Red Hat Bugzilla – Bug 568184
CVE-2010-0651 webkit: remote information disclosure
Last modified: 2015-08-19 04:43:56 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-0651 to the following vulnerability: WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. http://code.google.com/p/chromium/issues/detail?id=9877 http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs http://trac.webkit.org/changeset/52784 https://bugs.webkit.org/show_bug.cgi?id=29820 http://securitytracker.com/id?1023506
See bug #568231 for the bug filed for Firefox (CVE-2010-0654). The original report for this: http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html and an upstream WebKit bug report (currently not public): https://bugs.webkit.org/show_bug.cgi?id=29820
This has been addressed in Qt via: qt-4.6.2-8.fc12, qt-4.6.2-8.fc11, and qt-4.6.2-8.fc13 (see bug #570349).
Not sure when this was addressed in webkitgtk, but looking at the files in 1.2.0, this is corrected there. This means that Fedora 11 and 12 may still be problematic, but rawhide has 1.2.0 in it.
Adding CVE-2010-0051 as another bug alias based on: https://bugzilla.redhat.com/show_bug.cgi?id=570349#c3