Vulnerability Name:

CVE-2010-4203 (CCN-63011)

Assigned:2010-11-04
Published:2010-11-04
Updated:2020-07-31
Summary:WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
3.7 Low (REDHAT CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P)
2.7 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-190
Vulnerability Consequences:Gain Access
References:Source: CONFIRM
Type: Exploit, Issue Tracking, Mailing List, Vendor Advisory
http://code.google.com/p/chromium/issues/detail?id=60055

Source: MITRE
Type: CNA
CVE-2010-4203

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: CONFIRM
Type: Release Notes, Vendor Advisory
http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html

Source: CONFIRM
Type: Broken Link
http://review.webmproject.org/gitweb?p=libvpx.git;a=blob;f=CHANGELOG

Source: CONFIRM
Type: Broken Link
http://review.webmproject.org/gitweb?p=libvpx.git;a=commit;h=09bcc1f710ea65dc158639479288fb1908ff0c53

Source: CCN
Type: RHSA-2010-0999
Moderate: libvpx security update

Source: CCN
Type: SA42109
Google Chrome Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
42109

Source: CCN
Type: SA42118
libvpx Invalid Frame Memory Corruption Vulnerability

Source: SECUNIA
Type: Broken Link
42118

Source: SECUNIA
Type: Broken Link
42690

Source: SECUNIA
Type: Broken Link
42908

Source: GENTOO
Type: Third Party Advisory
GLSA-201101-03

Source: CCN
Type: GLSA-201101-03
libvpx: User-assisted execution of arbitrary code

Source: CCN
Type: OSVDB ID: 69169
Google Chrome WebM libvpx Unspecified Memory Corruption

Source: CCN
Type: BID-44646
Google Chrome prior to 7.0.517.44 Multiple Security Vulnerabilities

Source: CCN
Type: BID-44771
WebM libvpx Unspecified Memory Corruption Vulnerability

Source: VUPEN
Type: Permissions Required, Third Party Advisory
ADV-2011-0115

Source: XF
Type: UNKNOWN
google-chrome-libvpx-code-execution(63011)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:12198

Source: REDHAT
Type: Third Party Advisory
RHSA-2010:0999

Vulnerable Configuration:Configuration 1:
  • cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version < 7.0.517.44)

    • Configuration 2:
  • cpe:/a:webmproject:libvpx:*:*:*:*:*:*:*:* (Version < 0.9.5)

    • Configuration 3:
  • cpe:/o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:google:chrome:6.0.472.55:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:6.0.472.53:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:6.0.472.59:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:6.0.472.62:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.497.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.498.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.499.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.499.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.500.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.500.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.503.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.503.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.504.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.505.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.506.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.507.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.507.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.507.2:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.507.3:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.509.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.510.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.511.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.511.2:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.511.4:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.512.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.513.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.514.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:7.0.514.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:12758
    P
    		USN-1015-1 -- libvpx vulnerability
    2014-06-30
    oval:org.mitre.oval:def:23335
    P
    		ELSA-2010:0999: libvpx security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:22286
    P
    		RHSA-2010:0999: libvpx security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:12198
    V
    		Vulnerability in WebM libvpx (aka the VP8 Codec SDK) in Google Chrome before 7.0.517.44
    2013-08-12
    oval:com.redhat.rhsa:def:20100999
    P
    		RHSA-2010:0999: libvpx security update (Moderate)
    2010-12-20
    BACK
    google chrome *
    webmproject libvpx *
    redhat enterprise linux desktop 6.0
    redhat enterprise linux server 6.0
    redhat enterprise linux workstation 6.0
    google chrome 6.0.472.55
    google chrome 6.0.472.53
    google chrome 6.0.472.59
    google chrome 6.0.472.62
    google chrome 7.0.497.0
    google chrome 7.0.498.0
    google chrome 7.0.499.0
    google chrome 7.0.499.1
    google chrome 7.0.500.0
    google chrome 7.0.500.1
    google chrome 7.0.503.0
    google chrome 7.0.503.1
    google chrome 7.0.504.0
    google chrome 7.0.505.0
    google chrome 7.0.506.0
    google chrome 7.0.507.0
    google chrome 7.0.507.1
    google chrome 7.0.507.2
    google chrome 7.0.507.3
    google chrome 7.0.509.0
    google chrome 7.0.510.0
    google chrome 7.0.511.1
    google chrome 7.0.511.2
    google chrome 7.0.511.4
    google chrome 7.0.512.0
    google chrome 7.0.513.0
    google chrome 7.0.514.0
    google chrome 7.0.514.1
    gentoo linux *
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6