« Back to list

CVE-2010-0040

Status: ModifiedHigh (9.3)—

Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Apple — Safari

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2010-0040",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-03-15T13:28:25.277",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://secunia.com/advisories/39135",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://support.apple.com/kb/HT4070",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://support.apple.com/kb/HT4105",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/38671",
      "tags": [
        "Patch"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/38674",
      "tags": [
        "Patch"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1023706",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56826",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6741",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/39135",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT4070",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT4105",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38671",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38674",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1023706",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56826",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6741",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de entero en ColorSync en Apple Safari anterior a 4.0.5 sobre Windows, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída de aplicación) a través de una imagen con un perfil de color manipulado que provoca un desbordamiento de búfer basado en memoria dinámica (heap)."
    }
  ],
  "lastModified": "2026-06-16T23:15:17.537",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1816CD6-0159-4684-A54D-94866D3FE570",
              "versionEndIncluding": "4.0.4"
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BDA6DB4-A0DA-43CA-AABD-10EEEEB28EAB"
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02EAC196-AE43-4787-9AF9-E79E2E1BBA46"
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2FD40E4-D4C9-492E-8432-ABC9BD2C7E67"
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36EA71E0-63F7-46FF-AF11-792741F27628"
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80E36485-565D-4FAA-A6AD-57DF42D47462"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "evaluatorComment": "Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html\r\n\r\n\r\n\r\nColorSync\r\nCVE-ID:  CVE-2010-0040\r\nAvailable for:  Windows 7, Vista, XP\r\nImpact:  Viewing a maliciously crafted image with an embedded color\r\nprofile may lead to an unexpected application termination or\r\narbitrary code execution\r\nDescription:  An integer overflow, that could result in a heap buffer\r\noverflow, exists in the handling of images with an embedded color\r\nprofile. Opening a maliciously crafted image with an embedded color\r\nprofile may lead to an unexpected application termination or\r\narbitrary code execution. The issue is addressed by performing\r\nadditional validation of color profiles. This issue does not affect\r\nMac OS X systems. Credit to Sebastien Renaud of VUPEN Vulnerability\r\nResearch Team for reporting this issue.\r\n",
  "sourceIdentifier": "product-security@apple.com",
  "evaluatorSolution": "Per:   http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html\r\n\r\n\r\n\r\n'Safari 4.0.5 is available via the Apple Software Update application,\r\nor Apple's Safari download site at:\r\nhttp://www.apple.com/safari/download/'\r\n"
}