HOMEVULNERABILITIESCVE-2010-4206
HIGH

CVE-2010-4206

CWE-787Published: November 6, 2010· Updated: Jun 16, 2026

8.8
CVSS v3.1

Official Description

Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG document, related to effects in the application of filters.

NVD Source

Technical Analysis

CVE-2010-4206 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionRequired
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors & Products

Fedora1 product(s)
fedora
Google1 product(s)
chrome
webkitgtk1 product(s)
webkitgtk
Source: NVD CPE · 3 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://trac.webkit.org/changeset/70652
PATCHhttp://trac.webkit.org/changeset/70652
ADVISORYhttp://code.google.com/p/chromium/issues/detail?id=60688
ADVISORYhttp://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html
ADVISORYhttp://www.securityfocus.com/bid/45721
ADVISORYhttp://www.vupen.com/english/advisories/2011/0216
ADVISORYhttp://www.vupen.com/english/advisories/2011/0552
ADVISORYhttps://bugs.webkit.org/show_bug.cgi?id=48371
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=656129
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11949
ADVISORYhttp://code.google.com/p/chromium/issues/detail?id=60688
ADVISORYhttp://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html
ADVISORYhttp://www.securityfocus.com/bid/45721
ADVISORYhttp://www.vupen.com/english/advisories/2011/0216
ADVISORYhttp://www.vupen.com/english/advisories/2011/0552
ADVISORYhttps://bugs.webkit.org/show_bug.cgi?id=48371
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=656129
ADVISORYhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11949

All References (28)

→
http://code.google.com/p/chromium/issues/detail?id=60688Exploit · Issue Tracking · Mailing List · Vendor Advisory
→
http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.htmlRelease Notes · Vendor Advisory
→
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.htmlMailing List · Third Party Advisory
→
http://secunia.com/advisories/42109Broken Link
→
http://secunia.com/advisories/43086Broken Link
→
http://trac.webkit.org/changeset/70652Mailing List · Patch · Vendor Advisory
→
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039Broken Link
→
http://www.redhat.com/support/errata/RHSA-2011-0177.htmlNot Applicable
→
http://www.securityfocus.com/bid/45721Third Party Advisory · VDB Entry
→
http://www.vupen.com/english/advisories/2011/0216Permissions Required · Third Party Advisory
→
http://www.vupen.com/english/advisories/2011/0552Permissions Required · Third Party Advisory
→
https://bugs.webkit.org/show_bug.cgi?id=48371Permissions Required · Vendor Advisory
→
https://bugzilla.redhat.com/show_bug.cgi?id=656129Issue Tracking · Third Party Advisory
→
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11949Third Party Advisory
→
http://code.google.com/p/chromium/issues/detail?id=60688Exploit · Issue Tracking · Mailing List · Vendor Advisory

Quick Facts

CVE IDCVE-2010-4206
CVSS Score8.8 / 10
SeverityHIGH
WeaknessCWE-787
CISA KEVNo
Affected3 vendor(s)
PublishedNov 6, 2010

Related CVEs (CWE-787)

CVE-2012-0751
10.0
CVE-2018-3991
10.0
CVE-2004-0574
10.0
CVE-2002-2227
10.0
CVE-2013-5610
10.0
CVE-2019-6235
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2010-4206 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2010-4206·NVD