dbcve.org
SafariWeb browser · Apple

CVE-2010-1119

HIGH · 10.0 CVSS v2.0 Published 2010-03-25
Fix available
A fix is available. Upgrade to after 4.0.5 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis
How this class of weakness works · CWE-399

A legacy NVD category grouping weaknesses in how resources — memory, file handles, connections — are allocated, used, and released. It gathers leaks, exhaustion, and lifecycle bugs under one label rather than naming a single flaw. The fix depends on the specific resource issue, generally pairing acquisition with release and bounding what any request can consume.

General guidance for the resource management errors class — the official description and references above are authoritative for this specific CVE. Want a bespoke review and a reviewed fix? Ask our team →

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
SafariWeb browser
Affected:<= 4.0.5= 1.0= 1.0.0= 1.0.0b1= 1.0.0b2= 1.0.1= 1.0.2= 1.0.3= 1.1= 1.1.0= 1.1.1= 1.2
Mac Os XOperating system
Affected:= 10.5= 10.5.0= 10.5.1= 10.5.2= 10.5.3= 10.5.4= 10.5.5= 10.5.6= 10.5.7= 10.5.8= 10.6.0
Mac Os X ServerOperating system
Affected:= 10.5.0= 10.5.1= 10.5.2= 10.5.3= 10.5.4= 10.5.5= 10.5.6= 10.5.7= 10.5.8= 10.6.0= 10.6.1= 10.6.2
Iphone OsOperating system
Affected:= 2.0= 2.0.0= 2.0.1= 2.0.2= 2.1= 2.1.1= 2.2= 2.2.1= 3.0= 3.0.1= 3.1= 3.1.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 4.0.5
Vendor patch lists.apple.com →
Recommended fix High confidence

Safari 5.0 (or later) for Mac OS X 10.5/10.6; Safari 4.1 (or later) for Mac OS X 10.4; iOS 4.0 (or later) for iPhone

  1. Upgrade Safari to version 5.0 or later for Mac OS X 10.5/10.6 and Windows systems
  2. Upgrade Safari to version 4.1 or later for Mac OS X 10.4 systems
  3. For iPhone OS (iOS) devices, upgrade to iOS 4.0 or later which includes the fixed Safari component
  4. Verify the Safari version by clicking Safari > About Safari (Mac) or Settings > Safari > About (iOS)
Caveat This is a security-only upgrade from 2010; ensure compatibility with legacy hardware and any required legacy plugins or extensions before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

We can identify the exact fixed release, upgrade, and verify it in staging — typical engagement from $1,950. Get the upgrade done

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2010-1119 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2010-1119 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data