CVE-2010-3813

N/A

Published: November 20, 2010 at 09:00 PM UTC

Updated: June 16, 2026 at 11:23 PM UTC

4 products affected across 1 vendorSafariWebkitmacOS· also runs on 3 platforms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 2%

Description

The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled when processing an HTML LINK element, which allows remote attackers to bypass intended access restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Safari · Apple

95%

v ≤ 4.1.2v ≤ 5.0.21.0 1.0 beta 1.0 beta2 1.0.0 1.0.0b1 1.0.0b2 1.0.1 1.0.2 1.0.3 1.0.3 85.8 1.0.3 85.8.1 1.1 1.1.0 1.1.1 1.2 1.2.0 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5 1.3 1.3.0 1.3.1 1.3.2 1.3.2 312.5 1.3.2 312.6 2 2.0 2.0.0 2.0.1 2.0.2 2.0.3 2.0.3 417.8 2.0.3 417.9 2.0.3 417.9.22.0.3 417.9.32.0.4 3 3.0 3.0.0 3.0.0b 3.0.1 3.0.1b 3.0.2 3.0.2b 3.0.3 3.0.3b 3.0.4 3.0.4b 3.1.0 3.1.0b 3.1.1 3.1.2 3.2.0 3.2.1 3.2.2 4.1 4.1.1 5.0 5.0.1

apple-mac-os-x-server (environment) · apple-macos (environment) · microsoft-windows-7 (environment) · microsoft-windows-vista (environment) · microsoft-windows-xp (environment)

Webkit · Apple

95%

All versions

apple-mac-os-x-server (environment) · apple-macos (environment) · microsoft-windows-7 (environment) · microsoft-windows-vista (environment) · microsoft-windows-xp (environment)

Mac OS X Server · Appledevice

80%

All versions

macOS · Appledevice

80%

All versions