CVE-2010-1422

Description

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle changes to keyboard focus that occur during processing of key press events, which allows remote attackers to force arbitrary key presses via a crafted HTML document.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.08% Top 25%

Vendor Advisory mandriva.com Vendor Advisory apple.com Vendor Advisory ubuntu.com Vendor Advisory apple.com Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory apple.com Vendor Advisory secunia.com Vendor Advisory apple.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039	vendor advisory
http://support.apple.com/kb/HT4220
http://www.vupen.com/english/advisories/2010/2722	vdb entry
http://secunia.com/advisories/43068	third party advisory
http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html	vendor advisory
http://support.apple.com/kb/HT4334
http://www.ubuntu.com/usn/USN-1006-1	vendor advisory
http://secunia.com/advisories/41856	third party advisory
http://www.vupen.com/english/advisories/2011/0212	vdb entry
http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html	patch vendor advisory
http://secunia.com/advisories/40196	third party advisory
http://secunia.com/advisories/40105	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2010/1373	vdb entry patch vendor advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=552255
http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7591	vdb entry signature
http://secunia.com/advisories/42314	third party advisory
http://www.vupen.com/english/advisories/2010/1512	vdb entry
http://www.securityfocus.com/bid/40620	vdb entry patch
http://www.vupen.com/english/advisories/2011/0552	vdb entry
http://support.apple.com/kb/HT4456
http://securitytracker.com/id?1024067	vdb entry
http://support.apple.com/kb/HT4196	vendor advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2010-1422?: CVE-2010-1422 has been scored as a medium severity vulnerability.
How to fix CVE-2010-1422?: To fix CVE-2010-1422, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2010-1422 being actively exploited in the wild?: It is possible that CVE-2010-1422 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.