CVE-2010-1807
EXPLOITEDApple Safari 4.x-5.x - Remote Code Execution via Floating-Point Validation Flaw
Title source: llmExploitation Summary
CVE-2010-1807 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Itzhak Avraham, MJ Keith.
AI-analyzed exploit summary This exploit leverages a use-after-free vulnerability in WebKit (CVE-2010-1807) to achieve remote code execution on Android 2.0/2.1 devices. It uses a crafted HTML page with JavaScript to trigger the vulnerability and execute shellcode that connects to a specified IP and port.
Description
WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to non-standard NaN representation.
Exploits (2)
This exploit leverages a use-after-free vulnerability in WebKit (CVE-2010-1807) to achieve remote code execution on Android 2.0/2.1 devices. It uses a crafted HTML page with JavaScript to trigger the vulnerability and execute shellcode that connects to a specified IP and port.
This exploit targets CVE-2010-1807, a WebKit code execution vulnerability affecting Safari and Android browsers. It uses a heap spray technique to execute shellcode, delivering a reverse shell to a hardcoded IP and port.