CVE-2011-1290

Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.

• CWE-189

• http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
• http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00002.html
• http://osvdb.org/71182
• http://secunia.com/advisories/43735Vendor Advisory
• http://secunia.com/advisories/43748Vendor Advisory
• http://secunia.com/advisories/43782Vendor Advisory
• http://secunia.com/advisories/44151Vendor Advisory
• http://secunia.com/advisories/44154Vendor Advisory
• http://support.apple.com/kb/HT4596
• http://support.apple.com/kb/HT4607
• http://www.blackberry.com/btsc/KB26132
• http://www.debian.org/security/2011/dsa-2192
• http://www.securityfocus.com/archive/1/517513/100/0/threaded
• http://www.securityfocus.com/bid/46849
• http://www.securitytracker.com/id?1025212
• http://www.vupen.com/english/advisories/2011/0645Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0654Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0671
• http://www.vupen.com/english/advisories/2011/0984Vendor Advisory
• http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
• http://www.zerodayinitiative.com/advisories/ZDI-11-104
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66052
• http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
• http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html
• http://lists.apple.com/archives/security-announce/2011//Apr/msg00002.html
• http://osvdb.org/71182
• http://secunia.com/advisories/43735Vendor Advisory
• http://secunia.com/advisories/43748Vendor Advisory
• http://secunia.com/advisories/43782Vendor Advisory
• http://secunia.com/advisories/44151Vendor Advisory
• http://secunia.com/advisories/44154Vendor Advisory
• http://support.apple.com/kb/HT4596
• http://support.apple.com/kb/HT4607
• http://www.blackberry.com/btsc/KB26132
• http://www.debian.org/security/2011/dsa-2192
• http://www.securityfocus.com/archive/1/517513/100/0/threaded
• http://www.securityfocus.com/bid/46849
• http://www.securitytracker.com/id?1025212
• http://www.vupen.com/english/advisories/2011/0645Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0654Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0671
• http://www.vupen.com/english/advisories/2011/0984Vendor Advisory
• http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
• http://www.zerodayinitiative.com/advisories/ZDI-11-104
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66052

Published

Mar 11, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-1282The Client/Server Run-time Subsystem (aka CSRSS) in the Win3…8.4
• CVE-2011-1283The Client/Server Run-time Subsystem (aka CSRSS) in the Win3…
• CVE-2011-1284Integer overflow in the Client/Server Run-time Subsystem (ak…
• CVE-2011-1285The regular-expression functionality in Google Chrome before…
• CVE-2011-1286Google V8, as used in Google Chrome before 10.0.648.127, all…
• CVE-2011-1288WebKit, as used in Apple Safari before 5.0.6, allows remote …
• CVE-2011-1291Google Chrome before 10.0.648.204 does not properly handle b…
• CVE-2011-1292Use-after-free vulnerability in the frame-loader implementat…
• CVE-2011-1293Use-after-free vulnerability in the HTMLCollection implement…
• CVE-2011-1294Google Chrome before 10.0.648.204 does not properly handle C…
• CVE-2011-1295WebKit, as used in Google Chrome before 10.0.648.204 and App…
• CVE-2011-1296Google Chrome before 10.0.648.204 does not properly handle S…