# CVEs published 2010-02-18 25 CVEs were published on February 18, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-0416](https://cve.now/CVE-2010-0416.md): Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and Rea (no CVSS) - [CVE-2010-0417](https://cve.now/CVE-2010-0417.md): Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (applic (no CVSS) - [CVE-2010-0643](https://cve.now/CVE-2010-0643.md): Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which al (no CVSS) - [CVE-2010-0644](https://cve.now/CVE-2010-0644.md): Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to o (no CVSS) - [CVE-2010-0645](https://cve.now/CVE-2010-0645.md): Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to ex (no CVSS) - [CVE-2010-0646](https://cve.now/CVE-2010-0646.md): Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attacke (no CVSS) - [CVE-2010-0647](https://cve.now/CVE-2010-0647.md): WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute arbitrary code in the Chrome sandbox vi (no CVSS) - [CVE-2010-0648](https://cve.now/CVE-2010-0648.md): Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a w (no CVSS) - [CVE-2010-0649](https://cve.now/CVE-2010-0649.md): Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall\_server.cc in Google Chrome before 4.0.249.89 a (no CVSS) - [CVE-2010-0650](https://cve.now/CVE-2010-0650.md): WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup window (no CVSS) - [CVE-2010-0651](https://cve.now/CVE-2010-0651.md): WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS styleshe (no CVSS) - [CVE-2010-0652](https://cve.now/CVE-2010-0652.md): Microsoft Internet Explorer permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and (no CVSS) - [CVE-2010-0653](https://cve.now/CVE-2010-0653.md): Opera before 10.10 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the styl (no CVSS) - [CVE-2010-0654](https://cve.now/CVE-2010-0654.md): Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0. (no CVSS) - [CVE-2010-0655](https://cve.now/CVE-2010-0655.md): Use-after-free vulnerability in Google Chrome before 4.0.249.78 allows user-assisted remote attackers to cause a denial of service (applicat (no CVSS) - [CVE-2010-0656](https://cve.now/CVE-2010-0656.md): WebKit before r51295, as used in Google Chrome before 4.0.249.78, presents a directory-listing page in response to an XMLHttpRequest for a f (no CVSS) - [CVE-2010-0657](https://cve.now/CVE-2010-0657.md): Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument i (no CVSS) - [CVE-2010-0658](https://cve.now/CVE-2010-0658.md): Multiple integer overflows in Skia, as used in Google Chrome before 4.0.249.78, allow remote attackers to execute arbitrary code in the Chro (no CVSS) - [CVE-2010-0659](https://cve.now/CVE-2010-0659.md): The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocati (no CVSS) - [CVE-2010-0660](https://cve.now/CVE-2010-0660.md): Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http (no CVSS) - [CVE-2010-0661](https://cve.now/CVE-2010-0661.md): WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attacker (no CVSS) - [CVE-2010-0662](https://cve.now/CVE-2010-0662.md): The ParamTraits\::Read function in common/common\_param\_traits.cc in Google Chrome before 4.0.249.78 does not use the correct variab (no CVSS) - [CVE-2010-0663](https://cve.now/CVE-2010-0663.md): The ParamTraits\::Read function in common/common\_param\_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory (no CVSS) - [CVE-2010-0664](https://cve.now/CVE-2010-0664.md): Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child\_process\_security\_policy.cc in Goo (no CVSS) - [CVE-2010-0556](https://cve.now/CVE-2010-0556.md): browser/login/login\_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Pas (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-02-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.