Font Size Change

HOMEIT SecurityMeasures for Information Security VulnerabilitiesIPA/ISEC:Vulnerabilities:Security Alert for Vulnerability in Sleipnir and Grani


IT Security

IPA/ISEC:Vulnerabilities:Security Alert for Vulnerability in Sleipnir and Grani

Published: Oct 22, 2010

The Information-technology Promotion Agency (IPA, Chairman Kazumasa Fujie) announced a security alert on October 22, 2010, concerning security vulnerability in Sleipnir and Grani.
This vulnerability allows an attacker to execute arbitrary code when a user opens an HTML file stored in a particular folder.

To fix this vulnerability, update to the fixed version supplied by the vendor.


Sleipnir and Grani are web browsers. They are vulnerable to a flaw in the way they load DLL (Dynamic-Link Libraries). If exploited, there is a possibility that arbitrary code may be executed on the computers installed with Sleipnir and Grani.

To get a fixed version, go to the following URL.
For Sleipnir: (Japanese)
For Grani: (Japanese)

For the latest information, refer to the following URL:

The IPA first received a report concerning this vulnerability through the creditee below and the JPCERT Coordination Center (JPCERT/CC), in line with the Information Security Early Warning Partnership, made adjustments to clarify the matter with the vendor, and made the announcement public on October 22, 2010.

Credit Makoto Shiotsuki (Reported: September 27, 2010)


Involuntary operations may occur, such as the execution of unintended programs, the deletion of files, and the installation of malicious tools like viruses and bots when a user is guided to a shared folder, for example, on a file server and opens an HTML file there.

Security Alert for Vulnerability in Sleipnir and Grani


To fix this vulnerability, update to the fixed version provided by the vendor.

4.CVSS Severity

(1)Evaluation Result

Severity Rating
(CVSS base score)
□ Low
CVSS base score  

(2) Base Score Metrics

AV:Access Vector □ Local □ Adjacent
■ Network
AC:Access Complexity □ High ■ Medium □ Low
Au:Authentication □ Multiple □ Single ■ None
C:Confidentiality Impact □ None ■ Partial □ Complete
I:Integrity Impact □ None ■ Partial □ Complete
A:Availability Impact □ None ■ Partial □ Complete

■:Selected Values

5.CWE Type

This vulnerability has been CWE classified as "No Mapping (CWE-Other)".


IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)