PT-2010-1980 · Mozilla · Firefox

Jesse Ruderman · Publicado 2010-03-25 · Atualizado 2024-06-15 · CVE-2010-0166

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.2

Description The issue is related to the gfxTextRun::SanitizeGlyphRuns function in the browser engine, specifically when the Core Text API is used on Mac OS X. It does not properly handle certain deletions, which can be exploited by remote attackers using an HTML document containing invisible Unicode characters, such as U+FEFF, U+FFF9, U+FFFA, and U+FFFB. This can lead to a denial of service due to memory corruption and application crash, and potentially allow the execution of arbitrary code.

Recommendations For Mozilla Firefox versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-0166

OPENSUSE-SU-2024:10071-1

Produtos afetados

Firefox

Referências · 908

• 🔥 https://exploit-db.com/exploits/33800 · Exploit
• https://suse.com/security/cve/CVE-2012-1938 · Nota
• https://suse.com/security/cve/CVE-2012-1965 · Nota
• https://suse.com/security/cve/CVE-2011-3003 · Nota
• https://suse.com/security/cve/CVE-2012-1950 · Nota
• https://suse.com/security/cve/CVE-2014-1587 · Nota
• https://suse.com/security/cve/CVE-2015-4483 · Nota
• https://suse.com/security/cve/CVE-2011-3648 · Nota
• https://suse.com/security/cve/CVE-2009-3389 · Nota
• https://suse.com/security/cve/CVE-2012-3995 · Nota
• https://suse.com/security/cve/CVE-2012-4217 · Nota
• https://suse.com/security/cve/CVE-2015-0817 · Nota
• https://suse.com/security/cve/CVE-2015-7214 · Nota
• https://suse.com/security/cve/CVE-2016-9899 · Nota
• https://suse.com/security/cve/CVE-2014-1562 · Nota