PT-2010-1980 · Mozilla · Firefox

Jesse Ruderman · Published 2010-03-25 · Updated 2024-06-15 · CVE-2010-0166

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.2

Description The issue is related to the gfxTextRun::SanitizeGlyphRuns function in the browser engine, specifically when the Core Text API is used on Mac OS X. It does not properly handle certain deletions, which can be exploited by remote attackers using an HTML document containing invisible Unicode characters, such as U+FEFF, U+FFF9, U+FFFA, and U+FFFB. This can lead to a denial of service due to memory corruption and application crash, and potentially allow the execution of arbitrary code.

Recommendations For Mozilla Firefox versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-0166

OPENSUSE-SU-2024:10071-1

Affected Products

Firefox

References · 908

• 🔥 https://exploit-db.com/exploits/33800 · Exploit
• http://mozilla.org/security/announce/2010/mfsa2010-11.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0166 · Security Note
• https://suse.com/security/cve/CVE-2012-1938 · Note
• https://suse.com/security/cve/CVE-2012-1965 · Note
• https://suse.com/security/cve/CVE-2011-3003 · Note
• https://suse.com/security/cve/CVE-2012-1950 · Note
• https://suse.com/security/cve/CVE-2014-1587 · Note
• https://suse.com/security/cve/CVE-2015-4483 · Note
• https://suse.com/security/cve/CVE-2011-3648 · Note
• https://suse.com/security/cve/CVE-2009-3389 · Note
• https://suse.com/security/cve/CVE-2012-3995 · Note
• https://suse.com/security/cve/CVE-2012-4217 · Note
• https://suse.com/security/cve/CVE-2015-0817 · Note