PT-2010-2749 · Mozilla · Firefox

Published 2010-03-19 · Updated 2024-12-12 · CVE-2010-1028

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.6 through 3.6.1 Mozilla Firefox versions 3.7 alpha 1 through 3.7 alpha 2

Description The issue is related to an integer overflow in the decompression functionality of the Web Open Fonts Format (WOFF) decoder. This allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow.

Recommendations For Mozilla Firefox versions 3.6 through 3.6.1, update to version 3.6.2 or later. For Mozilla Firefox versions 3.7 alpha 1 through 3.7 alpha 2, update to version 3.7 alpha 3 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-1028

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

ZDI-10-064

Affected Products

Firefox

References · 2073

• http://secunia.com/community/forum/thread/show/3592 · Vendor Advisory
• http://mozilla.org/security/announce/2010/mfsa2010-08.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1028 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-064 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://secunia.com/advisories/38608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1028 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-1028 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1028 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2012-4192 · Note
• https://suse.com/security/cve/CVE-2019-9798 · Note
• https://suse.com/security/cve/CVE-2020-16044 · Note
• https://suse.com/security/cve/CVE-2024-10467 · Note
• https://suse.com/security/cve/CVE-2023-25743 · Note