Vulnerability CVE-2010-2752
Published: 2010-07-30   Modified: 2012-02-13

Description:
Integer overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array, related to references to external font resources and an inconsistency between 16-bit and 32-bit integers.

See advisories in our WLB2 database:
Topic
Author
Date
High
Mozilla Firefox CSS font-face Remote Code Execution Vulnerability
Abysssec
30.09.2010

Type:

CWE-189

 (Numeric Errors)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Mozilla -> Firefox 
Mozilla -> Seamonkey 
Mozilla -> Thunderbird 

 References:
https://bugzilla.mozilla.org/show_bug.cgi?id=574059
http://www.zerodayinitiative.com/advisories/ZDI-10-133/
http://www.securityfocus.com/bid/41852
http://www.securityfocus.com/archive/1/512514
http://www.mozilla.org/security/announce/2010/mfsa2010-39.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11680
Copyright 2024, cxsecurity.com

 

Back to Top