National Cyber Awareness System

Vulnerability Summary for CVE-2010-3769

Overview

The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=608336

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=608336

External Source: VUPEN

Name: ADV-2011-0030

Hyperlink:http://www.vupen.com/english/advisories/2011/0030

External Source: SECTRACK

Name: 1024848

Hyperlink:http://www.securitytracker.com/id?1024848

External Source: SECTRACK

Name: 1024846

Hyperlink:http://www.securitytracker.com/id?1024846

External Source: BID

Name: 45345

Hyperlink:http://www.securityfocus.com/bid/45345

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2010/mfsa2010-75.html

Type: Advisory

Hyperlink:http://www.mozilla.org/security/announce/2010/mfsa2010-75.html

External Source: MANDRIVA

Name: MDVSA-2010:258

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:258

External Source: MANDRIVA

Name: MDVSA-2010:251

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:251

External Source: DEBIAN

Name: DSA-2132

Hyperlink:http://www.debian.org/security/2010/dsa-2132

External Source: SECUNIA

Name: 42818

Hyperlink:http://secunia.com/advisories/42818

External Source: SECUNIA

Name: 42716

Hyperlink:http://secunia.com/advisories/42716

External Source: OVAL

Name: oval:org.mitre.oval:def:12342

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12342

External Source: OSVDB

Name: 69771

Hyperlink:http://osvdb.org/69771

External Source: SUSE

Name: SUSE-SA:2011:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html

External Source: FEDORA

Name: FEDORA-2010-18920

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html

External Source: FEDORA

Name: FEDORA-2010-18890

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html

References to Check Content

Identifier:oval:org.mitre.oval:def:12342

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12342