CVE-2010-3168 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents6 sources
Severity
9.3CRITICALNVD
EPSS
5.4%
top 9.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedSep 9
Latest updateMay 17

Description

Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal, which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmozilla/firefox3.5.11+87
▶NVDmozilla/seamonkey2.0.6+40
▶NVDmozilla/thunderbird3.0.6+67

🔴Vulnerability Details

2
GHSA
GHSA-77mq-xmv8-43x5: Mozilla Firefox before 3↗2022-05-17
▶
CVEList
CVE-2010-3168: Mozilla Firefox before 3↗2010-09-09
▶

📋Vendor Advisories

5
Ubuntu
Firefox and Xulrunner regression↗2010-09-16
▶
Ubuntu
Thunderbird regression↗2010-09-16
▶
Ubuntu
Thunderbird vulnerabilities↗2010-09-08
▶
Ubuntu
Firefox and Xulrunner vulnerabilities↗2010-09-08
▶
Red Hat
Mozilla XUL tree removal crash and remote code execution (MFSA 2010-55)↗2010-09-07
▶

💬Community

1
Bugzilla
CVE-2010-3168 Mozilla XUL tree removal crash and remote code execution (MFSA 2010-55)↗2010-09-03
▶
CVE-2010-3168 — Mozilla Firefox vulnerability | cvebase