CVE-2010-3768 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation7 documents6 sources
Severity
9.3CRITICALNVD
EPSS
6.1%
top 9.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird
Timeline
PublishedDec 10
Latest updateMay 17

Description

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation, which allows remote attackers to execute arbitrary code via vectors related to @font-face Cascading Style Sheets (CSS) rules.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmozilla/firefox3.5.15+95
▶NVDmozilla/seamonkey2.0.10+43
▶NVDmozilla/thunderbird3.0.10+77

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-qrwh-98p4-jg32: Mozilla Firefox before 3↗2022-05-17
▶
CVEList
CVE-2010-3768: Mozilla Firefox before 3↗2010-12-10
▶

📋Vendor Advisories

3
Ubuntu
Firefox and Xulrunner vulnerabilities↗2010-12-09
▶
Red Hat
Mozilla add support for OTS font sanitizer (MFSA 2010-78)↗2010-12-09
▶
Ubuntu
Thunderbird vulnerabilities↗2010-12-09
▶

💬Community

1
Bugzilla
CVE-2010-3768 Mozilla add support for OTS font sanitizer (MFSA 2010-78)↗2010-12-06
▶
CVE-2010-3768 — Improper Input Validation in Mozilla | cvebase