Mozilla Foundation Security Advisory 2010-40

Mozilla Foundation Security Advisory 2010-40 Title: nsTreeSelection dangling pointer remote code execution vulnerability Impact: Critical Announced: July 20, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.7 Firefox...

Mozilla nsTreeSelection dangling pointer remote code execution vulnerability

Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-fre...

Mozilla Firefox 3.5.x < 3.5.11 Multiple Vulnerabilities

Binary data 5606.prm...

nsTreeSelection dangling pointer remote code execution vulnerability — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can...

Opera - Canvas Element (Denial of Service)

Opera - Canvas Element Denial of Service Opera.html function Opera canvas = document.getElementById"canvas"; ctx = canvas.getContext"2d"; ctx.getImageData0,0,0x20000,0x20000; Original Advisory: http://pouya.info/blog/userfiles/vul/OperaCC.pdf...

Opera Denial of Service by <canvas> Element

Exploit for windows platform in category dos / poc =========================================== Opera Denial of Service by Element =========================================== Opera.html function Opera canvas = document.getElementById"canvas"; ctx = canvas.getContext"2d";...

Opera - Canvas Element (Denial of Service)

Opera.html function Opera canvas = document.getElementById"canvas"; ctx = canvas.getContext"2d"; ctx.getImageData0,0,0x20000,0x20000; Original Advisory: http://pouya.info/blog/userfiles/vul/OperaCC.pdf...

CVE-2010-2663

Opera before 10.60 allows remote attackers to cause a denial of service application hang via an ended event handler that changes the SRC attribute of an AUDIO element...

CVE-2010-2664

Opera before 10.60 allows remote attackers to cause a denial of service application hang via certain HTML content that has an unclosed SPAN element with absolute positioning...

Design/Logic Flaw

Opera before 10.60 allows remote attackers to cause a denial of service application hang via certain HTML content that has an unclosed SPAN element with absolute positioning...

Code injection

Opera before 10.60 allows remote attackers to cause a denial of service application hang via an ended event handler that changes the SRC attribute of an AUDIO element...

CVE-2010-2663

Opera before 10.60 allows remote attackers to cause a denial of service application hang via an ended event handler that changes the SRC attribute of an AUDIO element...

CVE-2009-4924

Removed by vendor...

PYSEC-2010-1

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting XSS protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element...

CVE-2010-2480

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting XSS protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element...

Memory corruption

Use-after-free vulnerability in the Element::normalizeAttributes function in dom/Element.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via vectors related to handlers for DOM mutation...

CVE-2010-2300

Use-after-free vulnerability in the Element::normalizeAttributes function in dom/Element.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via vectors related to handlers for DOM mutation...

CVE-2010-2300

Use-after-free vulnerability in the Element::normalizeAttributes function in dom/Element.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via vectors related to handlers for DOM mutation...

CVE-2010-2300

Removed by vendor...

CVE-2010-1770

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Apple Safari before 4.1 on Mac OS X 10.4, and Google Chrome before 5.0.375.70 does not properly handle a transformation of a text node that has the IBM1147 character set, which allows remote attackers to execute arbitrar...