Mozilla Foundation Security Advisory 2010-29

2010-06-25T00:00:00
ID SECURITYVULNS:DOC:24122
Type securityvulns
Reporter Securityvulns
Modified 2010-06-25T00:00:00

Description

Mozilla Foundation Security Advisory 2010-29

Title: Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal Impact: Critical Announced: June 22, 2010 Reporter: Nils (MWR InfoSecurity) Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.4 Firefox 3.5.10 Thunderbird 3.0.5 SeaMonkey 2.0.5 Description

Security researcher Nils of MWR InfoSecurity reported that the routine for setting the text value for certain types of DOM nodes contained an integer overflow vulnerability. When a very long string was passed to this routine, the integer value used in creating a new memory buffer to hold the string would overflow, resulting in too small a buffer being allocated. An attacker could use this vulnerability to write data past the end of the buffer, causing a crash and potentially running arbitrary code on a victim's computer. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=534666
* CVE-2010-1196