Mozilla Foundation Security Advisory 2010-53

2010-09-10T00:00:00
ID SECURITYVULNS:DOC:24687
Type securityvulns
Reporter Securityvulns
Modified 2010-09-10T00:00:00

Description

Mozilla Foundation Security Advisory 2010-53

Title: Heap buffer overflow in nsTextFrameUtils::TransformText Impact: Critical Announced: September 7, 2010 Reporter: wushi Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey 2.0.7 Description

Security researcher wushi of team509 reported a heap buffer overflow in code routines responsible for transforming text runs. A page could be constructed with a bidirectional text run which upon reflow could result in an incorrect length being calculated for the run of text. When this value is subsequently used to allocate memory for the text too small a buffer may be created potentially resulting in a buffer overflow and the execution of attacker controlled memory. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=579655
* CVE-2010-3166