FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-0160

This CVE name corresponds to:

Entered Topic
2010-02-18 mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2010-0160
Phase Assigned(20100106)

Description

The Web Worker functionality in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly handle array data types for posted messages, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

References

Source Reference
BUGTRAQ 20100402 ZDI-10-046: Mozilla Firefox Web Worker Array Remote Code Execution Vulnerability
MISC http://www.zerodayinitiative.com/advisories/ZDI-10-046
CONFIRM http://www.mozilla.org/security/announce/2010/mfsa2010-02.html
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=531222
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=533000
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=534051
DEBIAN DSA-1999
FEDORA FEDORA-2010-1727
FEDORA FEDORA-2010-1932
FEDORA FEDORA-2010-1936
MANDRIVA MDVSA-2010:042
REDHAT RHSA-2010:0112
SUSE SUSE-SA:2010:015
UBUNTU USN-895-1
UBUNTU USN-896-1
OVAL oval:org.mitre.oval:def:11166
OVAL oval:org.mitre.oval:def:8465
SECUNIA 37242
SECUNIA 38847
VUPEN ADV-2010-0405
XF mozilla-webworkers-code-execution(56360)