FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-3131

This CVE name corresponds to:

Entered	Topic
2010-09-08	mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-3131 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-3131
Phase	Assigned(20100826)

Description

Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.

References

Source	Reference
BUGTRAQ	20100824 Firefox <= 3.6.8 DLL Hijacking Exploit [dwmapi.dll]
EXPLOIT-DB	14783
EXPLOIT-DB	14730
CONFIRM	http://www.mozilla.org/security/announce/2010/mfsa2010-52.html
CONFIRM	https://bugzilla.mozilla.org/show_bug.cgi?id=579593
SUSE	SUSE-SA:2010:049
OVAL	oval:org.mitre.oval:def:12143
SECUNIA	41095
SECUNIA	41168
VUPEN	ADV-2010-2169
VUPEN	ADV-2010-2201
VUPEN	ADV-2010-2323