CVE-2010-1028

Published: 19 March 2010

Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.

Priority

Status

Package	Release	Status
firefox Launchpad, Ubuntu, Debian	dapper	Ignored (end of life)
	hardy	Not vulnerable
	intrepid	Does not exist
	jaunty	Does not exist
	karmic	Does not exist
	upstream	Released (3.6.2)

References

https://www.cve.org/CVERecord?id=CVE-2010-1028
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.