CVE-2010-3769
Published: 10 December 2010
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
Notes
Author | Note |
---|---|
jdstrand | Ubuntu 11.04 (Natty Narwhal) has 4.0b7. Fixes will be in 4.0b8. thunderbird low (javascript not enabled by default) |
Priority
Status
Package | Release | Status |
---|---|---|
firefox Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
hardy |
Ignored
(end of life)
|
|
karmic |
Does not exist
|
|
lucid |
Released
(3.6.13+build3+nobinonly-0ubuntu0.10.04.1)
|
|
maverick |
Released
(3.6.13+build3+nobinonly-0ubuntu0.10.10.1)
|
|
natty |
Released
(4.0~b8+nobinonly-0ubuntu3)
|
|
upstream |
Released
(3.6.13)
|
|
firefox-3.0 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Released
(3.6.13+build3+nobinonly-0ubuntu0.8.04.1)
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
upstream |
Needs triage
(Ubuntu source uses 3.6.x)
|
|
firefox-3.5 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
karmic |
Released
(3.6.13+build3+nobinonly-0ubuntu0.9.10.1)
|
|
lucid |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
upstream |
Needs triage
(Ubuntu source uses 3.6.x)
|
|
seamonkey Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Released
(2.0.11+build1+nobinonly-0ubuntu0.8.04.1)
|
|
karmic |
Released
(2.0.11+build1+nobinonly-0ubuntu0.9.10.1)
|
|
lucid |
Released
(2.0.11+build1+nobinonly-0ubuntu0.10.04.1)
|
|
maverick |
Released
(2.0.11+build1+nobinonly-0ubuntu0.10.10.1)
|
|
natty |
Released
(2.0.11+build1+nobinonly-0ubuntu1)
|
|
upstream |
Released
(2.0.11)
|
|
thunderbird Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Ignored
(end of life)
|
|
karmic |
Ignored
(end of life)
|
|
lucid |
Released
(3.1.7+build3+nobinonly-0ubuntu0.10.04.1)
|
|
maverick |
Released
(3.1.7+build3+nobinonly-0ubuntu0.10.10.1)
|
|
natty |
Released
(3.1.7+build3+nobinonly-0ubuntu2)
|
|
upstream |
Released
(3.1.7)
|
|
xulrunner-1.9.2 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Released
(1.9.2.13+build3+nobinonly-0ubuntu0.8.04.1)
|
|
karmic |
Released
(1.9.2.13+build3+nobinonly-0ubuntu0.9.10.1)
|
|
lucid |
Released
(1.9.2.13+build3+nobinonly-0ubuntu0.10.04.1)
|
|
maverick |
Released
(1.9.2.13+build3+nobinonly-0ubuntu0.10.10.1)
|
|
natty |
Released
(1.9.2.13+build3+nobinonly-0ubuntu1)
|
|
upstream |
Needs triage
|