Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal, which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2106-1 | New xulrunner packages fix several vulnerabilities |
Debian DSA |
DSA-2106-2 | New xulrunner packages fix regression |
EUVD |
EUVD-2010-3168 | Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict the role of property changes in triggering XUL tree removal, which allows remote attackers to cause a denial of service (deleted memory access and application crash) or possibly execute arbitrary code by setting unspecified properties. |
Ubuntu USN |
USN-975-1 | Firefox and Xulrunner vulnerabilities |
Ubuntu USN |
USN-978-1 | Thunderbird vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-07T03:03:18.399Z
Reserved: 2010-08-27T00:00:00
Link: CVE-2010-3168
No data.
Status : Deferred
Published: 2010-09-09T19:00:02.717
Modified: 2025-04-11T00:51:21.963
Link: CVE-2010-3168
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
EUVD
Ubuntu USN