CVE-2010-2767

Mozilla Firefox <3.5.12 & 3.6.x <3.6.9 - DoS/Code Injection

Title source: llm

Description

The navigator.plugins implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle destruction of the DOM plugin array, which might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted access to the navigator object, related to a "dangling pointer vulnerability."

References (14)

Core 14

Core References

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11969

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=584512

Various Sources x_refsource_confirm

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html

Vendor Advisory x_refsource_confirm

http://support.avaya.com/css/P8/documents/100110210

Vendor Advisory x_refsource_confirm

http://support.avaya.com/css/P8/documents/100112690

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/42867

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2011/0061

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/61658

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:173

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2010/2323

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2010/dsa-2106

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2010/mfsa2010-51.html

Scores

EPSS 0.0468

EPSS Percentile 90.8%

Details

CWE

CWE-399

Status published

Products (47)

mozilla/firefox 3.6

mozilla/firefox 3.6.2

mozilla/firefox 3.6.3

mozilla/firefox 3.6.4

mozilla/firefox 3.6.6

mozilla/firefox 3.6.7

mozilla/firefox 3.6.8

mozilla/firefox 1.0 (2 CPE variants)

mozilla/firefox 1.0.1

mozilla/firefox 1.0.2

... and 37 more

Published Sep 09, 2010

Tracked Since Feb 18, 2026