Description
The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista and Windows 7 configurations are used, does not properly restrict font-rendering attempts, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
References (8)
Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/53218
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2012/mfsa2012-25.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17067
Not Applicable, Permissions Required third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49055
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:081
Not Applicable, Permissions Required third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48972
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:066
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=744480
Scores
EPSS
0.0412
EPSS Percentile
89.6%
Details
CWE
CWE-119
Status
published
Products (34)
mozilla/firefox
4.0 (13 CPE variants)
mozilla/firefox
4.0.1
mozilla/firefox
5.0
mozilla/firefox
6.0
mozilla/firefox
6.0.1
mozilla/firefox
6.0.2
mozilla/firefox
7.0
mozilla/firefox
7.0.1
mozilla/firefox
8.0
mozilla/firefox
8.0.1
... and 24 more
Published
Apr 25, 2012
Tracked Since
Feb 18, 2026