CVE-2010-3768

Mozilla add support for OTS font sanitizer (MFSA 2010-78)

Published Dec 10, 2010 CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Description
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation, which allows remote attackers to execute arbitrary code via vectors related to @font-face Cascading Style Sheets (CSS) rules.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2010-3747 Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation, which allows remote attackers to execute arbitrary code via vectors related to @font-face Cascading Style Sheets (CSS) rules.
Ubuntu USN Ubuntu USN USN-1019-1 Firefox and Xulrunner vulnerabilities
Ubuntu USN Ubuntu USN USN-1020-1 Thunderbird vulnerabilities
References
Link Providers
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052110.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052220.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html cve-icon cve-icon
http://secunia.com/advisories/42716 cve-icon cve-icon
http://secunia.com/advisories/42818 cve-icon cve-icon
http://support.avaya.com/css/P8/documents/100124650 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2010:251 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2010:258 cve-icon cve-icon
http://www.mozilla.org/security/announce/2010/mfsa2010-78.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2010-0966.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2010-0969.html cve-icon cve-icon
http://www.securityfocus.com/bid/45352 cve-icon cve-icon
http://www.securitytracker.com/id?1024846 cve-icon cve-icon
http://www.securitytracker.com/id?1024848 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-1019-1 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-1020-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2011/0030 cve-icon cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=527276 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=660420 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2010-3768 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12533 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2010-3768 cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 3:18 AM
Reserved
Oct 5, 2010, 12:00 AM
Status
Modified
Published
Dec 10, 2010, 7:00 PM
Modified
Jun 16, 2026, 11:23 PM
Severity
Critical
Public date
Dec 9, 2010, 12:00 AM