CVE-2010-1199
NoneCVSS
—
EPSS
11.4%
Published
Jun 24, 2010
CISA due date
—
The record
Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:5.0 | xulrunner | 0 | 1.9.0.19-2 |
| Red Hat:enterprise_linux:3::as | seamonkey | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-chat | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-debuginfo | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-dom-inspector | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-js-debugger | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-mail | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-chat | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-mail | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-chat | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-debuginfo | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-dom-inspector | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-js-debugger | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-mail | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-chat | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-debuginfo | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-js-debugger | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-mail | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss-devel | 0 | 0:1.0.9-0.55.el3 |
| Red Hat:enterprise_linux:4::as | firefox | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::as | firefox-debuginfo | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-chat | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-debuginfo | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-devel | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-dom-inspector | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-js-debugger | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-mail | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::as | thunderbird | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::as | thunderbird-debuginfo | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox-debuginfo | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-chat | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-devel | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-mail | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::desktop | thunderbird | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::desktop | thunderbird-debuginfo | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::es | firefox | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::es | firefox-debuginfo | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-chat | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-debuginfo | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-devel | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-dom-inspector | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-js-debugger | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-mail | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::es | thunderbird | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::es | thunderbird-debuginfo | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::ws | firefox | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::ws | firefox-debuginfo | 0 | 0:3.6.4-8.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-chat | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-debuginfo | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-devel | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-js-debugger | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-mail | 0 | 0:1.0.9-58.el4_8 |
| Red Hat:enterprise_linux:4::ws | thunderbird | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:4::ws | thunderbird-debuginfo | 0 | 0:1.5.0.12-28.el4 |
| Red Hat:enterprise_linux:5::client | devhelp | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client | devhelp-debuginfo | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client | devhelp-devel | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client | esc | 0 | 0:1.1.0-12.el5 |
| Red Hat:enterprise_linux:5::client | esc-debuginfo | 0 | 0:1.1.0-12.el5 |
| Red Hat:enterprise_linux:5::client | firefox | 0 | 0:3.6.4-8.el5 |
| Red Hat:enterprise_linux:5::client | firefox-debuginfo | 0 | 0:3.6.4-8.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-extras | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-extras-debuginfo | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-gtkhtml2 | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-gtkmozembed | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-gtkspell | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | gnome-python2-libegg | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::client | thunderbird | 0 | 0:2.0.0.24-6.el5 |
| Red Hat:enterprise_linux:5::client | thunderbird-debuginfo | 0 | 0:2.0.0.24-6.el5 |
| Red Hat:enterprise_linux:5::client | totem | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client | totem-debuginfo | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client | totem-devel | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client | totem-mozplugin | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client | xulrunner | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::client | xulrunner-debuginfo | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::client | xulrunner-devel | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::client | yelp | 0 | 0:2.16.0-26.el5 |
| Red Hat:enterprise_linux:5::client | yelp-debuginfo | 0 | 0:2.16.0-26.el5 |
| Red Hat:enterprise_linux:5::client_workstation | devhelp | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client_workstation | devhelp-debuginfo | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client_workstation | devhelp-devel | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::client_workstation | totem | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | totem-debuginfo | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | totem-devel | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | totem-mozplugin | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-debuginfo | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-devel | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::server | devhelp | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::server | devhelp-debuginfo | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::server | devhelp-devel | 0 | 0:0.12-21.el5 |
| Red Hat:enterprise_linux:5::server | esc | 0 | 0:1.1.0-12.el5 |
| Red Hat:enterprise_linux:5::server | esc-debuginfo | 0 | 0:1.1.0-12.el5 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:3.6.4-8.el5 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:3.6.4-8.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-extras | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-extras-debuginfo | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-gtkhtml2 | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-gtkmozembed | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-gtkspell | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | gnome-python2-libegg | 0 | 0:2.14.2-7.el5 |
| Red Hat:enterprise_linux:5::server | totem | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::server | totem-debuginfo | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::server | totem-devel | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::server | totem-mozplugin | 0 | 0:2.16.7-7.el5 |
| Red Hat:enterprise_linux:5::server | xulrunner | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::server | xulrunner-debuginfo | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::server | xulrunner-devel | 0 | 0:1.9.2.4-10.el5 |
| Red Hat:enterprise_linux:5::server | yelp | 0 | 0:2.16.0-26.el5 |
| Red Hat:enterprise_linux:5::server | yelp-debuginfo | 0 | 0:2.16.0-26.el5 |
| Red Hat:rhel_productivity:5 | thunderbird | 0 | 0:2.0.0.24-6.el5 |
| Red Hat:rhel_productivity:5 | thunderbird-debuginfo | 0 | 0:2.0.0.24-6.el5 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 45.5.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2011-2371 Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x… Also affects xulrunner
- CVE-2010-3765 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… Also affects xulrunner
- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before… Also affects xulrunner
- CVE-2010-1205 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… Also affects xulrunner
- CVE-2010-0167 The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x… Also affects xulrunner
- CVE-2009-3382 layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x… Also affects xulrunner
- CVE-2009-3373 Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and… Also affects xulrunner
- CVE-2009-2464 The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before… Also affects xulrunner