CVE-2010-1986 - Vulnerability Details - OpenCVE

Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a P element, related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll, a different vulnerability than CVE-2009-1571.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows Xp
Mozilla	Firefox

Configuration 1 [-]

AND

cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.exploit-db.com/exploits/12678
http://www.osvdb.org/64791
http://www.securityfocus.com/archive/1/511329/100/0/threaded
http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/58761
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2010-05-20T17:00:00

Updated: 2024-08-07T02:17:13.284Z

Reserved: 2010-05-20T00:00:00

Link: CVE-2010-1986

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2010-05-20T17:30:01.490

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-1986

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-05-18T00:00:00", "descriptions": [{"lang": "en", "value": "Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a P element, related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll, a different vulnerability than CVE-2009-1571."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "64791", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/64791"}, {"name": "12678", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/12678"}, {"tags": ["x_refsource_MISC"], "url": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt"}, {"name": "20100518 Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/511329/100/0/threaded"}, {"name": "firefox-javascriptcode-dos(58761)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58761"}, {"name": "oval:org.mitre.oval:def:12433", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-1986", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a P element, related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll, a different vulnerability than CVE-2009-1571."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "64791", "refsource": "OSVDB", "url": "http://www.osvdb.org/64791"}, {"name": "12678", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/12678"}, {"name": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt", "refsource": "MISC", "url": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt"}, {"name": "20100518 Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/511329/100/0/threaded"}, {"name": "firefox-javascriptcode-dos(58761)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58761"}, {"name": "oval:org.mitre.oval:def:12433", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T02:17:13.284Z"}, "title": "CVE Program Container", "references": [{"name": "64791", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/64791"}, {"name": "12678", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/12678"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt"}, {"name": "20100518 Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/511329/100/0/threaded"}, {"name": "firefox-javascriptcode-dos(58761)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58761"}, {"name": "oval:org.mitre.oval:def:12433", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-1986", "datePublished": "2010-05-20T17:00:00", "dateReserved": "2010-05-20T00:00:00", "dateUpdated": "2024-08-07T02:17:13.284Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "AFD775DF-277E-4D5B-B980-B8E6E782467D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*", "matchCriteriaId": "CE477A73-4EE4-41E9-8694-5A3D5DC88656", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a P element, related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll, a different vulnerability than CVE-2009-1571."}, {"lang": "es", "value": "Mozilla Firefox v3.6.3 en Windows XP SP3 permite a atacantes remotos causar una denegaci\u00f3n del servicio (consumo de memoria y ca\u00edda de la aplicaci\u00f3n) a trav\u00e9s de c\u00f3digo JavaScript que crea arrays m\u00faltiples que contienen valores de cadena largos y a\u00f1aden caracteres al contenido del elemento P relacionado con la funci\u00f3n gfxWindowsFontGroup::MakeTextRun en xul.dll, diferente a la vulnerabilidad CVE-2009-1571."}], "id": "CVE-2010-1986", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-05-20T17:30:01.490", "references": [{"source": "cve@mitre.org", "url": "http://www.exploit-db.com/exploits/12678"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/64791"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/511329/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58761"}, {"source": "cve@mitre.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.exploit-db.com/exploits/12678"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/64791"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/511329/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58761"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12433"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "nvd@nist.gov", "type": "Primary"}]}