The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mozilla Firefox 3.6.x prior to 3.6.2. Such versions are potentially affected by multiple security issues :

 - The WOFF decoder contains an integer overflow in a font decrompression routine. (MFSA 2010-08)
 - Deleted image frames are reused when handling 'multipart/x-mixed-replace' images. (MFSA 2010-09)
 - The 'window.location' object is made a normal overridable object. (MFSA 2010-10)
 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)
 - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)
 - Documents fail to call certain security checks when attempting to preload images. (MFSA 2010-13)
 - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)
 - The asynchronous Authorization Prompt is not always attached to the correct window. (MFSA 2010-15)
 - Multiple crashes cna result in arbitrary code execution. (MFSA 2010-16)
 - An error exists in the way '<option>' elements are inserted into a XUL tree '<optgroup>'. (MFSA 2010-18)
 - An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA 2010-19)
 - A browser applet can be used to turn a simple mouse click into a drag-and-drop action, potentially resulting in the unintended loading of resources in a user's browser. (MFSA 2010-20)
 - Session renegotiations are not handled properly, which can be exploited to insert arbitrary plaintext by a man-in-the-middle. (MFSA 2010-22)
 - When an image points to a resource that redirects to a 'mailto: ' URL, the external mail handler application is launched. (MFSA 2010-23)
 - XML documents fail to call certain security checks when loading new content. (MFSA 2010-24)

The installed version of Mozilla Thunderbird is earlier than 3.0.2.  Such versions are potentially affected by the following security issues : 

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

  - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

Versions of Mozilla Thunderbird prior to 3.0.2 are affected by the following vulnerabilities :

 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-01)
 - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)
 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)
 - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)
 - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

The remote host is running a version of Mozilla Firefox earlier than 3.0.18, 3.5.8, 3.6.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-011)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

  - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

The remote host is running a version of Mozilla SeaMonkey earlier than 2.0.3.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

The remote host is running a version of SeaMonkey earlier than 2.0.3.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

The remote host is running a version of Mozilla Firefox earlier than 3.0.18, 3.5.8, 3.6.  Such versions are potentially affected by multiple vulnerabilities : 

 - Several crashes can result in arbitrary code execution. (MFSA 2010-01)
 - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)
 - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)
 - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)
 - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)
 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-011)
 - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)
 - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

ID	Name	Product	Family	Severity
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
5485	Mozilla Firefox 3.6.x < 3.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
801210	Mozilla Thunderbird < 3.0.2 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
5355	Mozilla Thunderbird < 3.0.2 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium
801279	Mozilla Firefox < 3.0.18 / 3.5.8 / 3.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801219	Mozilla SeaMonkey < 2.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5343	SeaMonkey < 2.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
5342	Mozilla Firefox < 3.0.18 / 3.5.8 / 3.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2010-0166

critical

Tenable Plugins

critical

medium

high

medium

high

high

medium

medium