CVE-2010-2752

NameCVE-2010-2752
DescriptionInteger overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array, related to references to external font resources and an inconsistency between 16-bit and 32-bit integers.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
icedove (PTS)jessie (security), jessie1:52.3.0-4~deb8u2fixed
stretch (security), stretch1:52.3.0-4~deb9u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)2.0.6-1high
iceapesourcelenny(not affected)
icedovesource(unstable)3.0.6-1high
icedovesourcelenny(unfixed)end-of-life
iceweaselsource(unstable)3.5.11-2high
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.11-1high
xulrunnersourcelenny(not affected)

Notes

[lenny] - xulrunner <not-affected> (Only affects 1.9.1 and above)
[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Only a stub package)

Search for package or bug name: Reporting problems