Mozilla

mozilla

Mozilla Foundation Security Advisory 2010-53

Heap buffer overflow in nsTextFrameUtils::TransformText

Announced
September 7, 2010
Reporter
wushi
Impact
Critical
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 3.5.12
  • Firefox 3.6.9
  • SeaMonkey 2.0.7
  • Thunderbird 3.0.7
  • Thunderbird 3.1.3

Description

Security researcher wushi of team509 reported a heap buffer overflow in code routines responsible for transforming text runs. A page could be constructed with a bidirectional text run which upon reflow could result in an incorrect length being calculated for the run of text. When this value is subsequently used to allocate memory for the text too small a buffer may be created potentially resulting in a buffer overflow and the execution of attacker controlled memory.

References