This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours

Bug 630059 (CVE-2010-2767)

Summary: CVE-2010-2767 Mozilla Dangling pointer vulnerability using DOM plugin array (MFSA 2010-51)
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: ddumas, gecko-bugs-nobody, security-response-team, stransky, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20100907,reported=20100901,source=mozilla,impact=critical,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,rhel-4.8.z/firefox=affected,rhel-5.5.z/firefox=affected,rhel-6.0/firefox=affected,rhel-3/seamonkey=affected,rhel-4.9/seamonkey=affected,rhel-4/thunderbird=affected/impact=moderate/cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P,rhel-5/thunderbird=affected/impact=moderate/cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-12 14:59:33 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:

Description Josh Bressers 2010-09-03 11:47:28 EDT
Security researcher Sergey Glazunov reported a dangling pointer
vulnerability in the implementation of navigator.plugins in which the
navigator object could retain a pointer to the plugins array even after it
had been destroyed. An attacker could potentially use this issue to crash
the browser and run arbitrary code on a victim's computer.
Comment 1 Vincent Danen 2010-09-07 19:18:59 EDT
This is now public:

http://www.mozilla.org/security/announce/2010/mfsa2010-51.html
Comment 2 errata-xmlrpc 2010-09-07 20:06:47 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0682 https://rhn.redhat.com/errata/RHSA-2010-0682.html
Comment 3 errata-xmlrpc 2010-09-07 20:33:57 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0681 https://rhn.redhat.com/errata/RHSA-2010-0681.html
Comment 4 errata-xmlrpc 2010-09-07 21:10:07 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4

Via RHSA-2010:0680 https://rhn.redhat.com/errata/RHSA-2010-0680.html