CVE-2010-1199
Fixed in a distro release EPSS 11%
Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.
Products: mozilla firefox, mozilla seamonkey, mozilla thunderbird
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.19-2 |
| Red Hat Enterprise Linux 3 | seamonkey | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-chat | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-debuginfo | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-devel | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-dom-inspector | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-js-debugger | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-mail | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr-devel | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss-devel | 0:1.0.9-0.55.el3 |
| Red Hat Enterprise Linux 4 | firefox | 0:3.6.4-8.el4 |
| Red Hat Enterprise Linux 4 | firefox-debuginfo | 0:3.6.4-8.el4 |
| Red Hat Enterprise Linux 4 | seamonkey | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-chat | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-debuginfo | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-devel | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-dom-inspector | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-js-debugger | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-mail | 0:1.0.9-58.el4_8 |
| Red Hat Enterprise Linux 4 | thunderbird | 0:1.5.0.12-28.el4 |
| Red Hat Enterprise Linux 4 | thunderbird-debuginfo | 0:1.5.0.12-28.el4 |
| Red Hat Enterprise Linux 5 | devhelp | 0:0.12-21.el5 |
| Red Hat Enterprise Linux 5 | devhelp-debuginfo | 0:0.12-21.el5 |
| Red Hat Enterprise Linux 5 | devhelp-devel | 0:0.12-21.el5 |
| Red Hat Enterprise Linux 5 | esc | 0:1.1.0-12.el5 |
| Red Hat Enterprise Linux 5 | esc-debuginfo | 0:1.1.0-12.el5 |
| Red Hat Enterprise Linux 5 | firefox | 0:3.6.4-8.el5 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:3.6.4-8.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-extras | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-extras-debuginfo | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-gtkhtml2 | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-gtkmozembed | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-gtkspell | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | gnome-python2-libegg | 0:2.14.2-7.el5 |
| Red Hat Enterprise Linux 5 | thunderbird | 0:2.0.0.24-6.el5 |
| Red Hat Enterprise Linux 5 | thunderbird-debuginfo | 0:2.0.0.24-6.el5 |
| Red Hat Enterprise Linux 5 | totem | 0:2.16.7-7.el5 |
| Red Hat Enterprise Linux 5 | totem-debuginfo | 0:2.16.7-7.el5 |
| Red Hat Enterprise Linux 5 | totem-devel | 0:2.16.7-7.el5 |
| Red Hat Enterprise Linux 5 | totem-mozplugin | 0:2.16.7-7.el5 |
| Red Hat Enterprise Linux 5 | xulrunner | 0:1.9.2.4-10.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-debuginfo | 0:1.9.2.4-10.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-devel | 0:1.9.2.4-10.el5 |
| Red Hat Enterprise Linux 5 | yelp | 0:2.16.0-26.el5 |
| Red Hat Enterprise Linux 5 | yelp-debuginfo | 0:2.16.0-26.el5 |
| Red Hat rhel productivity 5 | thunderbird | 0:2.0.0.24-6.el5 |
| Red Hat rhel productivity 5 | thunderbird-debuginfo | 0:2.0.0.24-6.el5 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |