Mozilla Foundation Security Advisory 2010-53

Mozilla Foundation Security Advisory 2010-53

Title: Heap buffer overflow in nsTextFrameUtils::TransformText
Impact: Critical
Announced: September 7, 2010
Reporter: wushi
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.9
Firefox 3.5.12
Thunderbird 3.1.3
Thunderbird 3.0.7
SeaMonkey 2.0.7
Description

Security researcher wushi of team509 reported a heap buffer overflow in code routines responsible for transforming text runs. A page could be constructed with a bidirectional text run which upon reflow could result in an incorrect length being calculated for the run of text. When this value is subsequently used to allocate memory for the text too small a buffer may be created potentially resulting in a buffer overflow and the execution of attacker controlled memory.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=579655
* CVE-2010-3166