The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted web site that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Mozilla XULrunner was upgraded to 1.9.0.17 fixing some bugs and regressions.

The following security bug has been fixed :

  - The nsObserverList::FillObserverArray function in     xpcom/ds/nsObserverList.cpp in Mozilla Firefox before     3.5.7 allows remote attackers to cause a denial of     service (application crash) via a crafted website that     triggers memory consumption and an accompanying Low     Memory alert dialog, and also triggers attempted removal     of an observer from an empty observers array.
    (CVE-2010-0220)

Mozilla Firefox was upgraded to 3.5.7 fixing some bugs and regressions.

The following security bug has been fixed :

  - The nsObserverList::FillObserverArray function in     xpcom/ds/nsObserverList.cpp in Mozilla Firefox before     3.5.7 allows remote attackers to cause a denial of     service (application crash) via a crafted website that     triggers memory consumption and an accompanying Low     Memory alert dialog, and also triggers attempted removal     of an observer from an empty observers array.
    (CVE-2010-0220)

Security issues were identified and fixed in firefox 3.5.x :

The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted website that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array (CVE-2010-0220).

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Mozilla Firefox was upgraded to 3.5.7 fixing some bugs and regressions.

CVE-2010-0220: The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted website that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array.

Mozilla Firefox was upgraded to 3.0.17 fixing some bugs and regressions.

CVE-2010-0220: The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted website that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array.

ID	Name	Product	Family	Severity
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
49899	SuSE 10 Security Update : Mozilla XULrunner (ZYPP Patch Number 6777)	Nessus	SuSE Local Security Checks	medium
49890	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6773)	Nessus	SuSE Local Security Checks	medium
48163	Mandriva Linux Security Advisory : firefox (MDVSA-2010:000)	Nessus	Mandriva Local Security Checks	medium
44381	SuSE 10 Security Update : Mozilla XULrunner (ZYPP Patch Number 6772)	Nessus	SuSE Local Security Checks	medium
44380	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6771)	Nessus	SuSE Local Security Checks	medium
44379	SuSE 11 Security Update : Mozilla XULrunner (SAT Patch Number 1778)	Nessus	SuSE Local Security Checks	medium
44374	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1779)	Nessus	SuSE Local Security Checks	medium
44370	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1774)	Nessus	SuSE Local Security Checks	medium
44364	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1780)	Nessus	SuSE Local Security Checks	medium
44358	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1780)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-0220

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium