Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-1121 | First vendor Publication | 2010-03-25 |
| Vendor | Cve | Last vendor Modification | 2017-09-19 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1121 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10924 | |||
| Oval ID: | oval:org.mitre.oval:def:10924 | ||
| Title: | Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010. | ||
| Description: | Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2010-1121 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13152 | |||
| Oval ID: | oval:org.mitre.oval:def:13152 | ||
| Title: | USN-943-1 -- thunderbird vulnerabilities | ||
| Description: | Martin Barbella discovered an integer overflow in an XSLT node sorting routine. An attacker could exploit this to overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. An integer overflow was discovered in Thunderbird. If a user were tricked into viewing malicious content, an attacker could overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Several flaws were discovered in the browser engine of Thunderbird. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. If was discovered that Thunderbird could be made to access freed memory. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-943-1 CVE-2010-1199 CVE-2010-1196 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-1121 | Version: | 5 |
| Platform(s): | Ubuntu 10.04 | Product(s): | thunderbird |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6844 | |||
| Oval ID: | oval:org.mitre.oval:def:6844 | ||
| Title: | Mozilla Firefox DOM Node Moving Use-After-Free Remote Code Execution Vulnerability | ||
| Description: | Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with garbage collection, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 2010. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-1121 | Version: | 11 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Mozilla Firefox |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for devhelp CESA-2010:0501 centos5 i386 File : nvt/gb_CESA-2010_0501_devhelp_centos5_i386.nasl |
| 2010-07-30 | Name : Ubuntu Update for Firefox and Xulrunner vulnerability USN-930-6 File : nvt/gb_ubuntu_USN_930_6.nasl |
| 2010-07-26 | Name : Ubuntu Update USN-930-5 File : nvt/gb_ubuntu_USN_930_5.nasl |
| 2010-07-26 | Name : Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-930-4 File : nvt/gb_ubuntu_USN_930_4.nasl |
| 2010-07-23 | Name : SuSE Update for MozillaFirefox,mozilla-xulrunner191 SUSE-SA:2010:030 File : nvt/gb_suse_2010_030.nasl |
| 2010-07-23 | Name : Fedora Update for thunderbird FEDORA-2010-11361 File : nvt/gb_fedora_2010_11361_thunderbird_fc12.nasl |
| 2010-07-23 | Name : Fedora Update for sunbird FEDORA-2010-11361 File : nvt/gb_fedora_2010_11361_sunbird_fc12.nasl |
| 2010-07-12 | Name : Ubuntu Update for thunderbird vulnerabilities USN-943-1 File : nvt/gb_ubuntu_USN_943_1.nasl |
| 2010-07-06 | Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox47.nasl |
| 2010-07-02 | Name : Ubuntu Update for firefox regression USN-930-3 File : nvt/gb_ubuntu_USN_930_3.nasl |
| 2010-07-02 | Name : Ubuntu Update for apturl, Epiphany, gecko-sharp, gnome-python-extras, liferea... File : nvt/gb_ubuntu_USN_930_2.nasl |
| 2010-07-02 | Name : Ubuntu Update for Firefox and Xulrunner vulnerabilities USN-930-1 File : nvt/gb_ubuntu_USN_930_1.nasl |
| 2010-06-28 | Name : RedHat Update for firefox RHSA-2010:0501-01 File : nvt/gb_RHSA-2010_0501-01_firefox.nasl |
| 2010-06-25 | Name : Fedora Update for mozvoikko FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_mozvoikko_fc12.nasl |
| 2010-06-25 | Name : RedHat Update for firefox RHSA-2010:0500-01 File : nvt/gb_RHSA-2010_0500-01_firefox.nasl |
| 2010-06-25 | Name : Fedora Update for seamonkey FEDORA-2010-10329 File : nvt/gb_fedora_2010_10329_seamonkey_fc12.nasl |
| 2010-06-25 | Name : Fedora Update for firefox FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_firefox_fc12.nasl |
| 2010-06-25 | Name : Mandriva Update for mozilla-thunderbird MDVSA-2010:126 (mozilla-thunderbird) File : nvt/gb_mandriva_MDVSA_2010_126.nasl |
| 2010-06-25 | Name : Fedora Update for galeon FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_galeon_fc12.nasl |
| 2010-06-25 | Name : Fedora Update for gnome-python2-extras FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_gnome-python2-extras_fc12.nasl |
| 2010-06-25 | Name : Fedora Update for seamonkey FEDORA-2010-10363 File : nvt/gb_fedora_2010_10363_seamonkey_fc13.nasl |
| 2010-06-25 | Name : Fedora Update for xulrunner FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_xulrunner_fc12.nasl |
| 2010-06-25 | Name : Fedora Update for perl-Gtk2-MozEmbed FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_perl-Gtk2-MozEmbed_fc12.nasl |
| 2010-06-25 | Name : Fedora Update for gnome-web-photo FEDORA-2010-10344 File : nvt/gb_fedora_2010_10344_gnome-web-photo_fc12.nasl |
| 2010-04-29 | Name : Mandriva Update for totem MDVA-2010:126 (totem) File : nvt/gb_mandriva_MDVA_2010_126.nasl |
| 2010-04-21 | Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox46.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 63457 | Mozilla Firefox Cross Document DOM Node Moving Arbitrary Code Execution (PWN2... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0501.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0500.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0499.nasl - Type : ACT_GATHER_INFO |
| 2013-01-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100622_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20100622_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_MozillaFirefox-100628.nasl - Type : ACT_GATHER_INFO |
| 2010-10-11 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-7083.nasl - Type : ACT_GATHER_INFO |
| 2010-08-09 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0500.nasl - Type : ACT_GATHER_INFO |
| 2010-07-27 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-6.nasl - Type : ACT_GATHER_INFO |
| 2010-07-26 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-5.nasl - Type : ACT_GATHER_INFO |
| 2010-07-26 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-4.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-11361.nasl - Type : ACT_GATHER_INFO |
| 2010-07-22 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0499.nasl - Type : ACT_GATHER_INFO |
| 2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_MozillaFirefox-100625.nasl - Type : ACT_GATHER_INFO |
| 2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_MozillaFirefox-100628.nasl - Type : ACT_GATHER_INFO |
| 2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_MozillaFirefox-100625.nasl - Type : ACT_GATHER_INFO |
| 2010-07-07 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-943-1.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-10344.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-3.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10329.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-10361.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-10363.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2010-6204.nasl - Type : ACT_GATHER_INFO |
| 2010-06-30 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-1.nasl - Type : ACT_GATHER_INFO |
| 2010-06-30 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-930-2.nasl - Type : ACT_GATHER_INFO |
| 2010-06-25 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_99858b7c7ece11dfa007000f20797ede.nasl - Type : ACT_GATHER_INFO |
| 2010-06-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0501.nasl - Type : ACT_GATHER_INFO |
| 2010-06-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-126.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0501.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : seamonkey_205.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0500.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0499.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_305.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_3510.nasl - Type : ACT_GATHER_INFO |
| 2010-04-09 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_ec8f449f40ed11df9edc000f20797ede.nasl - Type : ACT_GATHER_INFO |
| 2010-04-02 | Name : The remote Windows host contains a web browser that is affected by a remote c... File : mozilla_firefox_363.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:11:26 |
|
| 2021-04-22 01:11:54 |
|
| 2020-05-23 00:25:29 |
|
| 2017-09-19 09:23:42 |
|
| 2016-04-26 19:41:24 |
|
| 2014-02-17 10:54:23 |
|
| 2013-05-10 23:21:08 |
|
| 2012-11-07 05:19:19 |
|
