1. CVE-Search
  2. CVE-2010-0164
ID CVE-2010-0164
Summary Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace animation in which the frames have different bits-per-pixel (bpp) values.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 10-10-2018 - 19:51)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
oval via4
accepted 2014-10-06T04:04:39.997-04:00
class vulnerability
contributors
  • name J. Daniel Brown
    organization DTCC
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
comment Mozilla Firefox Mainline release is installed
oval oval:org.mitre.oval:def:22259
description Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace animation in which the frames have different bits-per-pixel (bpp) values.
family windows
id oval:org.mitre.oval:def:8703
status accepted
submitted 2010-03-25T10:30:00.000-05:00
title Mozilla Firefox 'multipart/x-mixed-replace' Image Remote Memory Corruption Vulnerability
version 27
refmap via4
bid
  • 38918
  • 38921
bugtraq 20100402 ZDI-10-047: Mozilla Firefox libpr0n imgContainer Bits-Per-Pixel Change Remote Code Execution Vulnerability
confirm
mandriva MDVSA-2010:070
misc http://www.zerodayinitiative.com/advisories/ZDI-10-047
vupen ADV-2010-0692
Last major update 10-10-2018 - 19:51
Published 25-03-2010 - 21:00
Last modified 10-10-2018 - 19:51
Back to Top