CVE-2010-1028

2010-03-1921:30:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.862

Percentile

98.6%

JSON

Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0.

OSVersionArchitecturePackageVersionFilename
Debian12allcalibre< 2.38.0+dfsg-1calibre_2.38.0+dfsg-1_all.deb
Debian11allcalibre< 2.38.0+dfsg-1calibre_2.38.0+dfsg-1_all.deb
Debian999allcalibre< 2.38.0+dfsg-1calibre_2.38.0+dfsg-1_all.deb
Debian13allcalibre< 2.38.0+dfsg-1calibre_2.38.0+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	calibre	< 2.38.0+dfsg-1	calibre_2.38.0+dfsg-1_all.deb
Debian	11	all	calibre	< 2.38.0+dfsg-1	calibre_2.38.0+dfsg-1_all.deb
Debian	999	all	calibre	< 2.38.0+dfsg-1	calibre_2.38.0+dfsg-1_all.deb
Debian	13	all	calibre	< 2.38.0+dfsg-1	calibre_2.38.0+dfsg-1_all.deb