A memory corruption flaw exists in multiple Mozilla products. The cairo_dwrite_font_face() function fails to sanitize user-supplied input when rendering fonts. This may potentially allow a remote attacker to execute arbitrary code.
Classification
Location:
Remote / Network Access,
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Private
Disclosure:
Vendor Verified,
Coordinated Disclosure
OSVDB:
Web Related
Solution
Upgrade Firefox and Thunderbird to version 12.0 or higher (10.0.4 for ESR) and SeaMonkey to version 2.9 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
