| Name | CVE-2010-0169 |
| Description | The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding this stylesheet to the XUL cache, which might allow remote attackers to modify the browser's font and other CSS attributes, and potentially disrupt rendering of a web page, by forcing the browser to perform this erroneous stylesheet caching. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-1999-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| icedove (PTS) | jessie | 1:52.3.0-4~deb8u2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| iceape | source | lenny | (not affected) | |||
| iceape | source | (unstable) | 2.0.3-1 | |||
| icedove | source | lenny | (unfixed) | end-of-life | ||
| icedove | source | (unstable) | 3.0.2-1 | |||
| iceweasel | source | lenny | (not affected) | |||
| iceweasel | source | (unstable) | 3.5.11-2 | |||
| xulrunner | source | lenny | 1.9.0.18-1 | DSA-1999-1 | ||
| xulrunner | source | (unstable) | 1.9.1.8-1 |
[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Lenny package only provide xpcom stubs)