CVE-2010-0166
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in...
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
Exploit likelihood
What each source reports
NVD Score used
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
- Record
CVE-2010-0166- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
- Record
CVE-2010-0166- Updated
- 2026-11-02
EUVDEUVD-2010-0197 No score
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
- Record
EUVD-2010-0197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g5x4-8v96-9hwx No score
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in...
The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via an HTML document containing invisible Unicode characters, as demonstrated by the U+FEFF, U+FFF9, U+FFFA, and U+FFFB characters.
- Record
GHSA-g5x4-8v96-9hwx- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mozilla Firefox 3.6 - 'gfxTextRun::SanitizeGlyphRuns()' Remote Memory Corruption | 2010-03-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0166 is a medium vulnerability (CVSS 5.1) in Mozilla Firefox, published March 25, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.89%, the 94th percentile. No source names a fixed version.
References
securityfocus.com/bid/38918
bugzilla.mozilla.org/show_bug.cgi?id=538065
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14182
vupen.com/english/advisories/2010/0692
mozilla.org/security/announce/2010/mfsa2010-11.html
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2010-0166
github.com/advisories/GHSA-g5x4-8v96-9hwx
suse.com/security/cve/CVE-2008-5913
Left out here: 707 references. The JSON record has them.