CVE-2008-2785 Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue arra...
HighCVSS 9.3
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 2.0.0.15 | No fix listed |
| mozilla Firefox | = 2.0 | No fix listed |
| mozilla Firefox | = 2.0.0.1 | No fix listed |
| mozilla Firefox | = 2.0.0.2 | No fix listed |
| mozilla Firefox | = 2.0.0.3 | No fix listed |
| mozilla Firefox | = 2.0.0.4 | No fix listed |
| mozilla Firefox | = 2.0.0.5 | No fix listed |
| mozilla Firefox | = 2.0.0.6 | No fix listed |
| mozilla Firefox | = 2.0.0.7 | No fix listed |
| mozilla Firefox | = 2.0.0.8 | No fix listed |
| mozilla Firefox | = 2.0.0.9 | No fix listed |
| mozilla Firefox | = 2.0.0.10 | No fix listed |
| mozilla Firefox | = 2.0.0.11 | No fix listed |
| mozilla Firefox | = 2.0.0.12 | No fix listed |
| mozilla Firefox | = 2.0.0.13 | No fix listed |
| mozilla Firefox | = 2.0.0.14 | No fix listed |
| mozilla Firefox | = 3.0 | No fix listed |
| mozilla seamonkey | <= 1.1.10 | No fix listed |
| mozilla seamonkey | = 1.0 | No fix listed |
| mozilla seamonkey | = 1.0-alpha | No fix listed |
| mozilla seamonkey | = 1.0-beta | No fix listed |
| mozilla seamonkey | = 1.0.1 | No fix listed |
| mozilla seamonkey | = 1.0.2 | No fix listed |
| mozilla seamonkey | = 1.0.3 | No fix listed |
| mozilla seamonkey | = 1.0.4 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla seamonkey | = 1.0.5 | No fix listed |
| mozilla seamonkey | = 1.0.6 | No fix listed |
| mozilla seamonkey | = 1.0.7 | No fix listed |
| mozilla seamonkey | = 1.0.8 | No fix listed |
| mozilla seamonkey | = 1.0.9 | No fix listed |
| mozilla seamonkey | = 1.1 | No fix listed |
| mozilla seamonkey | = 1.1-alpha | No fix listed |
| mozilla seamonkey | = 1.1-beta | No fix listed |
| mozilla seamonkey | = 1.1.1 | No fix listed |
| mozilla seamonkey | = 1.1.2 | No fix listed |
| mozilla seamonkey | = 1.1.3 | No fix listed |
| mozilla seamonkey | = 1.1.4 | No fix listed |
| mozilla seamonkey | = 1.1.5 | No fix listed |
| mozilla seamonkey | = 1.1.6 | No fix listed |
| mozilla seamonkey | = 1.1.7 | No fix listed |
| mozilla seamonkey | = 1.1.8 | No fix listed |
| mozilla seamonkey | = 1.1.9 | No fix listed |
| mozilla Thunderbird | <= 2.0.0.14 | No fix listed |
| mozilla Thunderbird | = 0.1 | No fix listed |
| mozilla Thunderbird | = 0.2 | No fix listed |
| mozilla Thunderbird | = 0.3 | No fix listed |
| mozilla Thunderbird | = 0.4 | No fix listed |
| mozilla Thunderbird | = 0.5 | No fix listed |
| mozilla Thunderbird | = 0.6 | No fix listed |
| mozilla Thunderbird | = 0.7 | No fix listed |
| mozilla Thunderbird | = 0.8 | No fix listed |
| mozilla Thunderbird | = 0.9 | No fix listed |
| mozilla Thunderbird | = 1.0 | No fix listed |
| mozilla Thunderbird | = 1.0.2 | No fix listed |
| mozilla Thunderbird | = 1.0.5 | No fix listed |
| mozilla Thunderbird | = 1.0.6 | No fix listed |
| mozilla Thunderbird | = 1.0.7 | No fix listed |
| mozilla Thunderbird | = 1.0.8 | No fix listed |
| mozilla Thunderbird | = 1.5 | No fix listed |
| mozilla Thunderbird | = 1.5.0.2 | No fix listed |
| mozilla Thunderbird | = 1.5.0.4 | No fix listed |
| mozilla Thunderbird | = 1.5.0.5 | No fix listed |
| mozilla Thunderbird | = 1.5.0.7 | No fix listed |
| mozilla Thunderbird | = 1.5.0.8 | No fix listed |
| mozilla Thunderbird | = 1.5.0.9 | No fix listed |
| mozilla Thunderbird | = 1.5.0.10 | No fix listed |
| mozilla Thunderbird | = 1.5.0.12 | No fix listed |
| mozilla Thunderbird | = 1.5.0.13 | No fix listed |
| mozilla Thunderbird | = 1.5.0.14 | No fix listed |
| mozilla Thunderbird | = 2.0.0.0 | No fix listed |
| mozilla Thunderbird | = 2.0.0.4 | No fix listed |
| mozilla Thunderbird | = 2.0.0.5 | No fix listed |
| mozilla Thunderbird | = 2.0.0.6 | No fix listed |
| mozilla Thunderbird | = 2.0.0.9 | No fix listed |
| mozilla Thunderbird | = 2.0.0.12 | No fix listed |
References
- blog.mozilla.com
- dvlabs.tippingpoint.com
- RHSA-2008:0616 vendor-advisory
- 30761 third-party-advisory vendor-advisory
- 31121 third-party-advisory
- 31122 third-party-advisory vendor-advisory
- 31129 third-party-advisory vendor-advisory
- 31144 third-party-advisory
- 31145 third-party-advisory vendor-advisory
- 31154 third-party-advisory vendor-advisory
- 31157 third-party-advisory vendor-advisory
- 31176 third-party-advisory vendor-advisory
- 31183 third-party-advisory vendor-advisory
- 31195 third-party-advisory vendor-advisory
- 31220 third-party-advisory vendor-advisory
- 31253 third-party-advisory vendor-advisory
- 31261 third-party-advisory vendor-advisory
- 31270 third-party-advisory vendor-advisory
- 31286 third-party-advisory vendor-advisory
- 31306 third-party-advisory vendor-advisory
- 31377 third-party-advisory vendor-advisory
- 31403 third-party-advisory vendor-advisory
- 33433 third-party-advisory
- 34501 third-party-advisory
- GLSA-200808-03 vendor-advisory
- SSA:2008-210-05 vendor-advisory
- 256408 vendor-advisory
- wiki.rpath.com
- DSA-1614 vendor-advisory
- DSA-1615 vendor-advisory
- DSA-1621 vendor-advisory
- DSA-1697 vendor-advisory
- MDVSA-2008:148 vendor-advisory
- MDVSA-2008:155 vendor-advisory
- www.mozilla.org patch vendor-advisory
- www.novell.com
- RHSA-2008:0597 vendor-advisory
- RHSA-2008:0598 vendor-advisory
- RHSA-2008:0599 vendor-advisory
- 20080717 ZDI-08-044: Mozilla Firefox CSSValue Array Memory Corruption Vulnerability mailing-list
- 20080729 rPSA-2008-0238-1 firefox mailing-list
- 29802 vdb-entry
- 1020336 vdb-entry
- SSA:2008-198-02 vendor-advisory
- SSA:2008-198-01 vendor-advisory
- USN-623-1 vendor-advisory
- USN-626-1 vendor-advisory
- USN-626-2 vendor-advisory
- USN-629-1 vendor-advisory
- ADV-2008-1873 vdb-entry
- ADV-2009-0977 vdb-entry
- www.zerodayinitiative.com
- bugzilla.mozilla.org
- firefox-unspecified-code-execution(43167) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:9900 signature vdb-entry
- FEDORA-2008-6737 vendor-advisory
- FEDORA-2008-6706 vendor-advisory
- FEDORA-2008-6517 vendor-advisory
- FEDORA-2008-6519 vendor-advisory