National Cyber Awareness System

Vulnerability Summary for CVE-2008-2785

Overview

Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2008/mfsa2008-34.html

Type: Advisory; Patch Information

Hyperlink:http://www.mozilla.org/security/announce/2008/mfsa2008-34.html

External Source: FEDORA

Name: FEDORA-2008-6519

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00672.html

External Source: FEDORA

Name: FEDORA-2008-6517

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00667.html

External Source: FEDORA

Name: FEDORA-2008-6706

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.html

External Source: FEDORA

Name: FEDORA-2008-6737

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2683

Hyperlink:https://issues.rpath.com/browse/RPL-2683

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=440230

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=440230

External Source: XF

Name: firefox-unspecified-code-execution(43167)

Type: Advisory

Hyperlink:http://xforce.iss.net/xforce/xfdb/43167

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-08-044/

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-08-044/

External Source: VUPEN

Name: ADV-2009-0977

Hyperlink:http://www.vupen.com/english/advisories/2009/0977

External Source: VUPEN

Name: ADV-2008-1873

Hyperlink:http://www.vupen.com/english/advisories/2008/1873

External Source: UBUNTU

Name: USN-629-1

Hyperlink:http://www.ubuntu.com/usn/usn-629-1

External Source: UBUNTU

Name: USN-626-2

Hyperlink:http://www.ubuntu.com/usn/usn-626-2

External Source: UBUNTU

Name: USN-626-1

Hyperlink:http://www.ubuntu.com/usn/usn-626-1

External Source: UBUNTU

Name: USN-623-1

Hyperlink:http://www.ubuntu.com/usn/usn-623-1

External Source: SLACKWARE

Name: SSA:2008-198-01

Hyperlink:http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380974

External Source: SLACKWARE

Name: SSA:2008-198-02

Hyperlink:http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380767

External Source: SECTRACK

Name: 1020336

Hyperlink:http://www.securitytracker.com/id?1020336

External Source: BID

Name: 29802

Hyperlink:http://www.securityfocus.com/bid/29802

External Source: BUGTRAQ

Name: 20080729 rPSA-2008-0238-1 firefox

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494860/100/0/threaded

External Source: BUGTRAQ

Name: 20080717 ZDI-08-044: Mozilla Firefox CSSValue Array Memory Corruption Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494504/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0599

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0599.html

External Source: REDHAT

Name: RHSA-2008:0598

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0598.html

External Source: REDHAT

Name: RHSA-2008:0597

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0597.html

External Source: CONFIRM

Name: http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5031400

Hyperlink:http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5031400

External Source: MANDRIVA

Name: MDVSA-2008:155

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:155

External Source: MANDRIVA

Name: MDVSA-2008:148

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:148

External Source: DEBIAN

Name: DSA-1697

Hyperlink:http://www.debian.org/security/2009/dsa-1697

External Source: DEBIAN

Name: DSA-1621

Hyperlink:http://www.debian.org/security/2008/dsa-1621

External Source: DEBIAN

Name: DSA-1615

Hyperlink:http://www.debian.org/security/2008/dsa-1615

External Source: DEBIAN

Name: DSA-1614

Hyperlink:http://www.debian.org/security/2008/dsa-1614

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0238

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0238

External Source: SUNALERT

Name: 256408

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

External Source: SLACKWARE

Name: SSA:2008-210-05

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484

External Source: GENTOO

Name: GLSA-200808-03

Hyperlink:http://security.gentoo.org/glsa/glsa-200808-03.xml

External Source: SECUNIA

Name: 34501

Hyperlink:http://secunia.com/advisories/34501

External Source: SECUNIA

Name: 33433

Hyperlink:http://secunia.com/advisories/33433

External Source: SECUNIA

Name: 31403

Type: Advisory

Hyperlink:http://secunia.com/advisories/31403

External Source: SECUNIA

Name: 31377

Type: Advisory

Hyperlink:http://secunia.com/advisories/31377

External Source: SECUNIA

Name: 31306

Type: Advisory

Hyperlink:http://secunia.com/advisories/31306

External Source: SECUNIA

Name: 31286

Type: Advisory

Hyperlink:http://secunia.com/advisories/31286

External Source: SECUNIA

Name: 31270

Type: Advisory

Hyperlink:http://secunia.com/advisories/31270

External Source: SECUNIA

Name: 31261

Type: Advisory

Hyperlink:http://secunia.com/advisories/31261

External Source: SECUNIA

Name: 31253

Type: Advisory

Hyperlink:http://secunia.com/advisories/31253

External Source: SECUNIA

Name: 31220

Type: Advisory

Hyperlink:http://secunia.com/advisories/31220

External Source: SECUNIA

Name: 31195

Type: Advisory

Hyperlink:http://secunia.com/advisories/31195

External Source: SECUNIA

Name: 31183

Type: Advisory

Hyperlink:http://secunia.com/advisories/31183

External Source: SECUNIA

Name: 31176

Type: Advisory

Hyperlink:http://secunia.com/advisories/31176

External Source: SECUNIA

Name: 31157

Type: Advisory

Hyperlink:http://secunia.com/advisories/31157

External Source: SECUNIA

Name: 31154

Type: Advisory

Hyperlink:http://secunia.com/advisories/31154

External Source: SECUNIA

Name: 31145

Type: Advisory

Hyperlink:http://secunia.com/advisories/31145

External Source: SECUNIA

Name: 31144

Hyperlink:http://secunia.com/advisories/31144

External Source: SECUNIA

Name: 31129

Type: Advisory

Hyperlink:http://secunia.com/advisories/31129

External Source: SECUNIA

Name: 31122

Type: Advisory

Hyperlink:http://secunia.com/advisories/31122

External Source: SECUNIA

Name: 31121

Hyperlink:http://secunia.com/advisories/31121

External Source: SECUNIA

Name: 30761

Type: Advisory

Hyperlink:http://secunia.com/advisories/30761

External Source: REDHAT

Name: RHSA-2008:0616

Hyperlink:http://rhn.redhat.com/errata/RHSA-2008-0616.html

External Source: OVAL

Name: oval:org.mitre.oval:def:9900

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9900

External Source: MISC

Name: http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30

Hyperlink:http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30

External Source: MISC

Name: http://blog.mozilla.com/security/2008/06/18/new-security-issue-under-investigation/

Hyperlink:http://blog.mozilla.com/security/2008/06/18/new-security-issue-under-investigation/

References to Check Content

Identifier:oval:org.mitre.oval:def:9900

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9900