CVE-2013-0800

03.04.2013, 11:56

Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	6.8 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P
mozilla	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 80%

Vendor	Product	Version
mozilla	firefox	𝑥 < 20.0
mozilla	firefox	17.0 ≤ 𝑥 < 17.0.5
mozilla	seamonkey	𝑥 < 2.17
mozilla	thunderbird	𝑥 < 17.0.5
mozilla	thunderbird_esr	17.0 ≤ 𝑥 < 17.0.5
debian	debian_linux	7.0
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	11.10
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
opensuse	opensuse	11.4
opensuse	opensuse	12.1
opensuse	opensuse	12.2
opensuse	opensuse	12.3

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

firefox

saucy	Fixed 20.0+build1-0ubuntu1 released
raring	Fixed 20.0+build1-0ubuntu1 released
quantal	Fixed 20.0+build1-0ubuntu0.12.10.3 released
precise	Fixed 20.0+build1-0ubuntu0.12.04.3 released
oneiric	Fixed 20.0+build1-0ubuntu0.11.10.3 released
lucid	Fixed 20.0+build1-0ubuntu0.10.04.3 released
hardy	ignored

seamonkey

saucy	dne
raring	dne
quantal	dne
precise	dne
oneiric	ignored
lucid	ignored
hardy	ignored

thunderbird

saucy	Fixed 17.0.5+build1-0ubuntu1 released
raring	Fixed 17.0.5+build1-0ubuntu1 released
quantal	Fixed 17.0.5+build1-0ubuntu0.12.10.1 released
precise	Fixed 17.0.5+build1-0ubuntu0.12.04.1 released
oneiric	Fixed 17.0.5+build1-0ubuntu0.11.10.1 released
lucid	Fixed 17.0.5+build1-0ubuntu0.10.04.1 released
hardy	ignored