Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2012-3910 | Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component. |
Ubuntu USN |
USN-1548-1 | Firefox vulnerabilities |
Ubuntu USN |
USN-1551-1 | Thunderbird vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 21 Oct 2024 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:mozilla:firefox_esr:10.0.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:10.0:*:*:*:*:*:*:* |
|
| Vendors & Products |
Mozilla firefox Esr
|
Mon, 21 Oct 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:mozilla:firefox_esr:10.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:10.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:10.0.6:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:10.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:10.0.6:*:*:*:*:*:*:* |
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-06T20:21:04.215Z
Reserved: 2012-07-11T00:00:00.000Z
Link: CVE-2012-3966
No data.
Status : Deferred
Published: 2012-08-29T10:56:40.723
Modified: 2025-04-11T00:51:21.963
Link: CVE-2012-3966
OpenCVE Enrichment
No data.
Weaknesses
EUVD
Ubuntu USN