Lucene search

[email protected]CVE-2013-0800

HistoryApr 03, 2013 - 11:56 a.m.

CVE-2013-0800

2013-04-0311:56:21

[email protected]

web.nvd.nist.gov

cve-2013-0800

pixman

cairo

mozilla firefox

firefox esr

thunderbird

thunderbird esr

seamonkey

integer signedness error

arbitrary code execution

out-of-bounds write

remote code execution

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.7 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.7%

JSON

Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.

Affected configurations

NVD

Node

mozillafirefoxRange<20.0

mozillafirefox_esrRange17.0–17.0.5

mozillaseamonkeyRange<2.17

mozillathunderbirdRange<17.0.5

mozillathunderbird_esrRange17.0–17.0.5

Node

debiandebian_linuxMatch7.0

Node

canonicalubuntu_linuxMatch10.04-

canonicalubuntu_linuxMatch11.10

canonicalubuntu_linuxMatch12.04-

canonicalubuntu_linuxMatch12.10

Node

opensuseopensuseMatch11.4

opensuseopensuseMatch12.1

opensuseopensuseMatch12.2

opensuseopensuseMatch12.3

suselinux_enterprise_desktopMatch10sp4-

suselinux_enterprise_desktopMatch11sp2

suselinux_enterprise_serverMatch10sp4-

suselinux_enterprise_serverMatch11sp1ltss-

suselinux_enterprise_serverMatch11sp1ltssvmware

suselinux_enterprise_serverMatch11sp2-

suselinux_enterprise_serverMatch11sp2vmware

suselinux_enterprise_software_development_kitMatch10sp4

suselinux_enterprise_software_development_kitMatch11sp2

CPENameOperatorVersion
mozilla:firefoxmozilla firefoxlt20.0
mozilla:firefox_esrmozilla firefox esrlt17.0.5
mozilla:seamonkeymozilla seamonkeylt2.17
mozilla:thunderbirdmozilla thunderbirdlt17.0.5
mozilla:thunderbird_esrmozilla thunderbird esrlt17.0.5

CPE	Name	Operator	Version
mozilla:firefox	mozilla firefox	lt	20.0
mozilla:firefox_esr	mozilla firefox esr	lt	17.0.5
mozilla:seamonkey	mozilla seamonkey	lt	2.17
mozilla:thunderbird	mozilla thunderbird	lt	17.0.5
mozilla:thunderbird_esr	mozilla thunderbird esr	lt	17.0.5