CVE-2013-0800

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00012.html

http://rhn.redhat.com/errata/RHSA-2013-0696.html

http://rhn.redhat.com/errata/RHSA-2013-0697.html

http://www.debian.org/security/2013/dsa-2699

http://www.mozilla.org/security/announce/2013/mfsa2013-31.html

http://www.ubuntu.com/usn/USN-1791-1

https://bugzilla.mozilla.org/show_bug.cgi?id=825721

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16909

Details

Source: MITRE

Published: 2013-04-03

Updated: 2021-03-11

Risk Information

CVSS v2

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (39 total)

IDNameProductFamilySeverity
83585SUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2013:0850-1)NessusSuSE Local Security Checks
critical
75081openSUSE Security Update : seamonkey (openSUSE-SU-2013:1180-1)NessusSuSE Local Security Checks
critical
74988openSUSE Security Update : seamonkey (openSUSE-SU-2013:0875-1)NessusSuSE Local Security Checks
critical
74965openSUSE Security Update : Mozilla Firefox and others (openSUSE-SU-2013:0630-1)NessusSuSE Local Security Checks
critical
70183GLSA-201309-23 : Mozilla Products: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
68949SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8001)NessusSuSE Local Security Checks
critical
68802Oracle Linux 6 : thunderbird (ELSA-2013-0697)NessusOracle Linux Local Security Checks
critical
68801Oracle Linux 5 / 6 : firefox (ELSA-2013-0696)NessusOracle Linux Local Security Checks
critical
66766Debian DSA-2699-1 : iceweasel - several vulnerabilitiesNessusDebian Local Security Checks
critical
66668SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8578)NessusSuSE Local Security Checks
critical
66667SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7741)NessusSuSE Local Security Checks
critical
66666SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7741)NessusSuSE Local Security Checks
critical
65867Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : thunderbird vulnerabilities (USN-1791-1)NessusUbuntu Local Security Checks
critical
65866SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8537)NessusSuSE Local Security Checks
critical
65865SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7599)NessusSuSE Local Security Checks
critical
65847FreeBSD : mozilla -- multiple vulnerabilities (94976433-9c74-11e2-a9fc-d43d7e0c7c02)NessusFreeBSD Local Security Checks
critical
65817Ubuntu 12.10 : unity-firefox-extension update (USN-1786-2)NessusUbuntu Local Security Checks
critical
65816Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox vulnerabilities (USN-1786-1)NessusUbuntu Local Security Checks
critical
801250Mozilla Thunderbird < 17.0.5 Multiple VulnerabilitiesLog Correlation EngineSMTP Clients
high
801242Mozilla Firefox < 20.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801224Mozilla SeaMonkey < 2.17 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6736Mozilla Thunderbird < 17.0.5 Multiple VulnerabilitiesNessus Network MonitorSMTP Clients
critical
6735SeaMonkey < 2.17 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
6734Mozilla Firefox < 20.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
65809SeaMonkey < 2.17 Multiple VulnerabilitiesNessusWindows
critical
65808Mozilla Thunderbird ESR 17.x < 17.0.5 Multiple VulnerabilitiesNessusWindows
critical
65807Mozilla Thunderbird < 17.0.5 Multiple VulnerabilitiesNessusWindows
critical
65806Firefox < 20 Multiple VulnerabilitiesNessusWindows
critical
65805Firefox ESR 17.x < 17.0.5 Multiple VulnerabilitiesNessusWindows
critical
65804Thunderbird ESR 17.x < 17.0.5 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
65803Thunderbird < 17.0.5 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
65802Firefox < 20 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
65801Firefox ESR 17.x < 17.0.5 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
65783Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20130402)NessusScientific Linux Local Security Checks
critical
65782Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20130402)NessusScientific Linux Local Security Checks
critical
65781RHEL 5 / 6 : thunderbird (RHSA-2013:0697)NessusRed Hat Local Security Checks
critical
65780RHEL 5 / 6 : firefox (RHSA-2013:0696)NessusRed Hat Local Security Checks
critical
65771CentOS 5 / 6 : thunderbird (CESA-2013:0697)NessusCentOS Local Security Checks
critical
65770CentOS 5 / 6 : firefox / xulrunner (CESA-2013:0696)NessusCentOS Local Security Checks
critical