Mozilla Foundation Security Advisory 2012-31
Off-by-one error in OpenType Sanitizer
- Announced
- April 24, 2012
- Reporter
- Mateusz Jurczyk
- Impact
- Critical
- Products
- Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
- Fixed in
-
- Firefox 12
- Firefox ESR 10.0.4
- SeaMonkey 2.9
- Thunderbird 12
- Thunderbird ESR 10.0.4
Description
Mateusz Jurczyk of the Google Security Team discovered an
off-by-one error in the OpenType Sanitizer using the Address Sanitizer tool.
This can lead to an out-of-bounds read and execution of an uninitialized
function pointer during parsing and possible remote code execution.
References
Vulmon