Published: 19/06/2008 Updated: 11/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Mozilla Firefox prior to 2.0.0.16 and 3.x prior to 3.0.1, Thunderbird prior to 2.0.0.16, and SeaMonkey prior to 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote malicious users to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 2.0
mozilla firefox 2.0.0.1
mozilla firefox 2.0.0.5
mozilla firefox 2.0.0.6
mozilla thunderbird 2.0.0.9
mozilla thunderbird 2.0.0.6
mozilla thunderbird 1.5.0.10
mozilla thunderbird 1.5.0.9
mozilla thunderbird 1.0.7
mozilla thunderbird 1.0.6
mozilla thunderbird 0.6
mozilla thunderbird 0.5
mozilla seamonkey 1.0.9
mozilla seamonkey 1.0.8
mozilla seamonkey 1.0
mozilla seamonkey 1.1.8
mozilla seamonkey 1.1.7
mozilla firefox 2.0.0.3
mozilla firefox 2.0.0.4
mozilla firefox
mozilla thunderbird 2.0.0.12
mozilla thunderbird 1.5.0.13
mozilla thunderbird 1.5.0.12
mozilla thunderbird 1.5
mozilla thunderbird 1.0.8
mozilla thunderbird 0.8
mozilla thunderbird 0.7
mozilla seamonkey 1.1
mozilla seamonkey 1.0.2
mozilla seamonkey 1.0.1
mozilla seamonkey
mozilla seamonkey 1.1.9
mozilla seamonkey 1.1.2
mozilla seamonkey 1.1.1
mozilla firefox 2.0.0.10
mozilla firefox 2.0.0.11
mozilla firefox 2.0.0.7
mozilla firefox 2.0.0.8
mozilla thunderbird 2.0.0.5
mozilla thunderbird 2.0.0.4
mozilla thunderbird 1.5.0.8
mozilla thunderbird 1.5.0.7
mozilla thunderbird 1.0.5
mozilla thunderbird 1.0.2
mozilla thunderbird 0.4
mozilla thunderbird 0.3
mozilla seamonkey 1.0.7
mozilla seamonkey 1.0.6
mozilla seamonkey 1.0.5
mozilla thunderbird
mozilla seamonkey 1.1.6
mozilla seamonkey 1.1.5
mozilla firefox 2.0.0.12
mozilla firefox 2.0.0.13
mozilla firefox 2.0.0.2
mozilla firefox 2.0.0.9
mozilla firefox 3.0
mozilla thunderbird 2.0.0.0
mozilla thunderbird 1.5.0.14
mozilla thunderbird 1.5.0.5
mozilla thunderbird 1.5.0.4
mozilla thunderbird 1.5.0.2
mozilla thunderbird 1.0
mozilla thunderbird 0.9
mozilla thunderbird 0.2
mozilla thunderbird 0.1
mozilla seamonkey 1.0.4
mozilla seamonkey 1.0.3
mozilla firefox 2.0.0.14
mozilla seamonkey 1.1.4
mozilla seamonkey 1.1.3

Debian Bug report logs - #488358 iceweasel: CVE-2008-2786 CVE-2008-2785: two vulnerabilities with unknown impact Package: iceweasel; Maintainer for iceweasel is Maintainers of Mozilla-related packages <team+pkg-mozilla@trackerdebianorg>; Source for iceweasel is src:firefox-esr (PTS, buildd, popcon) Reported by: Steffen Joe ...

USN-626-1 fixed vulnerabilities in xulrunner-19 The changes required that Devhelp, Epiphany, Midbrowser and Yelp also be updated to use the new xulrunner-19 ...

A flaw was discovered in the browser engine A variable could be made to overflow causing the browser to crash If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2008-2785) ...

Various flaws were discovered in the browser engine If a user had Javascript enabled and were tricked into opening a malicious web page, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2008-2798, CVE-2008-2799) ...

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0304 It was discovered that a buffer overflow in MIME decoding can lead to the execution of arbitrary code C ...

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-2785 It was discovered that missing boundary checks on a reference counter for CSS objects can lead to the execution of arbitrary code CV ...

Several remote vulnerabilities have been discovered in Iceape an unbranded version of the Seamonkey internet suite The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the ex ...

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-2785 It was discovered that missing boundary checks on a reference counter for CSS objects can lead to the execution of a ...

Mozilla Foundation Security Advisory 2008-34 Remote code execution by overflowing CSS reference counter Announced July 15, 2008 Reporter TippingPoint Zero Day Initiative Impact Critical Products Firefox, SeaMonkey, Thunderbir ...

Get Started

CVE-2008-2785

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect