32113 : Mozilla Firefox SVG _cairo_pen_init Heap Overflow
Printer | http://osvdb.org/32113 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
8	1540	about 6 years ago	about 5 years ago	0 times	90%

Timeline

Disclosure Date
2007-02-23

Description

A remote overflow exists in Mozilla Firefox. The application fails to validate input passed to the 'stroke-width' variable in the '_cairo_pen_init' function resulting in a heap overflow. With a specially crafted .svg file, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Exploit: Exploit Public
Disclosure: Vendor Verified

Solution

Upgrade to Firefox 2.0.0.2 or higher, as it has been reported to fix this vulnerability. Additionally, disable Firefox's it internal SVG viewer as a workaround.

Products

Mozilla Organization	Firefox	2.0
		2.0.0.1

References

Security Tracker: 1017698
CVE ID: 2007-0776 (see also: NVD)
Bugtraq ID: 22694
Secunia Advisory ID: 24205 24238 24293 24320 24328 24333 24384 24389 24393 24406 24410 24437 24455 24456 24457 24522 24569 25588
Related OSVDB ID: 32103 32104 32105 32107 32109 32110 32111 32114 32115
ISS X-Force ID: 32698
CERT VU: 551436
VUPEN Advisory: ADV-2007-0718 ADV-2007-0719
Vendor Specific Advisory URL: http://fedoranews.org/cms/node/2713
http://lists.rpath.com/pipermail/security-announce/2007-February/000153.html
http://www.mozilla.org/security/announce/2007/mfsa2007-01.html
Other Advisory URL: http://fedoranews.org/cms/node/2721
http://fedoranews.org/cms/node/2728
http://fedoranews.org/cms/node/2747
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0006.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
http://www.gentoo.org/security/en/glsa/glsa-200703-04.xml
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
http://www.gentoo.org/security/en/glsa/glsa-200703-18.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:052
http://www.ubuntu.com/usn/usn-428-1
http://www.ubuntu.com/usn/usn-431-1
http://www.us.debian.org/security/2007/dsa-1336
Vendor Specific Solution URL: http://security.gentoo.org/glsa/glsa-200703-04.xml
Vendor Specific News/Changelog Entry: https://bugzilla.mozilla.org/show_bug.cgi?id=360645

Tools & Filters

	24701 24735 24748 24771 24778 24800 24867 25000 27118 27119 27439 27440 28021 28022 28025 29359
	3922 3927 3931 3942

Credit

Tom Ferris - tommysecurity-protocols.com - Security-Protocols

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2007-02-27 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.