NetSight
IP …
critical10.0

CVE-2012-3966

Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remot…

Impact

Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component.

Affected products

VendorProductAffected versions
MozillaFirefox
Versions 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5
MozillaThunderbird
through 14.0
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4
MozillaSeamonkey
through 2.11
Versions 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4
MozillaThunderbird Esr
Versions 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5

Weakness classification

CWE-119

References