CVE-2013-0800

NameCVE-2013-0800
DescriptionInteger signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2699-1
NVD severityhigh (attack range: remote)
Debian/oldoldstablepackages icedove, iceweasel are vulnerable.
Debian/oldstablepackage wine-gecko-1.4 is vulnerable; however, the security impact is unimportant.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iceape (PTS)squeeze (security)2.0.11-17vulnerable
icedove (PTS)squeeze, squeeze (security)3.0.11-1+squeeze15vulnerable
wheezy31.3.0-1~deb7u1fixed
wheezy (security)31.8.0-1~deb7u1fixed
jessie31.7.0-1~deb8u1fixed
jessie (security)31.8.0-1~deb8u1fixed
stretch31.7.0-1fixed
sid38.0.1-1fixed
iceweasel (PTS)squeeze, squeeze (security)3.5.16-20vulnerable
wheezy31.3.0esr-1~deb7u1fixed
wheezy (security)31.8.0esr-1~deb7u1fixed
jessie31.6.0esr-1fixed
jessie (security)31.8.0esr-1~deb8u1fixed
stretch, sid38.1.0esr-3fixed
wine-gecko-1.4 (PTS)wheezy1.4+dfsg1-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)(unfixed)high
iceapesourcesqueeze(unfixed)end-of-life
iceapesourcewheezy(unfixed)end-of-life
icedovesource(unstable)17.0.5-1high
icedovesourcesqueeze(unfixed)end-of-life
iceweaselsource(unstable)17.0.5esr-1high
iceweaselsourcesqueeze(unfixed)end-of-life
iceweaselsourcewheezy17.0.6esr-1~deb7u1highDSA-2699-1
wine-gecko-1.4source(unstable)(unfixed)unimportant

Notes

The description is misleading: Firefox embeds a copy of Cairo, the interdiff
shows the respective change at mozilla-esr17/gfx/cairo/cairo/src/cairo-image-surface.c
Apparently the forked copy has changed, the code isn't present in vanilla Cairo

Search for package or bug name: Reporting problems