CVE-2012-5838 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-416 — Use After Free7 documents6 sources
Severity
9.3CRITICALNVD
EPSS
1.0%
top 22.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+6 more
Timeline
PublishedNov 21
Latest updateMay 13

Description

The copyTexImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via large image dimensions.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages8 packages

▶NVDmozilla/firefox< 10.0.11+1
▶NVDmozilla/seamonkey< 2.14
▶NVDopensuse/opensuse11.4, 12.1, 12.2+2

Also affects: Ubuntu Linux 10.04, 11.10, 12.04, 12.10

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-759w-9wgc-9p32: The copyTexImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17↗2022-05-13
▶
CVEList
CVE-2012-5838: The copyTexImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17↗2012-11-21
▶

📋Vendor Advisories

3
Ubuntu
Firefox vulnerabilities↗2012-11-21
▶
Ubuntu
Thunderbird vulnerabilities↗2012-11-21
▶
Red Hat
Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)↗2012-11-20
▶

💬Community

1
Bugzilla
CVE-2012-5838 Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)↗2012-11-19
▶
CVE-2012-5838 — Mozilla Firefox vulnerability | cvebase