Description
Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.3 | RHSA-2005:335 |
| RHEL 4 | evolution +1 | 2.0.2-14 | RHSA-2005:335 |
| RHEL 4 | firefox +1 | 1.0.2-1.4.1 | RHSA-2005:337, RHSA-2005:336 |
Advisories 3
- RHSA-2005:336 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:337 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:335 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2005:323 vendor-advisory
- RHSA-2005:336 vendor-advisory
- ADV-2005-0296 vdb-entry
- oval:org.mitre.oval:def:100028 vdb-entry signature
- RHSA-2005:335 vendor-advisory
- 19823 third-party-advisory
- 15495 vdb-entry
- P-160 third-party-advisory government-resource
- gif-extension-overflow(19269) vdb-entry
- 12881 vdb-entry
- http://www.mozilla.org/security/announce/mfsa2005-30.html
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=150877
- 20050323 Mozilla Foundation GIF Overflow third-party-advisory
- VU#557948 third-party-advisory
- GLSA-200503-30 vendor-advisory
- oval:org.mitre.oval:def:11377 vdb-entry signature
- 14654 third-party-advisory
- SUSE-SA:2006:022 vendor-advisory
- RHSA-2005:337 vendor-advisory