Description
modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which allows remote attackers to read portions of memory uninitialized via a crafted 8-bit bitmap (BMP) file that triggers an out-of-bounds read within the heap, as demonstrated using a CANVAS element; or cause a denial of service (application crash) via a crafted 8-bit bitmap file that triggers an out-of-bounds read. NOTE: the initial public reports stated that this affected Firefox in Ubuntu 6.06 through 7.10.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080131b-0etch1 | DSA-1484-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-9.el5 | RHSA-2008:0103 |
| RHEL 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
| RHEL 4 | firefox | 1.5.0.12-0.10.el4 | RHSA-2008:0103 |
| RHEL 4 | seamonkey +5 | 1.0.9-9.el4 | RHSA-2008:0104 |
| RHEL 4 | thunderbird | 1.5.0.12-8.el4 | RHSA-2008:0105 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.9.el3 | RHSA-2008:0104 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.9.el2 | RHSA-2008:0104 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
Advisories 5
- RHSA-2008:0104 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0105 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0103 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1484-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-582-2 vendor-advisory
- http://browser.netscape.com/releasenotes/
- 20080216 [HISPASEC] FireFox 2.0.0.11 and Opera 9.50 beta Remote Memory Information Leak, FireFox 2.0.0.11 Remote Denial of Service mailing-list
- FEDORA-2008-2118 vendor-advisory
- FEDORA-2008-2060 vendor-advisory
- 30620 third-party-advisory
- 29049 third-party-advisory
- firefox-bmp-information-disclosure(40491) vdb-entry
- USN-582-1 vendor-advisory
- 29167 third-party-advisory
- 30327 third-party-advisory
- 238492 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=408076
- http://www.mozilla.org/security/announce/2008/mfsa2008-07.html
- ADV-2008-1793 vdb-entry
- 27826 vdb-entry
- firefox-bmp-dos(40606) vdb-entry
- 1019434 vdb-entry
- oval:org.mitre.oval:def:10119 vdb-entry signature
- ADV-2008-0627 vdb-entry
- GLSA-200805-18 vendor-advisory
- 28758 third-party-advisory
- MDVSA-2008:048 vendor-advisory
- 29098 third-party-advisory
- 28839 third-party-advisory
- USN-576-1 vendor-advisory