CVE-2007-0776

Heap-based buffer overflow in the _cairo_pen_init function in Mozilla Firefox 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to execute arbitrary code via a large stroke-width attribute in the clipPath element in an SVG file.

🔗 References (92)

• secalert@redhathttp://fedoranews.org/cms/node/2713
• secalert@redhathttp://fedoranews.org/cms/node/2728
• secalert@redhathttp://fedoranews.org/cms/node/2747
• secalert@redhathttp://fedoranews.org/cms/node/2749
• secalert@redhathttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• secalert@redhathttp://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
• secalert@redhathttp://secunia.com/advisories/24205
• secalert@redhathttp://secunia.com/advisories/24238
• secalert@redhathttp://secunia.com/advisories/24252
• secalert@redhathttp://secunia.com/advisories/24293
• secalert@redhathttp://secunia.com/advisories/24320
• secalert@redhathttp://secunia.com/advisories/24328
• secalert@redhathttp://secunia.com/advisories/24333
• secalert@redhathttp://secunia.com/advisories/24384
• secalert@redhathttp://secunia.com/advisories/24389