Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade thunderbirdUpgrade xulrunner | Dec 1, 2016 | Apr 3, 2013 |
| Freebsd | — | Upgrade linux-firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade firefoxUpgrade thunderbird | Dec 10, 2025 | Apr 3, 2013 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Apr 3, 2013 |
| Mfsa2013 31 | — | Upgrade to Mozilla Firefox version 20.0Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 17.0.5 | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.17.0 | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 17.0.5Upgrade to Mozilla Thunderbird ESR version 17.0.5Upgrade to the latest version of Mozilla Thunderbird | Apr 3, 2013 | Apr 2, 2013 |
| Oracle_linux | — | Upgrade xulrunnerUpgrade xulrunner-develUpgrade firefoxUpgrade thunderbird | Oct 16, 2024 | Apr 3, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 2, 2013 |
| Suse | — | Upgrade mozilla-nss-debuginfo-32bitUpgrade mozilla-nss-sysinit-x86Upgrade xulrunner-devel-debuginfoUpgrade MozillaThunderbirdUpgrade mozilla-nss-sysinitUpgrade xulrunner-debuginfo-32bitUpgrade seamonkey-translations-otherUpgrade MozillaThunderbird-debugsourceUpgrade xulrunner-debugsourceUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-debuginfo-32bitUpgrade MozillaFirefoxUpgrade mozilla-nspr-develUpgrade mozilla-nspr-64bitUpgrade MozillaThunderbird-buildsymbolsUpgrade seamonkey-dom-inspectorUpgrade seamonkeyUpgrade mozilla-nspr-debuginfo-32bitUpgrade mozilla-js-x86Upgrade mozilla-nss-64bitUpgrade mozilla-nsprUpgrade libsoftokn3-32bitUpgrade MozillaFirefox-develUpgrade enigmailUpgrade seamonkey-ircUpgrade MozillaFirefox-translations-otherUpgrade seamonkey-debuginfoUpgrade mozilla-jsUpgrade MozillaFirefox-translations-commonUpgrade mozilla-js-32bitUpgrade MozillaThunderbird-translations-otherUpgrade xulrunner-debuginfo-x86Upgrade mozillafirefox-branding-upstreamUpgrade libsoftokn3Upgrade mozilla-nss-certs-32bitUpgrade seamonkey-venkmanUpgrade mozilla-nspr-debuginfo-x86Upgrade sle-sdk-releaseUpgrade mozilla-nspr-debuginfoUpgrade MozillaFirefox-debuginfoUpgrade mozilla-nspr-x86Upgrade libsoftokn3-debuginfoUpgrade libfreebl3-debuginfoUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-nssUpgrade MozillaThunderbird-develUpgrade mozilla-nss-debuginfoUpgrade xulrunnerUpgrade libfreebl3-debuginfo-x86Upgrade MozillaThunderbird-translations-commonUpgrade mozilla-nss-sysinit-debuginfoUpgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade xulrunner-x86Upgrade xulrunner-buildsymbolsUpgrade mozilla-js-debuginfo-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade enigmail-debuginfoUpgrade xulrunner-debuginfoUpgrade seamonkey-debugsourceUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade libfreebl3Upgrade mozilla-nss-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nss-certs-debuginfoUpgrade mozilla-nss-certsUpgrade xulrunner-develUpgrade MozillaThunderbird-devel-debuginfoUpgrade mozilla-nss-certs-debuginfo-x86Upgrade mozilla-js-debuginfo-x86Upgrade libfreebl3-debuginfo-32bitUpgrade mozilla-nss-tools-debuginfoUpgrade MozillaFirefox-debugsourceUpgrade MozillaThunderbird-debuginfoUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade mozilla-nss-develUpgrade libsoftokn3-x86Upgrade mozilla-nss-certs-x86Upgrade seamonkey-translations-commonUpgrade xulrunner-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-debugsourceUpgrade libfreebl3-x86Upgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-nss-debuginfo-x86Upgrade mozilla-js-debuginfoUpgrade mozilla-nspr-debugsourceUpgrade libsoftokn3-debuginfo-x86 | Feb 17, 2015 | Apr 3, 2013 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 8, 2024 | Apr 3, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub