CVE-2008-0420
Summary
| CVE | CVE-2008-0420 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-02-12 03:00:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | modules/libpr0n/decoders/bmp/nsBMPDecoder.cpp in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 does not properly perform certain calculations related to the mColors table, which allows remote attackers to read portions of memory uninitialized via a crafted 8-bit bitmap (BMP) file that triggers an out-of-bounds read within the heap, as demonstrated using a CANVAS element; or cause a denial of service (application crash) via a crafted 8-bit bitmap file that triggers an out-of-bounds read. NOTE: the initial public reports stated that this affected Firefox in Ubuntu 6.06 through 7.10. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Firefox | 0.1 | All | All | All |
| Application | Mozilla | Firefox | 0.2 | All | All | All |
| Application | Mozilla | Firefox | 0.3 | All | All | All |
| Application | Mozilla | Firefox | 0.4 | All | All | All |
| Application | Mozilla | Firefox | 0.5 | All | All | All |
| Application | Mozilla | Firefox | 0.6 | All | All | All |
| Application | Mozilla | Firefox | 0.6.1 | All | All | All |
| Application | Mozilla | Firefox | 0.7 | All | All | All |
| Application | Mozilla | Firefox | 0.7.1 | All | All | All |
| Application | Mozilla | Firefox | 0.8 | All | All | All |
| Application | Mozilla | Firefox | 0.9 | All | All | All |
| Application | Mozilla | Firefox | 0.9.1 | All | All | All |
| Application | Mozilla | Firefox | 0.9.2 | All | All | All |
| Application | Mozilla | Firefox | 0.9.3 | All | All | All |
| Application | Mozilla | Firefox | 1.0 | All | All | All |
| Application | Mozilla | Firefox | 1.0 | preview_release | All | All |
| Application | Mozilla | Firefox | 1.0.3 | All | All | All |
| Application | Mozilla | Firefox | 1.0.5 | All | All | All |
| Application | Mozilla | Firefox | 1.0.8 | All | All | All |
| Application | Mozilla | Firefox | 1.5 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.1 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.10 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.12 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.2 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.4 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.6 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.7 | All | All | All |
| Application | Mozilla | Firefox | 1.5.0.9 | All | All | All |
| Application | Mozilla | Firefox | 2.0 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.1 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.10 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.2 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.7 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.8 | All | All | All |
| Application | Mozilla | Firefox | 2.0.0.9 | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Seamonkey | 1.0 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0 | alpha | All | All |
| Application | Mozilla | Seamonkey | 1.0 | beta | All | All |
| Application | Mozilla | Seamonkey | 1.0.1 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.2 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.3 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.5 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.6 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.7 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.8 | All | All | All |
| Application | Mozilla | Seamonkey | 1.0.9 | All | All | All |
| Application | Mozilla | Seamonkey | 1.1 | All | All | All |
| Application | Mozilla | Seamonkey | 1.1 | alpha | All | All |
| Application | Mozilla | Seamonkey | 1.1 | beta | All | All |
| Application | Mozilla | Seamonkey | 1.1.1 | All | All | All |
| Application | Mozilla | Seamonkey | 1.1.2 | All | All | All |
| Application | Mozilla | Seamonkey | 1.1.6 | All | All | All |
| Application | Mozilla | Seamonkey | All | All | All | All |
| Application | Mozilla | Thunderbird | 0.1 | All | All | All |
| Application | Mozilla | Thunderbird | 0.5 | All | All | All |
| Application | Mozilla | Thunderbird | 0.6 | All | All | All |
| Application | Mozilla | Thunderbird | 0.7 | All | All | All |
| Application | Mozilla | Thunderbird | 0.8 | All | All | All |
| Application | Mozilla | Thunderbird | 0.9 | All | All | All |
| Application | Mozilla | Thunderbird | 1.0 | All | All | All |
| Application | Mozilla | Thunderbird | 1.0.2 | All | All | All |
| Application | Mozilla | Thunderbird | 1.0.5 | All | All | All |
| Application | Mozilla | Thunderbird | 1.0.6 | All | All | All |
| Application | Mozilla | Thunderbird | 1.0.8 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.12 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.13 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.14 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.2 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.4 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.5 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.7 | All | All | All |
| Application | Mozilla | Thunderbird | 1.5.0.9 | All | All | All |
| Application | Mozilla | Thunderbird | 2.0.0.0 | All | All | All |
| Application | Mozilla | Thunderbird | 2.0.0.4 | All | All | All |
| Application | Mozilla | Thunderbird | 2.0.0.5 | All | All | All |
| Application | Mozilla | Thunderbird | 2.0.0.6 | All | All | All |
| Application | Mozilla | Thunderbird | 2.0.0.9 | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 8 Update: thunderbird-2.0.0.12-1.fc8 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Yahoo | af854a3a-2127-422b-91ae-364da2661108 | browser.netscape.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Mozilla products: Multiple vulnerabilities — Gentoo Linux Documentation | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Sun Solaris Firefox Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Support / Security / Advisories / / MDVSA-2008:048 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Multiple Web Browser BMP Partial Palette Information Disclosure and Denial Of Service Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| MFSA 2008-07: Possible information disclosure in BMP decoder | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | |
| [SECURITY] Fedora 7 Update: thunderbird-2.0.0.12-1.fc7 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| USN-582-1: Thunderbird vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| USN-576-1: Firefox vulnerabilities | Ubuntu security notices | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Bug 408076 – out of bounds read in BMP decoder can lead to information disclosure | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| Gentoo Update for Mozilla Products - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Ubuntu update for firefox - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Netscape Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Fedora update for thunderbird - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Ubuntu update for thunderbird - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Mozilla Firefox BMP Handling Bug Lets Remote Users Access Portions of Kernel Memory - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| USN-582-2: Thunderbird regression | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Mozilla Firefox Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.