Mozilla Firefox CSSValue Array Memory Corruption Vulnerability (CVE-2008-2785) Advisory

Vulnerability Details Date: July 17th, 2008 Title: Mozilla Firefox CSSValue Array Memory Corruption Vulnerability Vulnerability IDs: - ZDI-08-044 - ZDI-CAN-349 CVE ID: CVE-2008-2785 Impact CVSS Score: Not provided Affected Vendors: - Mozilla Firefox - Mozilla Firefox Affected Product Versions: - 2.0.x - 3.0.x Description Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable versions of Mozilla Firefox. User interaction is required to exploit this vulnerability, specifically by visiting a malicious webpage. Specific Issue: - A specific flaw exists in the browser's handling of reference counting for the nsCSSValue::Array class. - Creating more than 65,535 references causes a 16-bit reference counter to overflow, leading to an incorrect free() operation while the object is still in use. - Successful exploitation of this vulnerability may result in arbitrary code execution under the context of the current user. Remediation and Protection Trend Micro Customer Protection: Trend Micro TippingPoint IPS customers are protected via the Digital Vaccine protection filter ID ['6204']. - More details: ![](http://www.tippingpoint.com) Additional Details: Mozilla Firefox has released an update to fix this vulnerability. - View details: ![](http://www.mozilla.org/security/announce/2008/mfsa2008-34.html) Disclosure Timeline 2008-06-17: Vulnerability reported to vendor 2008-07-17: Coordinated public advisory release Reporter Anonymous

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox CSSValue Array Memory Corruption Vulnerability (CVE-2008-2785) Advisory