Bug 547292 (CVE-2009-3978)

Summary:	CVE-2009-3978 Firefox, Seamonkey: NULL pointer dereference in GIF decoder
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jhorak, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://bugzilla.mozilla.org/show_bug.cgi?id=525326
Whiteboard:
Fixed In Version:	firefox 3.0.16	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-21 09:31:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-12-14 09:48:11 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-3978  to
the following vulnerability:

The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp
in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to
cause a denial of service (NULL pointer dereference and application crash)
via an animated GIF file with a large image size, a different vulnerability
than CVE-2009-3373.

Upstream bug report:
--------------------
https://bugzilla.mozilla.org/show_bug.cgi?id=525326

Upstream patch:
---------------
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/edf189567edc

Comment 1 Jan Lieskovsky 2009-12-14 10:00:05 UTC

This issue does NOT affect the versions of the seamonkey package, as shipped
with Red Hat Enterprise Linux 3 and 4.

This issue does NOT affect the versions of the seamonkey package, as shipped
with Fedora release of 10 and 11.

This issue affects the versions of the seamonkey package, as shipped with
Fedora release of 12 and Fedora Rawhide.

Please fix.

Comment 2 Jan Lieskovsky 2009-12-14 10:02:41 UTC

This issue affects the versions of the firefox package, as shipped with
Red Hat Enterprise Linux 4 and 5.

This issue affects the version of the firefox package, as shipped with
Fedora release of 10.

This issue does NOT affect the versions of the firefox package, as shipped
with Fedora release of 11 and 12.

Comment 3 Martin Stransky 2009-12-14 10:18:29 UTC

It's fixed in firefox-3.0.16.