Bug 851922 (CVE-2012-3969, CVE-2012-3970)

Summary: CVE-2012-3969 CVE-2012-3970 Mozilla: SVG buffer overflow and use-after-free issues (MFSA 2012-63)
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: gecko-bugs-nobody, jhorak, jrusnack, security-response-team, stransky
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=critical,public=20120828,reported=20120827,source=mozilla,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,rhel-5/firefox=affected,rhel-5/thunderbird=affected,rhel-6/firefox=affected,rhel-6/thunderbird=affected,cwe=(CWE-119|CWE-416)
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-29 01:28:40 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 847589    

Description Huzaifa S. Sidhpurwala 2012-08-26 23:55:18 EDT
Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko's SVG filter code when the sum of two values is too large to be stored as a signed 32-bit integer, causing the function to write past the end of an array. The second issue is a use-after-free when an element with a "requiredFeatures" attribute is moved between documents. In that situation, the internal representation of the "requiredFeatures" value could be freed prematurely. Both issues are potentially exploitable. 



Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Arthur Gerkis as the original reporter of this flaw.
Comment 1 errata-xmlrpc 2012-08-29 00:24:13 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2012:1211 https://rhn.redhat.com/errata/RHSA-2012-1211.html
Comment 2 errata-xmlrpc 2012-08-29 00:44:39 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2012:1210 https://rhn.redhat.com/errata/RHSA-2012-1210.html