Description
Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=710079 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72856 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14912 ↗
- http://secunia.com/advisories/49055 ↗
- http://www.mozilla.org/security/announce/2012/mfsa2012-06.html ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:013 ↗
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html ↗