Integer Overflow

2024-03-2501:33:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

integer overflow

firefox

thunderbird

vulnerability

out-of-bounds write

software

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

Firefox, Firefox ESR, Thunderbird is vulnerable to integer overflow leading to out-of-bounds write. The vulnerability is due to integer overflows in AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters(), causing underallocation of an output buffer, which can result in an out-of-bounds write.

CPENameOperatorVersion
thunderbird:bullseyeeq1:78.5.0-1
firefox:sideq81.0-2
firefox:sideq83.0-1
firefox:sideq82.0.3-1
thunderbird:sideq1:78.5.0-1
firefox-esr:bullseyeeq78.5.0esr-1
thunderbird:bustereq1:78.5.0-1~deb10u1
thunderbird:bustereq1:78.6.0-1~deb10u1
thunderbird:bustereq1:60.9.0-1~deb10u1
thunderbird:bustereq1:68.12.0-1~deb10u1

Name	Operator	Version
thunderbird:bullseye	eq	1:78.5.0-1
firefox:sid	eq	81.0-2
firefox:sid	eq	83.0-1
firefox:sid	eq	82.0.3-1
thunderbird:sid	eq	1:78.5.0-1
firefox-esr:bullseye	eq	78.5.0esr-1
thunderbird:buster	eq	1:78.5.0-1~deb10u1
thunderbird:buster	eq	1:78.6.0-1~deb10u1
thunderbird:buster	eq	1:60.9.0-1~deb10u1
thunderbird:buster	eq	1:68.12.0-1~deb10u1