Integer Overflow

2024-04-1901:25:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

firefox-esr

integer overflow

input validation

opentype font

out-of-bounds read

32-bit versions

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

firefox-esr is vulnerable to Integer Overflow. The vulnerability is due to insufficient input validation, allowing a malformed OpenType font to trigger integer overflows on 32-bit versions and resulting in an out-of-bounds read.

CPENameOperatorVersion
firefox-esr:bullseyeeq78.5.0esr-1
firefox-esr:sideq78.5.0esr-1
firefox-esr:sideq78.8.0esr-1
firefox:sideq81.0-2
firefox:sideq83.0-1
firefox:sideq82.0.3-1
firefox-esr:bustereq68.12.0esr-1~deb10u1
firefox-esr:bustereq78.7.0esr-1~deb10u1
firefox-esr:bustereq78.11.0esr-1~deb10u1
firefox-esr:bustereq78.5.0esr-1~deb10u1

Name	Operator	Version
firefox-esr:bullseye	eq	78.5.0esr-1
firefox-esr:sid	eq	78.5.0esr-1
firefox-esr:sid	eq	78.8.0esr-1
firefox:sid	eq	81.0-2
firefox:sid	eq	83.0-1
firefox:sid	eq	82.0.3-1
firefox-esr:buster	eq	68.12.0esr-1~deb10u1
firefox-esr:buster	eq	78.7.0esr-1~deb10u1
firefox-esr:buster	eq	78.11.0esr-1~deb10u1
firefox-esr:buster	eq	78.5.0esr-1~deb10u1