Software Engineering Institute

Cascading Style Sheets

CSS is a mechanism for adding style to web documents.

The problem

Mozilla products contain an integer overflow in the CSS letter spacing property. This may allow a remote attacker to manipulate memory allocation routines to create an undersized buffer. When data is copied to this buffer, a heap-based buffer overflow may occur.

For a list of affected, products refer to Mozilla Foundation Security Advisory 2006-22.

If an attacker can persuade a user to access a specially crafted web page, that attacker may be able to execute arbitrary code.

Upgrade
Refer to Mozilla Foundation Security Advisory 2006-22 for fixed versions of Mozilla products.