Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute, related to the layout engine.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 2.0.0.17 (excluding) |
| Firefox | Mozilla | 3.0 (including) | 3.0.2 (excluding) |
| Seamonkey | Mozilla | * | 1.1.12 (excluding) |
| Thunderbird | Mozilla | * | 2.0.0.17 (excluding) |