CVE-2008-2811: Mozilla Firefox

High severity, CVSS 10.0. EPSS: 7.1% chance of exploitation in the next 30 days.

The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image whose display requires more pixels than nscoord_MAX, related to nsBlockFrame::DrainOverflowLines.

Affected products

• Mozilla Firefox: up to and including 2.0.0.14; version 2.0 only; version 2.0.0.1 only; version 2.0.0.2 only; version 2.0.0.3 only; version 2.0.0.4 only; …
• Mozilla Seamonkey: up to and including 1.1.9; version 1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; version 1.1.5 only; …
• Mozilla Thunderbird: up to and including 2.0.0.14; version 2.0.0.0 only; version 2.0.0.1 only; version 2.0.0.2 only; version 2.0.0.3 only; version 2.0.0.4 only; …

Published 2008-07-07. Last modified 2026-06-16.