CERT-MU :Advisories

Overview

Multiple vulnerabilities have been reported in Mozilla Firefox, SeaMonkey and Thunderbird, which could allow a remote attacker to bypass certain security restrictions, disclose potentially sensitive information, manipulate certain data, execute an arbitrary code, causes denial of service condition or potentially compromise an affected system.

Description

Multiple Memory Corruption Vulnerabilities

Multiple memory corruption vulnerabilities have been reported in the JavaScript and browser engines when parsing malformed data in Mozilla Firefox, SeaMonkey and Thunderbird. A remote attacker could exploit these vulnerabilities via a specially crafted web page to trigger a memory corruption error. Successful exploitation of these vulnerabilities could allow a remote attacker to execute an arbitrary code or cause denial of service condition.

nsCycleCollector::MarkRoots()Use-after-freeVulnerability

This vulnerability is caused due to an Use-after-free error in frame construction process for menu in the nsCycleCollector::MarkRoots function in Mozilla Firefox and SeaMonkey. A remote attacker could exploit this vulnerability via a specially crafted HTML page to trigger an invalid pointer usage error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code.

Freed object reuse across plugin instances Vulnerability

This vulnerability is caused due to a use-after-free error in the handling of object references among multiple plugin instances in Mozilla Firefox and SeaMonkey. A remote attacker could exploit this vulnerability via a specially crafted HTML page involving multiple plugin instances to trigger an invalid pointer usage error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code.

nsGenericDOMDataNode::SetTextInternal Heap buffer overflow Vulnerability

This vulnerability is caused due to an integer overflow error in "nsGenericDOMDataNode::SetTextInternal" within the handling of text values for certain types of DOM nodes in Mozilla Firefox , SeaMonkey and Thunderbird. A remote attacker could exploit this vulnerability via a specially crafted DOM node with a long text value to trigger a heap-based buffer overflow error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code or cause denial of service condition.

XSLT Node Sorting Integer Overflow Vulnerability

This vulnerability is caused due to an integer overflow error in a XSLT node sorting routine in Mozilla Firefox , SeaMonkey and Thunderbird. A remote attacker could exploit this vulnerability via a specially crafted XSLT node containing an overly large text value to trigger a buffer overflow error. Successful exploitation of this vulnerability could allow a remote attacker to execute an arbitrary code or cause denial of service condition.

HTTP "Content-Disposition: attachment" header XSS Vulnerability

This vulnerability is caused due to an improper handling of events in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers in Mozilla Firefox and SeaMonkey. A remote attacker could exploit this vulnerability via a specially crafted "Content-Disposition: attachment" HTTP header value and "Content-Type: multipart" value to bypass certain security features. Successful exploitation of this vulnerability could allow a remote attacker to conduct cross-site scripting (XSS) attacks.

Re-use of freed object due to scope confusion Vulnerability

This vulnerability is caused due to improper management of the scopes of DOM nodes that are moved from one document to another in Mozilla Firefox. A remote attacker could exploit this vulnerability via unspecified vectors involving improper interaction with garbage collection to execute arbitrary code.

focus() behavior keystrokes stealing Vulnerability

This vulnerability is caused due to an error in JavaScript implementation, in which focus() could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location in Mozilla Firefox and SeaMonkey. A remote attacker could exploit this vulnerability via a specially crafted webpage to disclose potentially sensitive information.

JavaScript Engine 'Math.Random()' Cross Domain Information Disclosure Vulnerability

This vulnerability is caused due to an error in the implementation of "Math.random()" function in JavaScript implementation, which uses a random number generator that is seeded only once per browser session in Mozilla Firefox and SeaMonkey. A remote attacker could exploit this vulnerability to potentially disclose/track sensitive users information across different web sites.

Software Affected

Mozilla Firefox versions 3.5.x prior to 3.5.10
Mozilla Firefox versions 3.6.x prior to 3.6.4
Mozilla SeaMonkey Versions prior to 2.0.5
Mozilla Thunderbird versions prior to 3.0.5

Multiple Vulnerabilities in Mozilla Products