Mozilla Firefox Code Execution and Security Bypass Vulnerabilities
RISK: Medium Risk
Multiple vulnerabilities have been identified in Mozilla Firefox, which could be exploited by attackers to manipulate certain data, disclose sensitive information or compromise a vulnerable system.
1. Due to an error when handling a SOCKS5 proxy reply containing an overly long DNS name, which could be exploited to corrupt subsequent data stream in the response.
2. Due to a spoofing issue when handling "window.open()" calls.
3. Due to memory corruption errors in the JavaScript and browser engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable application or execute arbitrary code.
4. Due to a broken functionality that the window's global object receiving an incorrect security wrapper on pages that had a "Link:" HTTP header when an add-on implementing a Content Policy in JavaScript was installed, which could allow arbitrary JavaScript execution with chrome privileges.
Impact
- Remote Code Execution
- Information Disclosure
System / Technologies affected
- Mozilla Firefox versions 3.x
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Upgrade to Mozilla Firefox version 3.5.2 or 3.0.13 :
http://www.mozilla.com/firefox/
Vulnerability Identifier
Source
Related Link
Share with