Mozilla Firefox Multiple Vulnerabilities
RISK: Medium Risk
Multiple vulnerabilities have been identified in Mozilla Firefox, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or compromise a vulnerable system.
1. A memory corruption errors in the JavaScript and layout engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable application or execute arbitrary code.
2. A double free error during the garbage collection process when the browser is reloaded while handling a set of cloned XUL DOM elements which were linked as a parent and child, which could be exploited to corrupt memory and execute arbitrary code.
3. A same-origin validation error, which could allow malicious web sites to read arbitrary XML data from another domain by using nsIRDFService and a cross-domain redirect.
4. An errors in the PNG library, which could be exploited by attackers to crash an affected browser or potentially execute arbitrary code.
5. The browser decoding certain invisible control characters when displayed in the location bar, which could allow attackers to spoof the location bar and display a misleading URL for a malicious web page.
Impact
- Denial of Service
- Remote Code Execution
- Security Restriction Bypass
- Information Disclosure
System / Technologies affected
- Mozilla Firefox versions prior to 3.0.7
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Upgrade to Mozilla Firefox version 3.0.7 :
http://www.mozilla.com/firefox/
Vulnerability Identifier
Source
Related Link
- http://www.vupen.com/english/advisories/2009/0599
- http://secunia.com/advisories/34145/
- http://www.mozilla.org/security/announce/2009/mfsa2009-07.html
- http://www.mozilla.org/security/announce/2009/mfsa2009-08.html
- http://www.mozilla.org/security/announce/2009/mfsa2009-09.html
- http://www.mozilla.org/security/announce/2009/mfsa2009-10.html
- http://www.mozilla.org/security/announce/2009/mfsa2009-11.html
Share with