Mozilla Firefox / Thunderbird Multiple Vulnerabilities
Last Update Date:
22 Jun 2011 14:33
Release Date:
22 Jun 2011
6698
Views
RISK: High Risk
TYPE: Clients - Browsers
Multiple vulnerabilities have been identified in Mozilla Firefox and Thunderbird, which can be exploited by malicious people to bypass certain security restrictions and compromise a vulnerable system.
- Some unspecified errors can be exploited to corrupt memory.
- A use-after-free error in the "nsSVGPathSegList::ReplaceItem()" method when processing SVG element lists can be exploited to access an invalid element list when a user supplied callback deletes an object.
- A use-after-free error in the "nsSVGPointList::AppendElement()" method when processing SVG element lists can be exploited to access an invalid element list when a user supplied callback deletes an object.
- A use-after-free error in "nsXULCommandDispatcher" when processing XUL documents can be exploited to remove the currently used command updater.
- An error when handling cookies for two domains where one contains a trailing dot character can be exploited to bypass the same-origin policy and disclose a cookie to a third party.
Impact
- Remote Code Execution
- Security Restriction Bypass
System / Technologies affected
- Mozilla Firefox 3.6.x
- Mozilla Thunderbird 3.1.x
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Update to Firefox version 3.6.18 and Thunderbird version 3.1.11.
Vulnerability Identifier
- CVE-2011-0083
- CVE-2011-0085
- CVE-2011-2362
- CVE-2011-2363
- CVE-2011-2364
- CVE-2011-2365
- CVE-2011-2371
- CVE-2011-2373
- CVE-2011-2374
- CVE-2011-2376
- CVE-2011-2377
Source
Related Link
- http://secunia.com/advisories/44982/
- http://www.mozilla.org/security/announce/2011/mfsa2011-19.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-20.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-21.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-22.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-23.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-24.html
Share with