Skip to main content

Mozilla Firefox Multiple Vulnerabilities

Last Update Date: 30 Sep 2011 18:12 Release Date: 30 Sep 2011 5124 Views

RISK: High Risk

TYPE: Clients - Browsers

TYPE: Browsers

Multiple weaknesses and vulnerabilities have been identified in Mozilla Firefox, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

  1. Some unspecified errors can be exploited to corrupt memory.
  2. An error in the implementation of the "window.location" JavaScript object when creating named frames can be exploited to bypass the same-origin policy and e.g. conduct cross-site scripting attacks.
  3. An integer underflow error exists within the Regular Expression engine when evaluating certain regular expressions.
  4. A malicious application or extension could be downloaded and executed if a user is convinced into holding down the "Enter" key via e.g. a malicious game.
  5. An error within WebGL's ANGLE library does not properly check for return values from the "GrowAtomTable()" function and can be exploited to cause a buffer overflow by sending a series of requests.
  6. An unspecified error within WebGL can be exploited to corrupt memory.
  7. An unspecified error within the YARR regular expression library can be exploited to corrupt memory.
  8. An error exists within the JSSubScriptLoader, which incorrectly unwraps "XPCNativeWrappers". This can be exploited to execute arbitrary code by tricking a user into installing a malicious plug-in.
  9. A use-after-free error existing when parsing OGG headers.
  10. A weakness exists when handling multiple tabs and can be exploited to detect keystrokes sent to another tab.
NOTE: Additionally, a weakness exists when handling the "Location" header, which can lead to response splitting attacks when visiting a vulnerable web server.

Impact

  • Remote Code Execution
  • Security Restriction Bypass

System / Technologies affected

  • Mozilla Firefox 3.6.x 
  • Mozilla Firefox 6.x

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

  • For Mozilla Firefox 3.6.x
    Update to version 3.6.23.
  • For Mozilla Firefox 6.x
    Upgrade to version 7.0.

Vulnerability Identifier


Source


Related Link