Lucene search

Mozilla FoundationMFSA2006-48

HistoryJul 25, 2006 - 12:00 a.m.

JavaScript new Function race condition — Mozilla

2006-07-2500:00:00

Mozilla Foundation

www.mozilla.org

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.969 High

EPSS

Percentile

99.7%

JSON

H. D. Moore reported a testcase that was able to trigger a race condition where JavaScript garbage collection deleted a temporary variable still being used in the creation of a new Function object. The resulting use of a deleted object may be potentially exploitable to run native code provided by the attacker.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.5.0.5

mozillaseamonkeyRange<1.0.3

mozillathunderbirdRange<1.5.0.5

CPENameOperatorVersion
firefoxlt1.5.0.5
seamonkeylt1.0.3
thunderbirdlt1.5.0.5

Name	Operator	Version
firefox	lt	1.5.0.5
seamonkey	lt	1.0.3
thunderbird	lt	1.5.0.5

References

bugzilla.mozilla.org/show_bug.cgi?id=344759

bugzilla.mozilla.org/show_bug.cgi?id=344960

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.969 High

EPSS

Percentile

99.7%

JSON

Related for MFSA2006-48