CVE-2010-0165: Improper Restriction of Operations within the Bounds of a Memory Buffer

The TraceRecorder::traverseScopeChain function in js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service memory corruption and application crash and possibly execute arbitrary code via vectors involving certain indirect...

CVE-2009-2662: Improper Restriction of Operations within the Bounds of a Memory Buffer

The browser engine in Mozilla Firefox 3.5.x before 3.5.2 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to the TraceRecorder::snapshot function in js/src/jstracer.cpp, and unspecified other vector...

CVE-2009-2477: Improper Control of Generation of Code

js/src/jstracer.cpp in the Just-in-time JIT JavaScript compiler aka TraceMonkey in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a...