JavaScript new Function race condition — Mozilla

H. D. Moore reported a testcase that was able to trigger a race condition where JavaScript garbage collection deleted a temporary variable still being used in the creation of a new Function object. The resulting use of a deleted object may be potentially exploitable to run native code provided by...

Javascript navigator Object Vulnerability — Mozilla

An anonymous researcher for TippingPoint and the Zero Day Initiative showed that when used in a web page Java would reference properties of the window.navigator object as it started up. If the page replaced the navigator object before starting Java then the browser would crash in a way that could...

excel2000-exec.txt

Georgi Guninski security advisory 15, 2000 Excel 2000 vulnerability - executing programs Systems affected: Excel 2000/Win98 - almost sure other versions/OSes, have not tested Risk: High Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual...