Mozilla Foundation Security Advisory 2008-34
Title: Remote code execution by overflowing CSS reference counter Impact: Critical Announced: July 15, 2008 Reporter: TippingPoint Zero Day Initiative Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 3.0.1 Firefox 184.108.40.206 Thunderbird 220.127.116.11 SeaMonkey 1.1.11 Description
An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's internal CSSValue array data structure. The vulnerability was caused by an insufficiently sized variable being used as a reference counter for CSS objects. By creating a very large number of references to a common CSS object, this counter could be overflowed which could cause a crash when the browser attempts to free the CSS object while still in use. An attacker could use this crash to run arbitrary code on the victim's computer.
Bug details embargoed until after the upgrade period
* https://bugzilla.mozilla.org/show_bug.cgi?id=440230 * CVE-2008-2785