Mozilla Foundation Security Advisory 2008-49

2008-11-14T00:00:00
ID SECURITYVULNS:DOC:20867
Type securityvulns
Reporter Securityvulns
Modified 2008-11-14T00:00:00

Description

Mozilla Foundation Security Advisory 2008-49

Title: Arbitrary code execution via Flash Player dynamic module unloading Impact: Critical Announced: November 12, 2008 Reporter: TippingPoint ZDI Products: Firefox, SeaMonkey

Fixed in: Firefox 2.0.0.18 SeaMonkey 1.1.13 Description

An anonymous security researcher reported via TippingPoint's Zero Day Initiative that insufficient checks were being performed to test whether the Flash module was properly dynamically unloaded. The researcher demonstrated that a SWF file which dynamically unloads itself from an outside JavaScript function can cause the browser to access a memory address no longer mapped to the Flash module, resulting in a crash. This crash could be used by an attacker to run arbitrary code on a victim's computer.

Firefox 3 is not affected by this issue. Workaround

Disable JavaScript until a version containing these fixes can be installed. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=433610
* CVE-2008-5013