Mozilla Foundation Security Advisory 2009-38

2009-08-07T00:00:00
ID SECURITYVULNS:DOC:22255
Type securityvulns
Reporter Securityvulns
Modified 2009-08-07T00:00:00

Description

Mozilla Foundation Security Advisory 2009-38

Title: Data corruption with SOCKS5 reply containing DNS name longer than 15 characters Impact: Low Announced: July 21, 2009 Reporter: Andrej Andolsek Products: Firefox

Fixed in: Firefox 3.5.2 Firefox 3.0.12 Description

Andrej Andolsek reported that when Firefox receives a reply from a SOCKS5 proxy which contains a DNS name longer than 15 characters, the subsequent data stream in the response can become corrupted. There was no evidence of memory corruption, however, and the severity of the issue was determined to be low. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=459524
* CVE-2009-2470