Mozilla Foundation Security Advisory 2010-67

2010-10-23T00:00:00
ID SECURITYVULNS:DOC:24958
Type securityvulns
Reporter Securityvulns
Modified 2010-10-23T00:00:00

Description

Mozilla Foundation Security Advisory 2010-67

Title: Dangling pointer vulnerability in LookupGetterOrSetter Impact: Critical Announced: October 19, 2010 Reporter: regenrecht Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird 3.0.9 SeaMonkey 2.0.9 Description

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that when window.lookupGetter is called with no arguments the code assumes the top JavaScript stack value is a property name. Since there were no arguments passed into the function, the top value could represent uninitialized memory or a pointer to a previously freed JavaScript object. Under such circumstances the value is passed to another subroutine which calls through the dangling pointer, potentially executing attacker-controlled memory. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=598669
* CVE-2010-3183