Mozilla Foundation Security Advisory 2011-43

2011-10-01T00:00:00
ID SECURITYVULNS:DOC:27079
Type securityvulns
Reporter Securityvulns
Modified 2011-10-01T00:00:00

Description

Mozilla Foundation Security Advisory 2011-43

Title: loadSubScript unwraps XPCNativeWrapper scope parameter Impact: Critical Announced: September 27, 2011 Reporter: David Rees Products: Firefox, SeaMonkey

Fixed in: Firefox 7.0 SeaMonkey 2.4 Description

David Rees reported that the JSSubScriptLoader (a feature used by some add-ons) was "unwrapping" XPCNativeWrappers when they were used as the scope parameter to loadSubScript(). Without the protection of the wrappers the add-on could be vulnerable to privilege escalation attacks from malicious web content. Whether any given add-on were vulnerable would depend on how the add-on used the feature and whether it interacted directly with web content, but we did find at least one vulnerable add-on and presumer there are more.

The unwrapping behavior was a change introduced during Firefox 4 development. Firefox 3.6 and earlier versions are not affected.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=653926 CVE-2011-3004