Mozilla and Firefox vulnerabilities

Releases

• Ubuntu 5.04

Details

When a popup is blocked the user is given the ability to open that
popup through the popup-blocking status bar icon and, in Firefox,
through the information bar. Doron Rosenberg noticed that popups
which are permitted by the user were executed with elevated
privileges, which could be abused to automatically install and execute
arbitrary code with the privileges of the user. (CAN-2005-1153)

It was discovered that the browser did not start with a clean global
JavaScript state for each new website. This allowed a malicious web
page to define a global variable known to be used by a different site,
allowing malicious code to be executed in the context of that site
(for example, sending web mail or automatic purchasing).
(CAN-2005-1154)

Michael Krax discovered a flaw in the “favicon” links handler. A
malicious web page could define a favicon link tag as JavaScript,
which could be exploited to execute arbitrary code with the privileges
of the user. (CAN-2005-1155)

Michael Krax found two flaws in the Search Plugin installation. This
allowed malicious plugins to execute arbitrary code in the context of
the current site. If the current page had elevated privileges (like
“about:plugins” or “about:config”), the malicious plugin could even
install malicious software when a search was performed.
(CAN-2005-1156, CAN-2005-1157)

Kohei Yoshino discovered two missing security checks when Firefox
opens links in its sidebar. This allowed a malicious web page to
construct a link that, when clicked on, could execute arbitrary
JavaScript code with the privileges of the user. (CAN-2005-1158)

Georgi Guninski discovered that the types of certain XPInstall
related JavaScript objects were not sufficiently validated when they
were called. This could be exploited by a malicious website to crash
Firefox or even execute arbitrary code with the privileges of the
user. (CAN-2005-1159)

Firefox did not properly verify the values of XML DOM nodes of web
pages. By tricking the user to perform a common action like clicking
on a link or opening the context menu, a malicious page could exploit
this to execute arbitrary JavaScript code with the full privileges of
the user. (CAN-2005-1160)