CVE-2009-2477

js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka
TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to
execute arbitrary code via certain use of the escape function that triggers
access to uninitialized memory locations, as originally demonstrated by a
document containing P and FONT elements.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/firefox-3.5/+bug/400557&gt;