SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Mozilla Firefox Vendors:   Mozilla.org
Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019873
SecurityTracker URL:  http://securitytracker.com/id/1019873
CVE Reference:   CVE-2008-1380   (Links to External Site)
Date:  Apr 16 2008
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.0.0.13
Description:   A vulnerability was reported in Mozilla Firefox. A remote user can cause denial of service conditions.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a flaw in the JavaScript garbage collector code and cause the target user's browser to crash.

The vendor indicates that similar crashes have been exploitable in the past, so arbitrary code execution may be possible. However, the reported did not confirm code execution.

This vulnerability was introduced by the fix for CVE-2008-1237 described in Mozilla Foundation Security Advisory 2008-15 [see Alert ID 1019695].

Impact:   A remote user can create HTML that, when loaded by the target user, will cause the target user's browser to crash.

A remote user may be able to cause arbitrary code to be executed on the target user's system.

Solution:   The vendor has issued a fixed version (2.0.0.14).

The advisory is available at:

http://www.mozilla.org/security/announce/2008/mfsa2008-20.html

Vendor URL:  www.mozilla.org/security/announce/2008/mfsa2008-20.html (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 17 2008 (Red Hat Issues Fix) Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
Red Hat has released a fix for Red Hat Enterprise Linux 4 and 5.
Apr 17 2008 (Mozilla Seamonkey is Affected) Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
Mozilla Seamonkey is affected.
Apr 17 2008 (Red Hat Issues Fix for Seamonkey) Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
Red Hat has released a fix for Seamonkey on Red Hat Enterprise Linux 2.1, 3, and 4.
Apr 17 2008 (Mozilla Thunderbird is Affected) Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
Mozilla Thunderbird is affected.
Apr 30 2008 (Red Hat Issues Fix for Thunderbird) Mozilla Firefox Bug in JavaScript Garbage Collector Lets Remote Users Deny Service
Red Hat has released a fix for Thunderbird on Red Hat Enterprise Linux 4 and 5.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC