2014-08-06 09:00:40 +04:00
|
|
|
---
|
2014-07-15 19:04:48 +04:00
|
|
|
announced: May 30, 2007
|
2014-08-06 09:00:40 +04:00
|
|
|
fixed_in:
|
|
|
|
|
- Firefox 2.0.0.4
|
|
|
|
|
- Firefox 1.5.0.12
|
|
|
|
|
- Thunderbird 2.0.0.4
|
|
|
|
|
- Thunderbird 1.5.0.12
|
|
|
|
|
- SeaMonkey 1.0.9
|
|
|
|
|
- SeaMonkey 1.1.2
|
2014-07-15 19:04:48 +04:00
|
|
|
impact: Critical
|
|
|
|
|
reporter: Mozilla developers and community
|
|
|
|
|
title: Crashes with evidence of memory corruption (rv:1.8.0.12/1.8.1.4)
|
2014-08-06 09:00:40 +04:00
|
|
|
---
|
2014-07-12 00:08:09 +04:00
|
|
|
|
|
|
|
|
<h3>Description</h3>
|
|
|
|
|
|
|
|
|
|
<p>As part of the Firefox 2.0.0.4 and 1.5.0.12 update releases Mozilla
|
|
|
|
|
developers fixed many bugs to improve the stability of the product.
|
|
|
|
|
Some of these crashes that showed evidence of memory corruption under
|
|
|
|
|
certain circumstances and we presume that with enough effort at least
|
|
|
|
|
some of these could be exploited to run arbitrary code.</p>
|
|
|
|
|
|
|
|
|
|
<p class="note">Thunderbird shares the browser engine with Firefox
|
|
|
|
|
and could be vulnerable if JavaScript were to be enabled in
|
|
|
|
|
mail. This is not the default setting and we strongly discourage users from
|
|
|
|
|
running JavaScript in mail. Without further investigation we cannot rule out
|
|
|
|
|
the possibility that for some of these an attacker might be able to prepare
|
|
|
|
|
memory for exploitation through some means other than JavaScript, such as
|
|
|
|
|
large images.</p>
|
|
|
|
|
|
|
|
|
|
<h3>Workaround</h3>
|
|
|
|
|
|
|
|
|
|
<p>Upgrade to the fixed versions. Do not enable JavaScript in Thunderbird
|
|
|
|
|
or the mail portions of SeaMonkey.</p>
|
|
|
|
|
|
|
|
|
|
<h3>References</h3>
|
|
|
|
|
|
|
|
|
|
<p>Boris Zbarsky, Eli Friedman, Georgi Guninski, Jesse Ruderman, Martijn
|
|
|
|
|
Wargers and Olli Pettay reported crashes in the layout engine.</p>
|
|
|
|
|
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a class="ex-ref" href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2867">CVE-2007-2867</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=377216">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=377216</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=370360">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=370360</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=372285">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=372285</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=306902">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=306902</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=348492">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=348492</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=369150">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=369150</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=369249">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=369249</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=372237">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=372237</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=372376">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=372376</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=376223">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=376223</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=336574">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=336574</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=336744">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=336744</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=336994">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=336994</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=362708">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=362708</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=369542">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=369542</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=371124">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=371124</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=378273">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=378273</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=378325">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=378325</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=374584">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=374584</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=375196">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=375196</a></li>
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
<p>Brendan Eich, Igor Bukanov, Jesse Ruderman, moz_bug_r_a4 and Wladimir
|
|
|
|
|
Palant reported potential memory corruption in the JavaScript engine.</p>
|
|
|
|
|
|
|
|
|
|
<ul>
|
|
|
|
|
<li><a class="ex-ref" href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2868">CVE-2007-2868</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=351102">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=351102</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=369666">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=369666</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=367561">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=367561</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=370101">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=370101</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=370488">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=370488</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=375183">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=375183</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=367630">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=367630</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=375711">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=375711</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=367121">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=367121</a></li>
|
|
|
|
|
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=369714">
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=369714</a></li>
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
