Technical Description

Multiple vulnerabilities have been identified in Mozilla Firefox and Seamonkey, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or take complete control of an affected system.

The first issue is caused by memory corruption errors in the browser and JavaScript engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable application or execute arbitrary code.

The second vulnerability is caused by a timing error when processing "addEventListener" or "setTimeout" elements, which could be exploited to inject malicious scripting code in the context of arbitrary web sites.

The third issue is caused by a timing error when processing "about:blank" frames, which could be exploited to spoof the content of arbitrary pages.

The fourth vulnerability is caused by an error when handling certain elements, which could be exploited by attackers to execute arbitrary code with chrome privileges.

The fifth issue is caused by an error when handling a filename containing the "%00" string (encoded null), which could be exploited by attackers to bypass security checks and potentially execute arbitrary programs.

The sixth vulnerability is caused by an origin validation error when accessing "wyciwyg://" documents, which could be exploited by attackers to steal arbitrary data.

The seventh issue is caused by errors when processing the "XPCNativeWrapper" object, which could be exploited by attackers to execute arbitrary code.

Note : A regression was introduced by the fix for MFSA 2007-20 and could be exploited by malicious web sites to execute arbitrary code with elevated privileges.

Affected Products

Mozilla Firefox versions prior to 2.0.0.6
Mozilla Seamonkey versions prior to 1.1.4

Solution

Upgrade to Firefox version 2.0.0.6 :
http://www.mozilla.com/firefox/

Upgrade to Seamonkey version 1.1.4 :
http://www.mozilla.org/projects/seamonkey/

References

http://www.vupen.com/english/advisories/2007/2564
http://www.mozilla.org/security/announce/2007/mfsa2007-18.html
http://www.mozilla.org/security/announce/2007/mfsa2007-19.html
http://www.mozilla.org/security/announce/2007/mfsa2007-20.html
http://www.mozilla.org/security/announce/2007/mfsa2007-21.html
http://www.mozilla.org/security/announce/2007/mfsa2007-22.html
http://www.mozilla.org/security/announce/2007/mfsa2007-23.html
http://www.mozilla.org/security/announce/2007/mfsa2007-24.html
http://www.mozilla.org/security/announce/2007/mfsa2007-25.html
http://www.mozilla.org/security/announce/2007/mfsa2007-26.html

Credits

Vulnerabilities reported by Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli Pettay, Paul Nickerson, Vladimir Sukhoy, Asaf Romano, Igor Bukanov, moz_bug_r_a4, Ronen Zilberman, Michal Zalewski, Ronald van den Heetkamp, Greg MacManus, Billy Rios and shutdown.

ChangeLog

2007-07-18 : Initial release
2007-07-20 : Updated Solution
2007-07-30 : Updated Solution

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.