Multiple vulnerabilities have been identified in Mozilla Firefox, SeaMonkey and Thunderbird, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or compromise a vulnerable system.

The first issues are caused by memory corruption errors in the JavaScript and browser engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable application or execute arbitrary code.

The second vulnerability is caused due to certain invalid unicode characters being displayed as whitespace in the location bar when used as part of an IDN, which could be exploited to spoof the location bar.

The third weakness is caused by an error when interpreting the "file:" protocol, which could be exploited to access any domain's cookies on a vulnerable system by tricking a user into downloading and opening a malicious file via the browser.

The fourth issue is caused by an error when handling a non-200 response returned by a proxy in reply to a CONNECT request, which could cause the body of the response to be rendered within the context of the request "Host:" header.

The fifth vulnerability is caused due to a race condition in "NPObjWrapper_NewResolve" when accessing the properties of a NPObject, a wrapped JSObject, which could be exploited to execute arbitrary code by tricking a user into visiting a specially crafted web page.

The sixth issue is caused by an error when handling event listeners attached to an element whose owner document is null, which could be exploited to execute arbitrary JavaScript with chrome privileges.

The seventh vulnerability is caused due to the "file:" resource inheriting the principal of the previously loaded document when loaded via the location bar, which could allow unauthorized access to local files.

The eighth issue is caused due to content-loading policies not being checked before loading external script files into XUL documents, which could be exploited to bypass restrictions.

The ninth vulnerability is caused by an unspecified error which could allow scripts from page content to run with elevated privileges, leading to arbitrary code execution.

The tenth issue is caused by a memory corruption error when viewing a multipart/alternative mail message with a text/enhanced part, which could be exploited to crash Thunderbird or SeaMonkey, or execute arbitrary code.

Affected Products

Mozilla Firefox versions prior to 3.0.11
Mozilla Thunderbird versions prior to 2.0.0.22
Mozilla SeaMonkey versions prior to 1.1.17

Solution

Upgrade to Mozilla Firefox version 3.0.11 :
http://www.mozilla.com/firefox/

Upgrade to Mozilla SeaMonkey version 1.1.17 :
http://www.mozilla.org/projects/seamonkey/

Upgrade to Mozilla Thunderbird version 2.0.0.22 :
http://www.mozilla.com/thunderbird/

References

http://www.vupen.com/english/advisories/2009/1572
http://www.mozilla.org/security/announce/2009/mfsa2009-24.html
http://www.mozilla.org/security/announce/2009/mfsa2009-25.html
http://www.mozilla.org/security/announce/2009/mfsa2009-26.html
http://www.mozilla.org/security/announce/2009/mfsa2009-27.html
http://www.mozilla.org/security/announce/2009/mfsa2009-28.html
http://www.mozilla.org/security/announce/2009/mfsa2009-29.html
http://www.mozilla.org/security/announce/2009/mfsa2009-30.html
http://www.mozilla.org/security/announce/2009/mfsa2009-31.html
http://www.mozilla.org/security/announce/2009/mfsa2009-32.html
http://www.mozilla.org/security/announce/2009/mfsa2009-33.html

Credits

Vulnerabilities reported by Bob Clary, Jesse Ruderman, Alexander Sack, Bret McMillan, Tomeo Vizoso, Matt McCutchen, Martijn Wargers, Adam Hauner, Igor Bukanov, Pavel Cvrcek, Gregory Fleischer, Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang (Microsoft), Jakob Balle and Carsten Eiram (Secunia Research), moz_bug_r_a4, Adam Barth, Collin Jackson, and Wladimir Palant.

Changelog

2009-06-11 : Initial release
2009-06-22 : Updated Description and References (MFSA 2009-33)

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.