Multiple vulnerabilities have been identified in Mozilla Firefox, Thunderbird and SeaMonkey, which could be exploited by attackers to manipulate or disclose certain data, bypass security restrictions or compromise a vulnerable system.

The first issues are caused by memory corruption errors in the JavaScript and browser engines when parsing malformed data, which could be exploited by attackers to crash a vulnerable browser or execute arbitrary code.

The second vulnerability is caused due to a heap corruption error in the implementation of Web Workers, which could be exploited to crash a vulnerable browser or execute arbitrary code.

The third issue is caused due to a use-after-free error in the HTML parser, which could be exploited to crash a vulnerable browser or execute arbitrary code.

The fourth vulnerability is caused by an error related to "dialogArguments()" calls, which could be exploited to conduct cross domain scripting attacks.

The fifth issue is caused by an error when processing a SVG document embedded into another document with a specially crafted "Content-Type", which could be exploited to conduct cross domain scripting attacks.

Affected Products

Mozilla Firefox versions prior to 3.6
Mozilla Firefox versions prior to 3.5.8
Mozilla Firefox versions prior to 3.0.18
Mozilla Thunderbird versions prior to 3.0.2
Mozilla SeaMonkey versions prior to 2.0.3

Solution

Upgrade to Mozilla Firefox version 3.6, 3.5.8 or 3.0.18 :
http://www.mozilla.com/firefox/

Upgrade to Mozilla Thunderbird version 3.0.2 :
http://www.mozilla.com/thunderbird

Upgrade to Mozilla SeaMonkey version 2.0.3 :
http://www.mozilla.org/projects/seamonkey/

References

http://www.vupen.com/english/advisories/2010/0405
http://www.mozilla.org/security/announce/2010/mfsa2010-05.html
http://www.mozilla.org/security/announce/2010/mfsa2010-04.html
http://www.mozilla.org/security/announce/2010/mfsa2010-03.html
http://www.mozilla.org/security/announce/2010/mfsa2010-02.html
http://www.mozilla.org/security/announce/2010/mfsa2010-01.html

Credits

Vulnerabilities reported by Henri Sivonen, Boris Zbarsky, Zack Weinberg, Bob Clary, Martijn Wargers, Paul Nickerson, Orlando Barrera II via ZDI, Alin Rad Pop (Secunia Research), Hidetake Jo (Microsoft Vulnerability Research), TippingPoint Zero Day Initiative, and Georgi Guninski.

Changelog

2010-02-18 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.