SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#141528

Mozilla products fail to properly handle JavaScript regular expressions

Overview

Mozilla products fail to properly handle certain JavaScript regular expressions. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.

I. Description

According to Mozilla Foundation Security Advisory 2006-57:

    ...a regular expression that ends with a backslash inside an unterminated character set (e.g. "[\\") will cause the regular epression engine to read beyond the end of the buffer, possibly leading to a crash.

JavaScript must be enabled in order for this vulnerability to be exposed. JavaScript is enabled by default in the Firefox web browser, but not in the Mozilla Thunderbird email client. This vulnerability could be exploited in an affected web browser by viewing a specially crafted web page, or in an affected email client by viewing a specially crafted email message.

Note that this issue affects Mozilla Firefox, Thunderbird, and SeaMonkey.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition.

III. Solution

Upgrade

This issue is addressed by Firefox 1.5.0.7, Thunderbird 1.5.0.7, and SeaMonkey 1.0.5.

Disable JavaScript

For instructions on how to disable JavaScript in Firefox, please refer to the Firefox section of the Securing Your Web Browser document.

Systems Affected

VendorStatusDate Updated
Mozilla, Inc.Vulnerable18-Sep-2006
SUSE LinuxVulnerable2-Oct-2006

References


http://secunia.com/advisories/21906/
http://www.mozilla.org/security/announce/2006/mfsa2006-57.html

Credit

This issue was reported in Mozilla Foundation Security Advisory 2006-57. Mozilla credits Priit Laes, CanadianGuy, Girts Folkmanis, and Catalin Patulea for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public09/15/2006
Date First Published09/20/2006 09:35:53 AM
Date Last Updated10/02/2006
CERT Advisory 
CVE Name 
US-CERT Technical Alerts 
Metric27.00
Document Revision22

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader