SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#239124

Mozilla fails to properly handle simultaneous XPCOM events

Overview

Mozilla products are vulnerable to memory corruption via simultaneous XPCOM events. This may allow a remote attacker to execute arbitrary code on a vulnerable system.

I. Description

XPCOM

XPCOM is a cross-platform component object model similar to Microsoft COM or CORBA. XPCOM provides the following features to software developers:

  • Component management
  • File abstraction
  • Object message passing
  • Memory Management
The problem

XPCOM events that occur simultaneously can trigger the use of a deleted timer object, which can cause memory corruption.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. The attacker could also cause the vulnerable application to crash.

III. Solution

Apply an update

This vulnerability is addressed in Firefox 1.5.0.5, Thunderbird 1.5.0.5, and SeaMonkey 1.0.3 according to the Mozilla Foundation Security Update 2006-46.

Disable JavaScript

This vulnerability can be mitigated by disabling JavaScript.

Systems Affected

VendorStatusDate NotifiedDate Updated
America Online, Inc.Unknown31-Jul-2006
Mozilla, Inc.Vulnerable27-Jul-2006
Netscape Communications CorporationUnknown31-Jul-2006

References


http://www.mozilla.org/security/announce/2006/mfsa2006-46.html
https://bugzilla.mozilla.org/show_bug.cgi?id=342507
https://bugzilla.mozilla.org/show_bug.cgi?id=320982
http://secunia.com/advisories/19873/
http://secunia.com/advisories/21216/
http://secunia.com/secunia_research/2006-53/
https://issues.rpath.com/browse/RPL-537
http://www.securityfocus.com/bid/19181

Credit

This vulnerability was reported by the Mozilla Foundation, who in turn credit Secunia Research.

This document was written by Will Dormann.

Other Information

Date Public:2006-07-25
Date First Published:2006-07-27
Date Last Updated:2007-02-09
CERT Advisory: 
CVE-ID(s):CVE-2006-3113
NVD-ID(s):CVE-2006-3113
US-CERT Technical Alerts: 
Metric:7.83
Document Revision:10

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader