Vulnerability Note VU#466521

Mozilla JavaScript privilege escalation

Overview

Mozilla products contain multiple vulnerabilities that may allow a remote, unauthenticated attacker to execute arbitrary code.

I. Description

Mozilla Firefox, Thunderbird, and SeaMonkey do not properly handle JavaScript, which may allow privilege escalation and execution of arbitrary code on an affected system.

II. Impact

Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

III. Solution

Apply an update

Mozilla Foundation has issued new versions of the affected products which address these vulnerabilities. Please see MFSA 2008-14 for more details.

Workaround

Disabling JavaScript is an effective workaround for these vulnerabilities. It is strongly recommended that you disable JavaScript until a version containing patches for these vulnerabilities can be installed.

Systems Affected

Vendor	Status	Date Updated
Mozilla	Vulnerable	27-Mar-2008

References

http://www.mozilla.org/security/announce/2008/mfsa2008-14.html

Credit

This document was written by Joseph Pruszynski.

Other Information

Date Public	03/25/2008
Date First Published	03/27/2008 03:01:58 PM
Date Last Updated	03/27/2008
CERT Advisory
CVE Name	CVE-2008-1233; CVE-2008-1234; CVE-2008-1235
US-CERT Technical Alerts
Metric	20.38
Document Revision	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader