Vulnerability Note VU#265964
Mozilla products contain a race condition
Overview
Mozilla products contain a race condition. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable system.
Description
The Mozilla products JavaScript garbage collection process may delete a variable while that variable is still in use. This may corrupt memory in a way that can allow an attacker to execute arbitrary code. For complete list of affected products refer to Mozilla Foundation Security Advisory 2006-48. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. The attacker could also cause the vulnerable application to crash. |
Solution
Apply an update |
|
Systems Affected (Learn More)
Vendor | Status | Date Notified | Date Updated |
---|---|---|---|
Mozilla, Inc. | Affected | - | 27 Jul 2006 |
CVSS Metrics (Learn More)
Group | Score | Vector |
---|---|---|
Base | N/A | N/A |
Temporal | N/A | N/A |
Environmental | N/A | N/A |
References
- http://www.mozilla.org/security/announce/2006/mfsa2006-48.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=344759
- https://bugzilla.mozilla.org/show_bug.cgi?id=344960
- http://secunia.com/advisories/19873/
- http://secunia.com/advisories/21216/
- http://www.securityfocus.com/bid/19181
Credit
This vulnerability was reported in Mozilla Foundation Security Advisory 2006-48. Mozilla credits H. D. Moore with reporting this vulnerability.
This document was written by Jeff Gennari.
Other Information
- CVE IDs: CVE-2006-3803
- Date Public: 25 Jul 2006
- Date First Published: 27 Jul 2006
- Date Last Updated: 09 Feb 2007
- Severity Metric: 16.03
- Document Revision: 13
Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.