Overview
The Mozilla JavaScript engine contains multiple memory corruption vulnerabilities. These vulnerabilities may allow an attacker to execute arbitrary code, or create a denial of service condition.
Description
The Mozilla Foundation supports several Open Source projects, including the Mozilla, Seamonkey, and Firefox web browsers. The Thunderbird email client is also a Mozilla product. Multiple memory corruption vulnerabilities exist in the way Mozilla products process JavaScript. For more information refer to Mozilla Foundation Security Advisory 2007-01. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code or create a denial of service condition. |
Solution
Upgrade |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://www.mozilla.org/security/announce/2007/mfsa2007-01.html
- http://www.mozilla.org/products/mozilla1.x/
- http://www.mozilla.com/en-US/
- http://www.mozilla.com/en-US/thunderbird/
- http://www.mozilla.org/security/announce/2007/mfsa2007-01.html
- http://www.cert.org/tech_tips/securing_browser/
- http://secunia.com/advisories/24238/
- http://secunia.com/advisories/24287/
- http://secunia.com/advisories/24252/
- http://secunia.com/advisories/24320/
- http://secunia.com/advisories/24328/
- http://secunia.com/advisories/24293/
- http://secunia.com/advisories/24327/
- http://secunia.com/advisories/24343/
- http://secunia.com/advisories/24333/
- http://secunia.com/advisories/24393/
- http://secunia.com/advisories/24352/
- http://www.ciac.org/ciac/bulletins/r-164.shtml
- http://secunia.com/advisories/24406/
- http://secunia.com/advisories/24432/
- http://secunia.com/advisories/24410/
- http://secunia.com/advisories/24389/
- http://secunia.com/advisories/24455/
- http://secunia.com/advisories/24456/
- http://secunia.com/advisories/24457/
Acknowledgements
Thanks to Mozilla for information used in this report. Mozilla thanks Brian Crowder, Igor Bukanov, Johnny Stenback, moz_bug_r_a4 and shutdown.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2007-0777 |
| Severity Metric: | 2.65 |
| Date Public: | 2007-02-23 |
| Date First Published: | 2007-02-23 |
| Date Last Updated: | 2007-03-08 14:54 UTC |
| Document Revision: | 55 |