Vulnerability Note VU#928956
Mozilla SVG memory corruption vulnerability
Mozilla products contain a memory corruption vulnerability related to SVG processing. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Scalable Vector Graphics (SVG) processing code in Mozilla Firefox and SeaMonkey contains a memory corruption vulnerability. According to Mozilla Foundation Security Advisory 2006-73:
Appending an SVG comment DOM node from one document into another type of document such as HTML in some cases results in a crash due to memory corruption that can be exploited to run arbitrary code.
By convincing a user to visit a specially crafted website, a remote, unauthenticated attacker may be able to execute arbitrary code.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Mozilla||Affected||-||20 Dec 2006|
CVSS Metrics (Learn More)
This vulnerability was reported by Mozilla who in turn credits TippingPoint and the Zero Day Initiative.
This document was written by Katie Steiner.
- CVE IDs: CVE-2006-6504
- Date Public: 19 Dec 2006
- Date First Published: 20 Dec 2006
- Date Last Updated: 07 Feb 2007
- Severity Metric: 26.77
- Document Revision: 29
If you have feedback, comments, or additional information about this vulnerability, please send us email.