You are here

U-101: Mozilla Firefox / Thunderbird / SeaMonkey XBL Binding Use-After-Free Vulnerability

February 13, 2012 - 7:00am

Addthis

PROBLEM:

A vulnerability has been reported in multiple Mozilla products.

PLATFORM:

Mozilla Firefox 10.x
Mozilla SeaMonkey 2.x
Mozilla Thunderbird 10.x

ABSTRACT:

A vulnerability has been reported in multiple Mozilla products, which can be exploited by malicious people to compromise a user's system.

referenceĀ  LINKS:

Vendor Advisory
Secunia Advisory SA48008
CVE-2012-0452

IMPACT ASSESSMENT:

High

Discussion:

A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
The vulnerability is caused due to a use-after-free error in the "nsXBLDocumentInfo::ReadPrototypeBindings()" method when handling XBL bindings in a hash table and can be exploited to cause a cycle collector to call an invalid virtual function.

Impact:

Remote system access

Solution:

Update Firefox and Thunderbird to version 10.0.1 and SeaMonkey to version 2.7.1.

Addthis