Package Instance

Justin Schuh and Tom Cross of the
IBM X-Force and Peter Williams of IBM Watson Labs reported
errors in Mozilla URL parsing routines.  These errors could be exploited
using a specially crafted UTF-8 URL in a hyperlink which could overflow
a stack buffer and allow an attacker to execute arbitrary code.Firefox 3 is not affected by this issue

Mozilla security researcher moz_bug_r_a4 reported a
series of vulnerabilities by which page content can pollute
XPCNativeWrappers and have arbitrary code run with chrome privileges.
One variant reported by moz_bug_r_a4 only affected Firefox 2.Mozilla developer Olli Pettay reported that XSLT can
create documents which do not have script handling objects.  moz_bug_r_a4
also reported that document.loadBindingDocument() returns a
document that does not have a script handling object.  These issues could
also be used by an attacker to run arbitrary script with chrome privileges.Thunderbird shares the browser engine with Firefox and
could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from running
JavaScript in mail.

Microsoft developer Dave Reed reported that certain
BOM characters are stripped from JavaScript code before it is executed.
This can lead to code, which would otherwise be treated as part of a quoted
string, to be executed.  The issue could potentially be used by an attacker
to bypass or evade script filters and perform a cross-site scripting (XSS)
attack. Chris Weber of Casaba Security independently
reported the same issue, noting that the same parsing problem affected
other attributes, such as the -moz-binding style property,
that could also be used to perform XSS attacks.
Security researcher Gareth Heyes reported an issue with the HTML parser in which the parser ignored certain low surrogate characters if they were HTML-escaped.  This issue could potentially be used to bypass naive script filtering and used in an XSS attack.  This issue only affected Firefox 2.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.

Mozilla security researcher moz_bug_r_a4 reported
that the same-origin check in nsXMLDocument::OnChannelRedirect()
could be bypassed.  This vulnerability could be used to execute JavaScript
in the context of a different website.Firefox 3 is not affected by this issueThunderbird shares the browser engine with Firefox and
could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from running
JavaScript in mail.

Microsoft developer Dave Reed reported that certain
BOM characters are stripped from JavaScript code before it is executed.
This can lead to code, which would otherwise be treated as part of a quoted
string, to be executed.  The issue could potentially be used by an attacker
to bypass or evade script filters and perform a cross-site scripting (XSS)
attack. Chris Weber of Casaba Security independently
reported the same issue, noting that the same parsing problem affected
other attributes, such as the -moz-binding style property,
that could also be used to perform XSS attacks.
Security researcher Gareth Heyes reported an issue with the HTML parser in which the parser ignored certain low surrogate characters if they were HTML-escaped.  This issue could potentially be used to bypass naive script filtering and used in an XSS attack.  This issue only affected Firefox 2.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.

Mozilla security researcher moz_bug_r_a4 reported a
series of vulnerabilities by which page content can pollute
XPCNativeWrappers and have arbitrary code run with chrome privileges.
One variant reported by moz_bug_r_a4 only affected Firefox 2.Mozilla developer Olli Pettay reported that XSLT can
create documents which do not have script handling objects.  moz_bug_r_a4
also reported that document.loadBindingDocument() returns a
document that does not have a script handling object.  These issues could
also be used by an attacker to run arbitrary script with chrome privileges.Thunderbird shares the browser engine with Firefox and
could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from running
JavaScript in mail.

Mozilla security researcher moz_bug_r_a4 reported a
series of vulnerabilities by which page content can pollute
XPCNativeWrappers and have arbitrary code run with chrome privileges.
One variant reported by moz_bug_r_a4 only affected Firefox 2.Mozilla developer Olli Pettay reported that XSLT can
create documents which do not have script handling objects.  moz_bug_r_a4
also reported that document.loadBindingDocument() returns a
document that does not have a script handling object.  These issues could
also be used by an attacker to run arbitrary script with chrome privileges.Thunderbird shares the browser engine with Firefox and
could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from running
JavaScript in mail.

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.Drew Yao of Apple Product Security reported two crashes in Mozilla image rendering code.  This vulnerability only affected Firefox 3.David Maciejak of Fortinet's FortiGuard Global Security
Research Team also reported a crash in graphics rendering which only
affected Firefox 3.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.Drew Yao of Apple Product Security reported two crashes in Mozilla image rendering code.  This vulnerability only affected Firefox 3.David Maciejak of Fortinet's FortiGuard Global Security
Research Team also reported a crash in graphics rendering which only
affected Firefox 3.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.