Package Instance

Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative that a select event handler for XUL
tree items could be called after the tree item was deleted.  This
results in the execution of previously freed memory which an attacker
could use to crash a victim's browser and run arbitrary code on the
victim's computer.This vulnerability does not affect Firefox 3.6

Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative an error in the implementation of
the window.navigator.plugins object.  When a page
reloads, the plugins array would reallocate all of its members without
checking for existing references to each member.  This could result in
the deletion of objects for which valid pointers still exist.  An
attacker could use this vulnerability to crash a victim's browser and
run arbitrary code on the victim's machine.

Mozilla developers identified and fixed several stability bugs in
the browser engine used in Firefox and other Mozilla-based
products. Some of these crashes showed evidence of memory corruption
under certain circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary code.

Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative an error in the
way <option> elements are inserted into a XUL
tree <optgroup>.  In certain cases, the number of
references to an <option> element is under-counted so
that when the element is deleted, a live pointer to its old location
is kept around and may later be used.  An attacker could potentially
use these conditions to run arbitrary code on a victim's computer.

Mozilla security researcher moz_bug_r_a4 reported
that the XMLHttpRequestSpy module in the Firebug add-on was exposing
an underlying chrome privilege escalation vulnerability.  When the
XMLHttpRequestSpy object was created, it would attach various
properties of itself to objects defined in web content, which were not
being properly wrapped to prevent their exposure to chrome privileged
objects.  This could result in an attacker running arbitrary
JavaScript on a victim's machine, though it required the victim to
have Firebug installed, so the overall severity of the issue was
determined to be High.This vulnerability does not affect Firefox 3.6

Security researcher Paul Stone reported that a
browser applet could be used to turn a simple mouse click into a
drag-and-drop action, potentially resulting in the unintended loading
of resources in a user's browser.  This behavior could be used twice
in succession to first load a privileged chrome: URL in a
victim's browser, then load a malicious javascript: URL
on top of the same document resulting in arbitrary script execution
with chrome privileges.