Package Instance

Yosuke Hasegawa reported that the Mozilla browser engine
mishandled invalid sequences in the Shift-JIS encoding. When encountering an
invalid pair Mozilla would turn the entire two-byte sequence into a single
unknown character rather than an unknown character followed by a valid
single-byte character. On some sites attackers may have been able to
end their input with the first byte of a two byte sequence; when that
input was later put into a page context it might cause the following
delimiter (such as a double-quote) to be consumed, breaking the format
of the page.  Depending on the page this could potentially be used to
steal data or inject script into the page.

Mozilla security researcher moz_bug_r_a4 reported that
the problem described in MFSA 2011-43 and fixed in
Firefox 7 also affected Firefox 3.6: a malicious page could potentially
exploit a Firefox user who had installed an add-on that used loadSubscript
in vulnerable ways.

Marc Schoenefeld reported a crash when using Firebug
to profile a JavaScript file with many functions. It may be possible
to trigger this crash without the use of debugging APIs, and if so
this could be exploitable.