Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:20867
HistoryNov 14, 2008 - 12:00 a.m.

Mozilla Foundation Security Advisory 2008-49

2008-11-1400:00:00
vulners.com
22

Mozilla Foundation Security Advisory 2008-49

Title: Arbitrary code execution via Flash Player dynamic module unloading
Impact: Critical
Announced: November 12, 2008
Reporter: TippingPoint ZDI
Products: Firefox, SeaMonkey

Fixed in: Firefox 2.0.0.18
SeaMonkey 1.1.13
Description

An anonymous security researcher reported via TippingPoint's Zero Day Initiative that insufficient checks were being performed to test whether the Flash module was properly dynamically unloaded. The researcher demonstrated that a SWF file which dynamically unloads itself from an outside JavaScript function can cause the browser to access a memory address no longer mapped to the Flash module, resulting in a crash. This crash could be used by an attacker to run arbitrary code on a victim's computer.

Firefox 3 is not affected by this issue.
Workaround

Disable JavaScript until a version containing these fixes can be installed.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=433610
* CVE-2008-5013