(Sun Issues Fix for Solaris) Mozilla Firefox Memory Corruption in Layout Engine and Javascript Engine May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1017787 |
|
SecurityTracker URL: http://securitytracker.com/id/1017787
|
|
CVE Reference:
CVE-2006-6497, CVE-2006-6498, CVE-2006-6499
(Links to External Site)
|
Updated: Apr 24 2007
|
Original Entry Date: Mar 16 2007
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.5 prior to 1.5.0.9, 2.0
|
Description:
A vulnerability was reported in Mozilla Firefox. A remote user may be able to cause arbitrary code to be executed on the target user's system.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a memory corruption error and crash or potentially execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
Andrew Miller, David Baron, Georgi Guninski, Jesse Ruderman, Olli Pettay, and Vladimir Vukicevic reported the vulnerabilities in the layout engine.
Igor Bukanov, Jesse Ruderman and moz_bug_r_a4 reported the vulnerabilities in the JavaScript engine.
Keith Victor reported a vulnerability in js_dtoa().
[Editor's note: The Mozilla Foundation has issued several additional advisories affecting Firefox, Thunderbird, and Seamonkey. Separate Alerts will be issued later today for each Mozilla advisory.]
|
Impact:
A remote user can create HTML that, when loaded by the target user, may execute arbitrary code on the target user's system.
|
Solution:
Sun has issued the following fixes.
SPARC Platform
* Solaris 8 with patch 120671-05 or later
* Solaris 9 with patch 120671-05 or later
* Solaris 10 with patch 119115-24 or later
x86 Platform
* Solaris 8 with patch 120672-05 or later
* Solaris 9 with patch 120672-05 or later
* Solaris 10 with patch 119116-24 or later
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102846-1
|
Vendor URL: www.mozilla.org/security/announce/2006/mfsa2006-68.html (Links to External Site)
|
Cause:
Access control error, Boundary error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 15 Mar 2007 23:09:28 -0500
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102846-1
|
CVE-2006-6499
|
|
