Mozilla Foundation Security Advisory 2012-20
Title: Miscellaneous memory safety hazards
Announced: April 24, 2012
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 12.0
Firefox ESR 10.0.4
Thunderbird ESR 10.0.4
Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products.
Christian Holler a reported memory safety and security problem affecting Firefox 11.
- Assertion failure: (ptrBits & 0x7) == 0, at ../../jsval.h:873 or Crash [@ compartment] or [@ js::array_shift]
Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay reported memory safety problems and crashes that affect Firefox ESR and Firefox 11.