• Security Center
  • Security Advisories
  • Known Vulnerabilities
  • Bug Bounty
  • Security Blog

You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-23

Mozilla Foundation Security Advisory 2013-23

Title: Wrapped WebIDL objects can be wrapped again
Impact: Critical
Announced: February 19, 2013
Reporter: Boris Zbarsky
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 19.0
  SeaMonkey 2.16

Description

Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapped state. This could lead to an exploitable condition in rare cases.

References

• Wrapping a WebIDL object should beware WrapNativeParent reentering itself (CVE-2013-0765)