You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-29
Mozilla Foundation Security Advisory 2013-29
Title: Use-after-free in HTML Editor
Impact: Critical
Announced: March 7, 2013
Reporter: VUPEN Security
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 19.0.2
Firefox ESR 17.0.4
Thunderbird 17.0.4
Thunderbird ESR 17.0.4
SeaMonkey 2.16.1
Description
VUPEN Security, via TippingPoint's Zero Day Initiative, reported a use-after-free within the HTML editor when content script is run by the document.execCommand() function while internal editor operations are occurring. This could allow for arbitrary code execution.
