Crashes with evidence of memory corruption (rv:1.8)
- April 13, 2006
- Firefox, Mozilla Suite, SeaMonkey, Thunderbird
- Fixed in
- Firefox 1.0.8
- Firefox 1.5
- Mozilla Suite 1.7.13
- SeaMonkey 1
- Thunderbird 1.0.8
- Thunderbird 1.5
As part of the Firefox 1.5 release we fixed several crash bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code and have been applied to the Firefox 1.0.x and Mozilla Suite 1.7.x releases
While fixing an unexploitable recursion-induced crash Bernd Mielke discovered that the CSS border-rendering code could potentially write past the end of an array.
Martijn Wargers found two potentially exploitable crashes when programmatically changing the -moz-grid and -moz-grid-group display styles.
Bob Clary found a memory corruption crash using the InstallTrigger.install() method that was introduced in Firefox 1.0.7 by one of the regression fixes described in MFSA 2005-58.