Mozilla Foundation Security Advisory 2008-49
Arbitrary code execution via Flash Player dynamic module unloading
- Announced
- November 12, 2008
- Reporter
- TippingPoint ZDI
- Impact
- Critical
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 2.0.0.18
- SeaMonkey 1.1.13
Description
An anonymous security researcher reported via TippingPoint's Zero Day Initiative that insufficient checks were being performed to test whether the Flash module was properly dynamically unloaded. The researcher demonstrated that a SWF file which dynamically unloads itself from an outside JavaScript function can cause the browser to access a memory address no longer mapped to the Flash module, resulting in a crash. This crash could be used by an attacker to run arbitrary code on a victim's computer.
Firefox 3 is not affected by this issue.
Workaround
Disable JavaScript until a version containing these fixes can be installed.