Mozilla Foundation Security Advisory 2009-23
Crash in nsTextFrame::ClearTextRun()
- Announced
- April 27, 2009
- Reporter
- Marc Gueury, Daniel Veditz
- Impact
- Critical
- Products
- Firefox
- Fixed in
-
- Firefox 3.0.10
Description
One of the security fixes in Firefox 3.0.9 introduced a regression that caused some users to experience frequent crashes. Users of the HTML Validator add-on were particularly affected, but other users also experienced this crash in some situations. In analyzing this crash we discovered that it was due to memory corruption similar to cases that have been identified as security vulnerabilities in the past.