Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2010-19

Dangling pointer vulnerability in nsPluginArray

Announced
March 30, 2010
Reporter
regenrecht (via TippingPoint's Zero Day Initiative)
Impact
Critical
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 3.0.19
  • Firefox 3.5.9
  • Firefox 3.6.2
  • SeaMonkey 2.0.4

Description

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the implementation of the window.navigator.plugins object. When a page reloads, the plugins array would reallocate all of its members without checking for existing references to each member. This could result in the deletion of objects for which valid pointers still exist. An attacker could use this vulnerability to crash a victim's browser and run arbitrary code on the victim's machine.

Workaround

Disable JavaScript until a version containing these fixes can be installed.

References