Mozilla Foundation Security Advisory 2010-19
Dangling pointer vulnerability in nsPluginArray
- Announced
- March 30, 2010
- Reporter
- regenrecht (via TippingPoint's Zero Day Initiative)
- Impact
- Critical
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 3.0.19
- Firefox 3.5.9
- Firefox 3.6.2
- SeaMonkey 2.0.4
Description
Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative an error in the implementation of
the window.navigator.plugins object. When a page
reloads, the plugins array would reallocate all of its members without
checking for existing references to each member. This could result in
the deletion of objects for which valid pointers still exist. An
attacker could use this vulnerability to crash a victim's browser and
run arbitrary code on the victim's machine.
Workaround
Disable JavaScript until a version containing these fixes can be installed.