Mozilla Foundation Security Advisory 2010-35
DOM attribute cloning remote code execution vulnerability
- Announced
- July 20, 2010
- Reporter
- regenrecht (via TippingPoint's Zero Day Initiative)
- Impact
- Critical
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 3.5.11
- Firefox 3.6.7
- SeaMonkey 2.0.6
Description
Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the DOM attribute cloning routine where under certain circumstances an event attribute node can be deleted while another object still contains a reference to it. This reference could subsequently be accessed, potentially causing the execution of attacker controlled memory.