Mozilla Foundation Security Advisory 2010-50
Frameset integer overflow vulnerability
- Announced
- September 7, 2010
- Reporter
- Chris Rohlf
- Impact
- Critical
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.12
- Firefox 3.6.9
- SeaMonkey 2.0.7
- Thunderbird 3.0.7
- Thunderbird 3.1.3
Description
Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory.