Mozilla Foundation Security Advisory 2010-65
Buffer overflow and memory corruption using document.write
- Announced
- October 19, 2010
- Reporter
- Alexander Miller
- Impact
- Critical
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.14
- Firefox 3.6.11
- SeaMonkey 2.0.9
- Thunderbird 3.0.9
- Thunderbird 3.1.5
Description
Security researcher Alexander Miller reported that
passing an excessively long string to document.write
could cause text rendering routines to end up in an inconsistent state
with sections of stack memory being overwritten with the string data.
An attacker could use this flaw to crash a victim's browser and
potentially run arbitrary code on their computer.