Mozilla Foundation Security Advisory 2010-67
Dangling pointer vulnerability in LookupGetterOrSetter
- Announced
- October 19, 2010
- Reporter
- regenrecht
- Impact
- Critical
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.5.14
- Firefox 3.6.11
- SeaMonkey 2.0.9
- Thunderbird 3.0.9
- Thunderbird 3.1.5
Description
Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative that
when window.__lookupGetter__ is called with no arguments
the code assumes the top JavaScript stack value is a property name.
Since there were no arguments passed into the function, the top value
could represent uninitialized memory or a pointer to a previously
freed JavaScript object. Under such circumstances the value is passed
to another subroutine which calls through the dangling pointer,
potentially executing attacker-controlled memory.