Mozilla Foundation Security Advisory 2011-18

XSLT generate-id() function heap address leak

Announced

April 28, 2011

Reporter

Chris Evans

Impact

Low

Products

Firefox, SeaMonkey

Fixed in

• Firefox 3.5.19
• Firefox 3.6.17
• Firefox 4.0.1
• SeaMonkey 2.0.14

Description

Chris Evans of the Chrome Security Team reported that the XSLT generate-id() function returned a string that revealed a specific valid address of an object on the memory heap. It is possible that in some cases this address would be valuable information that could be used by an attacker while exploiting a different memory corruption but, in order to make an exploit more reliable or work around mitigation features in the browser or operating system.

• https://bugzilla.mozilla.org/show_bug.cgi?id=640339
• CVE-2011-1202