Mozilla

Mozilla Foundation Security Advisory 2011-57

Crash when plugin removes itself on Mac OS X

Announced
December 20, 2011
Reporter
Richard Bateman
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 9
  • SeaMonkey 2.6
  • Thunderbird 9

Description

FireBreath developer Richard Bateman reported a crash on Mac OS X that occurred when a plugin deletes its containing DOM frame during a call from that frame. The observed symptom is a null dereference but we cannot rule out the possibility that content from a scriptable plugin such as Flash could find a way to dereference a more useful address and exploit it.

References