Mozilla

mozilla

Mozilla Foundation Security Advisory 2013-52

Arbitrary code execution within Profiler

Announced
June 25, 2013
Reporter
Mariusz Mlynski
Impact
High
Products
Firefox
Fixed in
  • Firefox 22

Description

Security researcher Mariusz Mlynski reported that when a user examines the profiler output on a malicious website containing specially crafted code, it is possible for arbitrary code execution to occur. This occurs because the profiler user interface runs in a special iframe that parses data from the profiler to render the UI, leaving it susceptible to manipulation.

References