You are here: Known Vulnerabilities in Mozilla Products (Firefox 1.5) > MFSA 2006-11
Mozilla Foundation Security Advisory 2006-11
Title: Crashes with evidence of memory corruption (rv:1.8)
Date: April 13, 2006
Products: Firefox, Thunderbird, Mozilla Suite
Fixed in: Firefox 1.5
Mozilla Suite 1.7.13
As part of the Firefox 1.5 release we fixed several crash bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code and have been applied to the Firefox 1.0.x and Mozilla Suite 1.7.x releases
While fixing an unexploitable recursion-induced crash Bernd Mielke discovered that the CSS border-rendering code could potentially write past the end of an array.
Martijn Wargers found two potentially exploitable crashes when programmatically changing the -moz-grid and -moz-grid-group display styles.
Bob Clary found a memory corruption crash using the InstallTrigger.install() method that was introduced in Firefox 1.0.7 by one of the regression fixes described in MFSA 2005-58.