Brendan Eich

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger memory corruption in the JavaScript engine.

The E4X implementation exposes the internal `AnyName` object to external interfaces, allowing multiple cooperating domains to exchange information in violation of the same origin restrictions.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.

The issue allows remote attackers to read portions of heap memory in a Javascript string. This is achieved via the lambda replace method in the `find replen` function.

Name of the Vulnerable Software and Affected Versions: Mozilla versions 1.4 and earlier Description: The issue allows attackers to execute native methods by modifying the string used as input to the `script.thaw` JavaScript function, which is then deserialized and executed. This is related to the `Script.prototype.freeze/thaw` functionality. Recommendations: For Mozilla versions 1.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.