Martijn Wargers

The issue involves a use-after-free vulnerability that can be exploited by remote attackers to execute arbitrary code. This is achieved through vectors involving a change to an `nsDOMAttribute` node.

The issue is related to multiple unspecified vulnerabilities in the browser engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.

The issue affects the browser engine, allowing remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code. The exact vectors used for the attack are unknown.

The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via several vectors related to the browser engine, including `nsEventStateManager::GetContentState`, `nsNativeTheme::CheckBooleanAttr`, `UnhookTextRunFromFrames`, `ClearAllTextRunReferences`, `nsTextFrame::ClearTextRun`, `IsPercentageAware`, `PL DHashTableFinish`, `nsListBoxBodyFrame::GetNextItemBox`, `AtomTableClearEntry`, `nsHTMLEditor::HideResizers`, and `nsWindow::SetCursor`. These vectors are related to the atom table, DOM mutation events, and Unicode surrogates.

The issue is related to multiple unspecified vulnerabilities in the layout engine, specifically with the destruction of arbitrary layout objects by the nsViewManager::Composite function. This can cause a denial of service due to memory corruption and application crash, or potentially allow the execution of arbitrary code.

The issue allows remote attackers to cause a denial of service, resulting in a crash, via multiple vectors that trigger an assertion failure or other consequences.

The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and may also enable the execution of arbitrary code. This is related to unspecified vulnerabilities in the layout engine.

The issue allows remote attackers to cause a denial of service and possibly trigger memory corruption via certain vectors related to specific methods, including `nsTableFrame::GetFrameAtOrBefore`, `nsAccessibilityService::GetAccessible`, `nsBindingManager::GetNestedInsertionPoint`, `nsXBLPrototypeBinding::AttributeChanged`, `nsColumnSetFrame::GetContentInsertionFrame`, and `nsLineLayout::TrimTrailingWhiteSpaceIn`.

The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors.

The issue allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues.

The issue affects the layout engine, allowing remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors.

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption. This includes problems with `nsListControlFrame::FireMenuItemActiveEvent`, buffer overflows in the string class in out-of-memory conditions, table row and column groups, anonymous box selectors outside of UA stylesheets, stale references to removed nodes, and running the `crypto.generateCRMFRequest` callback on deleted context.

The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe. This occurs when designMode is enabled, causing a reference to a deleted controller context object.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox (affected versions not specified) Mozilla Thunderbird (affected versions not specified) Mozilla Seamonkey (affected versions not specified) Description: Potential security vulnerabilities have been identified that could be exploited remotely, resulting in unauthorized access, elevation of privileges, or Denial of Service (DoS). Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.0.x through 1.0.7 and versions 1.x through 1.4 Mozilla Thunderbird versions 1.0.x through 1.0.7 and versions 1.x through 1.4 Mozilla Suite versions prior to 1.7.13 SeaMonkey versions prior to 1.0 Description: The issue allows remote attackers to cause a denial of service by changing the `-moz-grid` and `-moz-grid-group` display styles, leading to a crash. Recommendations: For Mozilla Firefox versions 1.0.x through 1.0.7 and versions 1.x through 1.4, update to version 1.0.8 or 1.5 or later. For Mozilla Thunderbird versions 1.0.x through 1.0.7 and versions 1.x through 1.4, update to version 1.0.8 or 1.5 or later. For Mozilla Suite versions prior to 1.7.13, update to version 1.7.13 or later. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

The issue allows remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.