Darin Fisher

The issue concerns the improper implementation of the history.replaceState method in certain situations involving IFRAME elements, allowing remote attackers to obtain sensitive information via a crafted HTML document.

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption. This includes problems with `nsListControlFrame::FireMenuItemActiveEvent`, buffer overflows in the string class in out-of-memory conditions, table row and column groups, anonymous box selectors outside of UA stylesheets, stale references to removed nodes, and running the `crypto.generateCRMFRequest` callback on deleted context.

Name of the Vulnerable Software and Affected Versions: Mozilla versions 1.7 beta Description: A remote attacker can read arbitrary files in known locations due to an unknown vulnerability in LiveConnect. Recommendations: For Mozilla version 1.7 beta, at the moment, there is no information about a newer version that contains a fix for this vulnerability.