Dveditz

A use-after-free vulnerability in SVG Animation has been discovered, allowing a remote attacker to execute arbitrary code. An exploit has been found in the wild, targeting Firefox and Tor Browser users on Windows.

The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect.

The issue allows remote attackers to bypass intended sandbox restrictions via a crafted web site, due to improper consideration of the sandbox attribute of an IFRAME element during processing of a contained OBJECT element.

The issue arises from improper handling of `onreadystatechange` events in conjunction with page reloading. This allows remote attackers to cause a denial of service, resulting in an application crash, or possibly execute arbitrary code via a crafted web site. The crafted web site triggers an attempt to execute data at an unmapped memory location.

A use-after-free issue in the `nsContentUtils::RemoveScriptBlocker` function allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption via unspecified vectors.

The issue is related to multiple unspecified vulnerabilities in the browser engine, allowing remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code. This is related to the `TraceRecorder::snapshot` function in `js/src/jstracer.cpp` and other unspecified vectors.

The issue concerns the jar: URI implementation, which fails to follow the Content-Disposition header of the inner URI. This allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation.

The issue allows remote attackers to execute arbitrary code via unknown vectors related to the ` moveToEdgeShift` XUL tree method. This method triggers garbage collection on objects that are still in use. The issue was demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.

The issue allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to a reachable assertion or an integer overflow.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 3.x before 3.0.1 Description: The issue allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors. This can be demonstrated by injection into a XUL error page, which can potentially be leveraged to execute arbitrary code. Recommendations: For Mozilla Firefox versions 3.x before 3.0.1, update to version 3.0.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 2.0.0.5 and 3.0alpha Description: The issue allows remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a mailto, nntp, news, snews, or telnet URI. Recommendations: For Mozilla Firefox version 2.0.0.5, update to a version that contains a fix for this issue. For Mozilla Firefox version 3.0alpha, update to a version that contains a fix for this issue.

The issue allows remote attackers to steal potentially sensitive information via an input control that monitors the values generated by the autocomplete capability.

The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libxul0d-dbg, libxul-dev, libsmjs1, libmozjs0d-dbg, libmozjs0d, libxul0d, libnss3-0d-dbg, libsmjs-dev, libnss3-0d, and libxul-common. These vulnerabilities can be exploited remotely, potentially leading to a disruption of confidentiality, integrity, and availability of protected information. Additionally, an integer overflow in the xpcom/io/nsEscape.cpp file in the browser engine of Mozilla Firefox can cause a denial of service (crash) via unknown vectors.