HTTP: Mozilla Firefox XUL Tree Element Code Execution

A memory corruption vulnerability exists in Mozilla Firefox. The flaw is due to a dangling pointer while processing a malicious XUL document. A remote attacker can exploit this vulnerability by enticing the target user to open a crafted web page. In a successful attack, where arbitrary code is injected and executed on the vulnerable target host, the behaviour of the target system is dependent on the malicious code. Note that any code executed by the attacker runs with the privileges of the logged in user. In an attack where code execution fails, the vulnerable application will terminate abnormally while parsing the malicious document.

Extended Description

Mozilla Firefox is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions. Versions prior to Firefox 3.0.8 are vulnerable.

Affected Products

Debian linux

References

BugTraq: 34181

CVE: CVE-2009-1044

Short Name

HTTP:STC:MOZILLA:XUL-TREE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Mozilla Firefox XUL Tree Element Code Execution

Extended Description

Affected Products

References

Found a potential security threat?