Twelve vulnerabilities were identified in Mozilla Suite and Firefox, which may be exploited by malicious web sites to execute arbitrary commands or conduct spoofing and cross site scripting attacks.
- An improper cloning of base objects could allow web content scripts to walk up the prototype chain to get to a privileged object, which could be exploited by attackers to execute arbitrary code.
- An input validation error in the processing of XHTML documents containing fake <IMG> elements could be exploited by malicious web sites to execute scripting code with elevated "chrome" privileges.
- JavaScript dialog boxes do not display or include their origin, which allows a new window to open e.g. a prompt dialog box, which appears to be from a trusted site. See : FrSIRT/ADV-2005-0820
- An input validation error in the processing of javascript URLs opened by media players could be exploited by attackers to execute arbitrary code.
- An error in the processing of "top.focus()" calls could be exploited by attackers to conduct spoofing and/or cross site scripting attacks.
- A regression error could be exploited by attackers to inject arbitrary JavaScript code from one page into the frameset of another site.
- An input validation error in the "InstallVersion.compareTo()" function when handling specially crafted objects could be exploited by attackers to run arbitrary code or conduct denial of service attacks.
- An input validation error in the processing of "data:" URLs could be exploited by attackers to conduct cross site scripting attacks.
- An error in the "InstallTrigger.install()" method could be exploited to conduct cross site scripting attacks.
- An error when handling Wallpapers could be exploited by attackers to run arbitary code on a vulnerable system by convincing a user to use the "Set As Wallpaper" context menu item on a specially crafted image.
- Scripts in XBL controls from web content are run even when Javascript was disabled.
- An error in the browser UI when handling user/synthetic events could be exploited by attackers to execute arbitrary code.
Credits
Vulnerabilities reported by moz_bug_r_a4, shutdown, Secunia, Michael Krax, Kohei Yoshino, Matthew Mastracci, Omar Khan, and Jochen.
ChangeLog
2005-07-12 : Initial release
2005-07-16 : Updated CVE
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
