Nine vulnerabilities were identified in Mozilla Suite and Mozilla Firefox, which may be exploited by remote attackers to execute arbitrary commands or conduct spoofing and cross site scripting attacks.
The first flaw is due to a buffer overflow error when handling malformed URLs containing "soft hyphen" characters, which could be exploited by remote attackers to take complete control of an affected system via specially crafted Web pages. For additional information, see : FrSIRT/ADV-2005-1690
The second vulnerability is due to a heap overflow error when processing specially crafted XBM images, which could be exploited by malicious websites to compromise a vulnerable system.
The third flaw is due to a stack corruption error when processing Unicode sequences with ZWNJ (zero-width non-joiner) characters, which could be exploited by malicious websites to execute arbitrary commands.
The fourth issue occurs when malformed headers are added to an XMLHttpRequest, which could be exploited by attackers to bypass certain security restrictions.
The fifth flaw is due to an error where unprivileged controls from web content can implement XPCOM interfaces, which could be exploited by attackers to execute arbitrary scripts with elevated privileges.
The sixth vulnerability is due to an integer overflow error in the JavaScript engine, which could be exploited by malicious websites to compromise a vulnerable system.
The seventh flaw is due to an error where high privileged "chrome" pages could be loaded from an unprivileged "about:" page, which may be combined with a same-origin violation and exploited to execute arbitrary commands.
The eighth vulnerability is due to an error when opening and handling a specially crafted window, which could be exploited by attackers to bypass certain security features and conduct spoofing attacks.
The ninth issue is due to an input validation error when processing specially crafted URLs containing malicious shell commands enclosed within backquote characters, which could be exploited by remote attackers to compromise a vulnerable system. For additional information, see : FrSIRT/ADV-2005-1794
Credits
Vulnerabilities reported by jackerror, Mats Palmgren, moz_bug_r_a4, Georgi Guninski, heatsync and shutdown.
ChangeLog
2005-09-22 : Initial release
2005-10-01 : Updated Affected Products and Solution
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
