Mozilla Foundation Security Advisory 2009-08

Mozilla Foundation Security Advisory 2009-08

Title: Mozilla Firefox XUL Linked Clones Double Free Vulnerability
Impact: Critical
Announced: March 4, 2009
Reporter: TippingPoint Zero Day Initiative
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.0.7
Thunderbird 2.0.0.21
SeaMonkey 1.1.15
Description

An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's garbage collection process. The vulnerability was caused by improper memory management of a set of cloned XUL DOM elements which were linked as a parent and child. After reloading the browser on a page with such linked elements, the browser would crash when attempting to access an object which was already destroyed. An attacker could use this crash to run arbitrary code on the victim's computer.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=474456
* CVE-2009-0775