Mozilla Foundation Security Advisory 2011-41

Mozilla Foundation Security Advisory 2011-41

Title: Potentially exploitable WebGL crashes
Impact: Critical
Announced: September 27, 2011
Reporter: Michael Jordan, Ben Hawkes
Products: Firefox, SeaMonkey

Fixed in: Firefox 7.0
SeaMonkey 2.4
Description

Michael Jordon of Context IS reported that in the ANGLE library used by WebGL the return value from GrowAtomTable() was not checked for errors. If an attacker could cause requests that exceeded the available memeory those would fail and potentially lead to a buffer overrun as subsequent code wrote into the non-allocated space.

Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=680840
CVE-2011-3002
https://bugzilla.mozilla.org/show_bug.cgi?id=682335
CVE-2011-3003