A memory corruption flaw exists in Firefox. The Just-in-Time (JIT) compiler can enter a corrupt state following native function calls resulting in memory corruption. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Upgrade to version 3.5.1 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable JavaScript.

• CVE ID: 2009-2477 (see also: NVD)
• Bugtraq ID: 35660
• Secunia Advisory ID: 35798 35964 51766
• CERT VU: 443060
• Metasploit ID: 55846
• Milw0rm: 9137 9214
• Exploit Database: 9137 9214
• Vendor Specific News/Changelog Entry: http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
  https://bugzilla.mozilla.org/show_bug.cgi?id=503286
  https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00900.html
  https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00901.html
• Generic Exploit URL: http://immunitysec.com
• Other Advisory URL: http://isc.sans.org/diary.html?storyid=6796
  http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html
  http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761
  http://www.saintcorporation.com/cgi-bin/exploit_info/firefox_jitescapefunction_memory_corruption
  http://www.vupen.com/english/advisories/2009/1868
• Vendor Specific Advisory URL: http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
  http://www.mozilla.org/security/announce/2009/mfsa2009-41.html
• News Article: http://www.scmagazineus.com/Firefox-releases-update-to-fix-severe-vulnerability/article/140255/

• zbyte -
• Simon Berry-Byrne -