Mozilla Firefox, Thunderbird and SeaMonkey are prone to an overflow condition. The text-rendering functionality fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted long argument to the document.write method, a remote attacker can potentially execute arbitrary code.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Upgrade Firefox to version 3.6.11 or 3.5.14 or higher, Thunderbird to 3.1.5 or 3.0.9 or higher and SeaMonkey to 2.0.9 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
