Mozilla Firefox, Mozilla Thunderbird, and Mozilla SeaMonkey contain a user-after-free error when handling child nodes. The issue is due to the 'AttributeChildRemoved()' method when removing child nodes from the 'nsDOMAttribute' node. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.

Upgrade Firefox to version 10.0 or higher or 3.6.26 or higher, Thunderbird to version 10.0 or higher or 3.1.18 or higher, and SeaMonkey to version 2.7 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026605 1026606 1026607
• ISS X-Force ID: 1026605
• Exploit Database: 18870
• CVE ID: 2011-3659 (see also: NVD)
• Secunia Advisory ID: 47751 47789 47791 47816 47839 47840 47902 47939 47940 47963 47980 47994 48075 51766 52614 52615
• Related OSVDB ID: 78733 78734 78735 78737 78738 78739 78740 78741
• Metasploit ID: 78736
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
  http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html
  http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-updates/2012-02/msg00026.html
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
  http://www.palemoon.org/releasenotes-ng.shtml
  http://www.ubuntu.com/usn/usn-1350-1/
  http://www.ubuntu.com/usn/usn-1353-1/
  http://www.ubuntu.com/usn/usn-1355-1/
  http://www.ubuntu.com/usn/usn-1355-2/
  http://www.ubuntu.com/usn/usn-1355-3/
  http://www.ubuntu.com/usn/usn-1369-1/
  https://bugzilla.mozilla.org/show_bug.cgi?id=708198 [ Auth Req'd ]
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2012:013
  http://www.zerodayinitiative.com/advisories/ZDI-12-110/
• Vendor URL: http://www.mozilla.org/
• Vendor Specific Advisory URL: http://www.mozilla.org/security/announce/2012/mfsa2012-04.html
  https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_thunderbird6
• RedHat RHSA: RHSA-2012:0079 RHSA-2012:0080

• regenrecht