Rapid7 Vulnerability & Exploit Database

Mozilla Firefox Multiple Vulnerabilities Fixed in 3.0.7

Back to Search

Mozilla Firefox Multiple Vulnerabilities Fixed in 3.0.7

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
03/04/2009
Created
07/25/2018
Added
03/29/2009
Modified
02/13/2015

Description

Mozilla Firefox before 3.0.7 is affected by multiple vulnerabilities:

  • Crashes with evidence of memory corruption (MFSA 2009-07). Some of these crashes show evidence of memory corruption under certain circumstances and with enough effort at least some of these could be exploited to run arbitrary code.
  • XUL Linked Clones Double Free Vulnerability (MFSA 2009-08). The vulnerability is caused by improper memory management of a set of cloned XUL DOM elements which are linked as a parent and child. After reloading the browser on a page with such linked elements, the browser would crash when attempting to access an object which was already destroyed. An attacker could use this crash to run arbitrary code on the victim's computer.
  • XML data theft via RDFXMLDataSource and cross-domain redirect (MFSA 2009-09). A website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy. This vulnerability could be used by a malicious website to steal private data from users authenticated to the redirected website.
  • Upgrade PNG library to fix memory safety hazards (MFSA 2009-10). Vulnerabilities were discovered in the libpng project, an external library used by Mozilla to render PNG images. These vulnerabilities could be used by a malicious website to crash a victim's browser and potentially execute arbitrary code on their computer.
  • URL spoofing with invisible control characters (MFSA 2009-11). Certain invisible control characters are decoded when displayed in the location bar, resulting in fewer visible characters than were present in the actual location. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.

Solution(s)

  • mozilla-firefox-upgrade-3_0_7

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;