Ubuntu 10.10, USN-1401-1 Moderate: Xulrunner Memory Safety Exploits

Several security issues were fixed in Firefox.

Software Description:

- xulrunner-1.9.2: Mozilla Gecko runtime environment

Details:

It was discovered that a flaw in the Mozilla SVG implementation could

result in an out-of-bounds memory access if SVG elements were removed

during a DOMAttrModified event handler. If the user were tricked into

opening a specially crafted page, an attacker could exploit this to cause a

denial of service via application crash. (CVE-2011-3658)

Atte Kettunen discovered a use-after-free vulnerability in the Gecko

Rendering Engine's handling of SVG animations. An attacker could

potentially exploit this to execute arbitrary code with the privileges of

the user invoking the Xulrunner based application. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in the Gecko

Rendering Engine's handling of SVG Filters. An attacker could potentially

exploit this to make data from the user's memory accessible to the page

...