Skip to Content.
Sympa Menu

sm-security - [SM-Security] Vulnerability in css found in seamonkey (MFSA 2008-34)

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: George Sherwood <pilot AT beernabeer.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] Vulnerability in css found in seamonkey (MFSA 2008-34)
  • Date: Wed, 24 Sep 2008 09:14:09 -0500

Synopsis
========
A critical security vulnerability has been found in seamonkey 1.1.11
and below. This vulnerability may allow remote code execution.

Background
==========
Seamonkey is the all-in-one internet application suite of the Mozilla project.

Description
===========
An anonymous researcher, via TippingPoint's Zero Day Initiative program,
reported a vulnerability in Mozilla's internal CSSValue array data structure.
The vulnerability was caused by an insufficiently sized variable being used
as a reference counter for CSS objects. By creating a very large number of
references to a common CSS object, this counter could be overflowed which
could cause a crash when the browser attempts to free the CSS object while
still in use. An attacker could use this crash to run arbitrary code on the
victim's computer.[0]

Affected packages
=================
These vulnerabilities were reported for seamonkey 1.1.11. Seamonkey in all
grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All seamonkey users should upgrade to the latest available version:
# scribe update
# cast -c seamonkey

If you maintain your own installation of seamonkey ouside of sorcery, there
are patches available from upstream.

References
==========
[0] http://www.mozilla.org/security/announce/2008/mfsa2008-34.html

Attachment: signature.asc
Description: PGP signature



  • [SM-Security] Vulnerability in css found in seamonkey (MFSA 2008-34), George Sherwood, 09/24/2008

Archive powered by MHonArc 2.6.24.

Top of Page