Mozilla Firefox Layout Engine Remote Code Execution
Publish Date: 21 Juli 2015
Schweregrad:: Kritisch
CVE Kennungen:: CVE-2008-4063
Hinweisdatum: 21 Juli 2015
Beschreibung
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and (1) a zero value of the "this" variable in the nsContentList::Item function; (2) interaction of the indic IME extension, a Hindi language selection, and the "g" character; and (3) interaction of the nsFrameList::SortByContentOrder function with a certain insufficient protection of inline frames.
nvd: NOTE: Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.
Trend Micro Lösungen
Apply associated Trend Micro DPI Rules.
Lösungen
Trend Micro Deep Security DPI Rule Number: 1002892
Trend Micro Deep Security DPI Rule Name: 1002892 - Mozilla Firefox Layout Engine Remote Code Execution
Betroffene Software und Version:
- Mozilla Firefox 3.0
- Mozilla Firefox 3.0.1