Stack Overflow Vulnerability in Firefox document. write mode

Release date:
Updated on:

Affected Systems:
Mozilla Firefox 3.6.x
Mozilla Firefox 3.5.x
Mozilla Thunderbird 3.1.x
Mozilla Thunderbird 3.0.x
Mozilla SeaMonkey <2.0.9
Unaffected system:
Mozilla Firefox 3.6.11
Mozilla Firefox 3.5.14
Mozilla Thunderbird 3.1.5
Mozilla Thunderbird 3.0.9
Mozilla SeaMonkey 2.0.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 44247
Cve id: CVE-2010-3179

Firefox is a very popular open-source WEB browser.

Firefox does not properly filter long strings submitted to the document. write method. If a user is cheated to access a malicious webpage, the text rendering routine will be inconsistent, and the string data will overwrite part of the stack memory. Attackers who successfully exploit this vulnerability can cause the browser to crash or execute arbitrary code.

<* Source: Alexander Miller

Link: http://secunia.com/advisories/41244/
Http://www.mozilla.org/security/announce/2010/mfsa2010-65.html
Https://www.redhat.com/support/errata/RHSA-2010-0782.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Mozilla
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.mozilla.org/

RedHat
------
For this reason, RedHat has released a Security Bulletin (RHSA-2010: 0782-01) and patch:
The RHSA-2010: 0782-01: Critical: firefox security update
Link: https://www.redhat.com/support/errata/RHSA-2010-0782.html