firefox

[Jakub Bogusz]

Dla odmiany dostarczanie starszej wersji firefoksa wiąże się z tym:

----- Forwarded message from Gaël Delalleau <gael.delalleau+moz w m4x.org> -----

[...]
Overview
--------

Firefox Preview Release, Thunderbird 0.8, and Mozilla 1.7.3 are
available for download at www.mozilla.org since Sept 13 and 14. These
releases fix 7 critical security issues, detailed on the "Known
Vulnerabilities in Mozilla" page:
http://www.mozilla.org/projects/security/known-vulnerabilities.html

Three of these issues are rated at maximum level "Severity: Critical"
and "Risk: High":

* Non-ascii hostname heap overrun (reported by Mats Palmgren, Gaël
  Delalleau)
   A link with a non-ascii hostname can cause a heap buffer overrun that
   could potentially be exploited to run arbitrary code.

* BMP integer overflow (reported by Gaël Delalleau)
   Extremely wide BMP images trigger an integer overflow, leading to
   heap overruns that are potentially exploitable to run arbitrary code.

* Buffer overflow when displaying VCard (reported by Georgi Guninski)
   A stack buffer overrun in VCard display routines could be exploited
   to run arbitrary code supplied by the attacker.


Technical information about the security bugs I reported
--------------------------------------------------------

These are some links to my original source code audit reports. I audited
parts of the Mozilla 1.7.2 C++ source code tree during my free time, in
an attempt to promote and participate to the Mozilla Security Bug Bounty
Program.

* Arbitrary code execution while parsing a malformed .BMP image
http://www.zencomsec.com/advisories/mozilla-1.7.2-BMP.txt

* Out of bounds writes in the POP3 protocol handler allows for arbitrary
code execution
http://www.zencomsec.com/advisories/mozilla-1.7.2-POP3.txt

* Non-ascii hostname heap overrun
http://www.zencomsec.com/advisories/mozilla-1.7.2-UTF8link.txt

[...]

----- End forwarded message -----

-- 
Jakub Bogusz    http://cyber.cs.net.pl/~qboosh/