Mozilla Announces Two Critical Vulnerabilities

The following critical vulnerabilities have been posted by the Mozilla Foundation. If you use the affected software, please update to the latest version, as indicated in the provided workaround.

• MFSA 2007-10 Potential integer overflow with text/enhanced mail

Impact: Critical
Fix released: March 1, 2007
Reporter: Georgi Guninski
Products: Thunderbird, SeaMonkey

Fixed in: Thunderbird 1.5.0.10
SeaMonkey 1.0.8

Description

Georgi Guninski discovered a potential integer overflow in the code that handles mail formatted as text/enhanced or text/richtext. This could in turn lead to a buffer overflow and potential code execution.

To exploit this flaw a malicious mail message would have to include a line more than 400 megabytes long. Many mail systems have storage quotas and transport filters that would prevent a message of that size from reaching its destination, but should the message get through its size would provide more than sufficient space for a payload.

Workaround

Do not open mail messages that are megabytes in size unless the sender is someone you know and from whom you were expecting that specific mail. Delete the message without opening it by shutting the view pane (F8, or from the "View | Layout" menu) before selecting the message in the thread pane and then deleting.

Upgrade to a version containing the fix.

• MFSA 2007-09 Privilege escalation by setting img.src to javascript: URI

Title: Privilege escalation by setting img.src to javascript: URI
Impact: Critical
Announced: March 5, 2007
Reporter: moz_bug_r_a4
Products: Firefox 1.5.0.9/2.0.0.1, SeaMonkey 1.0.7

Fixed in: Firefox 2.0.0.2
Firefox 1.5.0.10
SeaMonkey 1.1.1
SeaMonkey 1.0.8

Description

moz_bug_r_a4 reports that the fix for MFSA 2006-72 in Firefox 1.5.0.9 and Firefox 2.0.0.1 introduced a regression that allows scripts from web content to execute arbitrary code by setting the src attribute of an IMG tag to a specially crafted javascript: URI.

The same regression also caused javascript: URIs in IMG tags to be executed even if JavaScript execution was disabled in the global preferences. This facet was noted by moz_bug_r_a4 and reported independently by Anbo Motohiko.

Thunderbird is not affected by this flaw as it will not execute javascript: URIs in IMG tags.

Workaround

Upgrade to a version containing the fix. Disabling JavaScript does not protect against this flaw.