Overview
Mozilla products fail to properly handle certain JavaScript regular expressions. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.
Description
According to Mozilla Foundation Security Advisory 2006-57: ...a regular expression that ends with a backslash inside an unterminated character set (e.g. "[\\") will cause the regular epression engine to read beyond the end of the buffer, possibly leading to a crash. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition. |
Solution
Upgrade |
Disable JavaScript
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This issue was reported in Mozilla Foundation Security Advisory 2006-57. Mozilla credits Priit Laes, CanadianGuy, Girts Folkmanis, and Catalin Patulea for reporting this issue.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | None |
| Severity Metric: | 27.00 |
| Date Public: | 2006-09-15 |
| Date First Published: | 2006-09-20 |
| Date Last Updated: | 2006-10-02 13:53 UTC |
| Document Revision: | 26 |