Overview
Mozilla products fail to properly release memory. This vulnerability may allow a remote attacker to execute arbitrary code on a vulnerable system.
Description
Mozilla products fail to properly release JavaScript references. This may corrupt memory in a way that can allow an attacker to execute arbitrary code. For complete list of affected products refer to Mozilla Foundation Security Advisory 2006-44. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. The attacker could also cause the vulnerable application to crash. |
Solution
Upgrade |
Until it is possible to upgrade to a fixed version of Firefox or SeaMonkey, the following workaround will prevent exploitation:
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported in Mozilla Foundation Security Advisory 2006-44. Mozilla credits Thilo Girmann with reporting this vulnerability.
This document was written by Jeff Gennari based on information from Mozilla.
Other Information
| CVE IDs: | CVE-2006-3677 |
| Severity Metric: | 58.14 |
| Date Public: | 2006-07-25 |
| Date First Published: | 2006-07-27 |
| Date Last Updated: | 2007-02-09 14:05 UTC |
| Document Revision: | 27 |