Overview
Multiple Mozilla products allow running JavaScript to be recompiled while executing. This vulnerability may allow a remote attacker to execute arbitrary JavaScript bytecode.
Description
According to Mozilla Foundation Security Advisory 2006-67: ...it was possible to modify a Script object while it was executing, potentially leading to the execution of arbitrary JavaScript bytecode. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary JavaScript bytecode. |
Solution
Apply an update |
Disable JavaScript
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=355655
- http://www.mozilla.org/security/announce/2006/mfsa2006-67.html
- http://secunia.com/advisories/22929/
- http://secunia.com/advisories/22980/
- http://secunia.com/advisories/23013/
- http://secunia.com/advisories/22763/
- http://secunia.com/advisories/23009/
- http://secunia.com/advisories/22815/
- http://secunia.com/advisories/22727/
Acknowledgements
This vulnerability was reported in Mozilla Foundation Security Advisory 2006-67. Mozilla credits shutdown for providing information concerning this issue.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2006-5463 |
| Severity Metric: | 14.04 |
| Date Public: | 2006-11-08 |
| Date First Published: | 2006-11-08 |
| Date Last Updated: | 2006-12-21 18:50 UTC |
| Document Revision: | 25 |