Mozilla Foundation Security Advisory 2013-48
Memory corruption found using Address Sanitizer
- Announced
- May 14, 2013
- Reporter
- Abhishek Arya
- Impact
- Critical
- Products
- Firefox, Firefox ESR, Thunderbird, Thunderbird ESR
- Fixed in
-
- Firefox 21
- Firefox ESR 17.0.6
- Thunderbird 17.0.6
- Thunderbird ESR 17.0.6
Description
Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to discover a series of
use-after-free, out of bounds read, and invalid write problems rated as moderate
to critical as security issues in shipped software. Some of these issues are
potentially exploitable, allowing for remote code execution. We would also like
to thank Abhishek for reporting additional use-after-free flaws in
dir=auto code introduced during Firefox development. These were
fixed before general release.
References
- Out of Bounds Read in SelectionIterator::GetNextSegment (CVE-2013-1676)
- Out-of-bound read in gfxSkipCharsIterator::SetOffsets (CVE-2013-1677)
- Invalid write in _cairo_xlib_surface_add_glyph (CVE-2013-1678)
- Heap-use-after-free in mozilla::plugins::child::_geturlnotify (CVE-2013-1679)
- Heap-use-after-free in nsFrameList::FirstChild (CVE-2013-1680)
- Heap-use-after-free in nsContentUtils::RemoveScriptBlocker (CVE-2013-1681)