Bug 88039

Summary:	<=mozilla-firefox-1.0.2-r1 memory exposure weakness in javascript implementation (JS "lambda" flaw)
Product:	Gentoo Linux	Reporter:	vltg0903
Component:	Current packages	Assignee:	Mozilla Gentoo Team <mozilla>
Status:	RESOLVED FIXED
Severity:	normal	CC:	christian.hartmann
Priority:	High
Version:	unspecified
Hardware:	x86
OS:	Linux
URL:	http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	jsstr.c.patch mozilla-firefox-1.0.2-r2.ebuild mozilla-firefox-1.0.2-r4.diff

Description vltg0903 2005-04-05 07:58:32 UTC

Calling a specially crafted javascript function can expose parts of firefox's allocated memory to an external host. Secunia provides an online demo (follow URL above), mozilla suite is also vulnerable.
The problem is already fixed in the development branches, a patch is available here: https://bugzilla.mozilla.org/show_bug.cgi?id=288688
I recompiled mozilla-firefox-1.0.2-r1 with "fix, v4" (see mozilla bug report), Secunia's demo no longer works. Please consider to upgrade the ebuild.

Reproducible: Always
Steps to Reproduce:
1. Go to secunia's demo site: http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/
2. Click the demo button.

Comment 1 vltg0903 2005-04-05 13:26:52 UTC

Just read about firefox-1.0.3 coming up, it will address this issue:
http://mozillazine.org/talkback.html?article=6336

Comment 2 kevin 2005-04-07 09:57:16 UTC

Created attachment 55569 [details]
jsstr.c.patch

Just added the full path to the diff output of the original patch.

Comment 3 kevin 2005-04-07 09:58:31 UTC

Created attachment 55570 [details]
mozilla-firefox-1.0.2-r2.ebuild

Ebuild which expects the patch file in the files dir. Pretty easy to fix, but
worth a GLSA, isn't it?

Comment 4 Qui Gon 2005-04-16 03:31:31 UTC

Created attachment 56434 [details]
mozilla-firefox-1.0.2-r4.diff

Since I currently maintain the state of mozilla-firefox' ebuild I made a diff
to include the js-fix, so we have the most current state. Revision is bumped to
r4.
The filesdir-name of the fix should be mozilla-firefox-1.0.2-jsstr.c.patch
The diff is against the mozilla-ebuild from
http://bugs.gentoo.org/show_bug.cgi?id=86070

Comment 5 Benjamin 2005-04-16 12:29:36 UTC

Hi,
Mozilla released version 1.0.3 of Firefox which solved the security vulnerable. Hope we found the ebuild asap in portage. The current version 1.0.3 source can be downloaded at http://www.mozilla.org/download-mozilla.html


Thanks,
Benjamin

Comment 6 Jakub Moc (RETIRED) gentoo-dev

2005-12-22 20:15:26 UTC

Obsolete bug, 1.0.7 is the oldest version in portage now.