|
Firefox Bug Could Be Serious
|
Posted by dan on: 2006-04-26 05:00:10 Article Viewed : 100
|
A zero-day vulnerability in a fully-patched and most-current version of Mozilla Corp.'s Firefox could be exploited to crash the browser at the least, and at the worst, possibly introduce malicious code, a security company warned Tuesday.
The bug, which first appeared on Mozilla's Bugzilla listing a week ago on April 18, could be used by an attacker to crash Firefox by feeding it malformed JavaScript code.
Proof of concept code has been made public that crashes Firefox 1.5.0.2, the open-source browser's newest edition.
Although Danish vulnerability tracker Secunia ranked the threat as "low," its weakest warning, U.S.-based security vendor Symantec said the danger may be more dire.
"It does appear that triggering the vulnerability using the proof of concept results in the execution of data somewhere in anonymous memory, possibly in a portion of the heap," Symantec told customers of its DeepSight threat alert system Tuesday. "If this memory were somehow populated by an attacker with a malicious payload, this condition could likely be exploited to execute arbitrary code."
News Source InformationWeek
|
|
