Security researcher Abhishek Arya of Google used the Address Sanitizer tool to uncover several issues: two heap buffer overflow bugs and a use-after-free problem. The first heap buffer overflow was found in conversion from unicode to native character sets when the function fails. The use-after-free occurs in nsFrameList when working with column layout with absolute positioning in a container that changes size. The second buffer overflow occurs in nsHTMLReflowState when a window is resized on a page with nested columns and a combination of absolute and relative positioning. All three of these issues are potentially exploitable. Reference: http://www.mozilla.org/security/announce/2012/mfsa2012-40.html
Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges security researcher Abhishek Arya of Google as the original reporter.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2012:0710 https://rhn.redhat.com/errata/RHSA-2012-0710.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2012:0715 https://rhn.redhat.com/errata/RHSA-2012-0715.html