Security researcher J23 reported via TippingPoint's Zero Day Initiative an error in the code used to store the names and values of plugin parameter elements. A malicious page could embed plugin content containing a very large number of parameter elements which would cause an overflow in the integer value counting them. This integer is later used in allocating a memory buffer used to store the plugin parameters. Under such conditions, too small a buffer would be created and attacker-controlled data could be written past the end of the buffer, potentially resulting in code execution.
This is now public:http://www.mozilla.org/security/announce/2010/mfsa2010-37.html
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Via RHSA-2010:0546 https://rhn.redhat.com/errata/RHSA-2010-0546.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2010:0547 https://rhn.redhat.com/errata/RHSA-2010-0547.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0545 https://rhn.redhat.com/errata/RHSA-2010-0545.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2010:0544 https://rhn.redhat.com/errata/RHSA-2010-0544.html
seamonkey-2.0.6-1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
xulrunner-1.9.2.7-1.fc13, firefox-3.6.7-1.fc13, mozvoikko-1.0-12.fc13, gnome-web-photo-0.9-10.fc13, perl-Gtk2-MozEmbed-0.08-6.fc13.15, gnome-python2-extras-2.25.3-20.fc13, galeon-2.0.7-30.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
seamonkey-2.0.6-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
xulrunner-1.9.1.11-1.fc12, firefox-3.5.11-1.fc12, gnome-web-photo-0.9-8.fc12, mozvoikko-1.0-11.fc12, perl-Gtk2-MozEmbed-0.08-6.fc12.14, gnome-python2-extras-2.25.3-19.fc12, galeon-2.0.7-24.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.