Mozilla Firefox document.write and DOM insertion memory corruptionAdded: 11/04/2010
BackgroundFirefox is a freely available web browser for multiple platforms including Windows, Linux, and Mac OS.
ProblemA memory corruption vulnerability allows command execution when a user loads a specially crafted web page containing DOM insertions interspersed with calls to the document.write function.
ResolutionUpgrade to Firefox 3.5.15 or 3.6.12 or higher.
LimitationsExploit works on Firefox 3.6.11 and requires the user to load the exploit page in Firefox.
It may take some time to establish the shell session.
The exploit works best when the target platform has more than 1G memory.
Back to exploit index