You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2009-13
Mozilla Foundation Security Advisory 2009-13
Title: Arbitrary code execution via XUL tree element
Impact: Critical
Announced: March 27, 2009
Reporter: Nils
Products: Firefox
Fixed in: Firefox 3.0.8
Description
Security researcher Nils reported via
TippingPoint's Zero Day Initiative that the XUL tree
method _moveToEdgeShift
was in some cases triggering
garbage collection routines on objects which were still in use. In
such cases, the browser would crash when attempting to access a
previously destroyed object and this crash could be used by an
attacker to run arbitrary code on a victim's computer.
This vulnerability was used by the reporter to win the 2009 CanSecWest Pwn2Own contest.
This vulnerability does not affect Firefox 2, Thunderbird 2, or released versions of SeaMonkey.