Mozilla Foundation Security Advisory 2009-35
Crash and remote code execution during Flash player unloading
- Announced
- July 21, 2009
- Reporter
- Attila Suszter
- Impact
- Critical
- Products
- Firefox
- Fixed in
-
- Firefox 3.0.12
- Firefox 3.5.1
Description
Security researcher Attila Suszter reported that when a page contains a Flash object which presents a slow script dialog, and the page is navigated while the dialog is still visible to the user, the Flash plugin is unloaded resulting in a crash due to a call to the deleted object. This crash could potentially be used by an attacker to run arbitrary code on a victim's computer.