Mozilla Foundation Security Advisory 2011-33

• https://bugzilla.mozilla.org/show_bug.cgi?id=672789
• CVE-2011-2992

Mozilla developers and community members Robert Kaiser, Jesse Ruderman, moz_bug_r_a4, Mardeg, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary and Jonathan Watt reported memory safety issues which affected SeaMonkey 2.2.

• Memory safety bugs - SeaMonkey 2.3
• CVE-2011-2985

Unsigned scripts can call script inside signed JAR

Impact: Critical
Description: Rafael Gieschke reported that unsigned JavaScript could call into script inside a signed JAR thereby inheriting the identity of the site that signed the JAR as well as any permissions that a user had granted the signed JAR.

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=657267
• CVE-2011-2993

String crash using WebGL shaders

Impact: Critical
Description: Michael Jordon of Context IS reported that an overly long shader program could cause a buffer overrun and crash in a string class used to store the shader source code.

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=665936
• CVE-2011-2988

Heap overflow in ANGLE library

Impact: Critical
Description: Michael Jordon of Context IS reported a potentially exploitable heap overflow in the ANGLE library used by Mozilla's WebGL implementation.

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=665934
• CVE-2011-2987

Crash in SVGTextElement.getCharNumAtPosition()

Impact: Critical
Description: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability.

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=648094
• CVE-2011-0084

Credential leakage using Content Security Policy reports

Impact: High
Description: Mike Cardwell reported that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. Daniel Veditz reported that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy.

References:

• CSP reports leak proxy auth tokens
• Incorrect CSP host resolution
• CVE-2011-2990

Cross-origin data theft using canvas and Windows D2D

Impact: High
Description: nasalislarvatus3000 reported that when using Windows D2D hardware acceleration, image data from one domain could be inserted into a canvas and read by a different domain.

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=655836
• CVE-2011-2986