Potentially exploitable crash in the YARR regular expression library

Potentially exploitable crash in the YARR regular expression library

Announced

September 27, 2011

Reporter

Aki Helin

Impact

Critical

Products

Firefox, SeaMonkey, Thunderbird

Fixed in

• Firefox 7
• SeaMonkey 2.4
• Thunderbird 7

Description

Security researcher Aki Helin reported a potentially exploitable crash in the YARR regular expression library used by JavaScript.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=653672
• https://bugs.webkit.org/show_bug.cgi?id=61585
• CVE-2011-3232