Crash with malformed embedded XSLT stylesheets

Related Vulnerabilities: CVE-2012-0449  

Mozilla Foundation Security Advisory 2012-08

Crash with malformed embedded XSLT stylesheets

Announced
January 31, 2012
Reporter
Nicolas Grégoire, Aki Helin
Impact
Critical
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 10
  • Firefox 3.6.26
  • SeaMonkey 2.7
  • Thunderbird 10
  • Thunderbird 3.1.18

Description

Security researchers Nicolas Grégoire and Aki Helin independently reported that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to a memory corruption. While there is no evidence that this is directly exploitable, there is a possibility of remote code execution.

References