Crash in nsTextFrame::ClearTextRun()

Related Vulnerabilities: CVE-2009-1313  

Mozilla Foundation Security Advisory 2009-23

Crash in nsTextFrame::ClearTextRun()

Announced
April 27, 2009
Reporter
Marc Gueury, Daniel Veditz
Impact
Critical
Products
Firefox
Fixed in
  • Firefox 3.0.10

Description

One of the security fixes in Firefox 3.0.9 introduced a regression that caused some users to experience frequent crashes. Users of the HTML Validator add-on were particularly affected, but other users also experienced this crash in some situations. In analyzing this crash we discovered that it was due to memory corruption similar to cases that have been identified as security vulnerabilities in the past.

References