Secunia

Some weaknesses and vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to disclose potentially sensitive information, potentially conduct cross-site scripting attacks, bypass certain security restrictions, conduct spoofing attacks, and compromise a user's system.

1) Multiple errors in the browser engine can be exploited to corrupt memory and potentially execute arbitrary code.

2) A use-after-free error within the DOM attribute cloning routine can be exploited to execute arbitrary code.

3) A use-after-free error within the NodeIterator implementation can be exploited to execute arbitrary code.

4) An error within the handling of parameters when embedding plugin content can be exploited to execute arbitrary code.

5) An error when accessing a content object via SJOW from the chrome scope can be exploited to execute arbitrary JavaScript code with chrome privileges.

6) An error when handling certain CSS array values (e.g. when handling external font resources) can be exploited to execute arbitrary code.

7) An integer overflow when calculating ranges for nsTreeSelection can be exploited to trigger the use of an invalid pointer and execute arbitrary code.

8) An error when handling certain PNG images can be exploited to execute arbitrary code.

For more information:
SA40302

9) An error within the Web Worker method importScripts can be exploited to bypass the same-origin policy and disclose potentially sensitive information.

10) An error within the canvas element after rendering cross-origin data can be exploited to bypass the same-origin policy and disclose potentially sensitive information.

11) A weakness exists when handling undefined positions within various 8 bit character encodings, which can lead to characters disappearing from the text run. This can potentially be leveraged to conduct cross-site scripting attacks.

12) A weakness exists when handling certain redirect sequences and responses in combination with JavaScript and SSL/TLS, which can be exploited to spoof the location bar to indicate a secure page, although the current document was served via plaintext.

13) A weakness when handling certain CSS selectors can be exploited to disclose potentially sensitive information by injecting CSS selectors into a target page and accessing the region between the selectors via e.g. the JavaScript "getComputedStyle()" API.

14) A vulnerability is caused due to the "window.onerror" handler being allowed to read the destination URL of a redirection. This can be exploited to e.g. disclose session-specific query parameters contained in a target URL by referencing a redirecting site via an HTML "<script>" tag.

Solution
Update to Firefox 3.5.11 or 3.6.7.

Provided and/or discovered by
2, 3, 7) regenrecht via ZDI.
4, 6) J23 via ZDI.
10) Reported by the vendor.

The vendor credits:
1) Jesse Ruderman, Ehsan Akhgari, Mats Palmgren, Igor Bukanov, Gary Kwong, Tobias Markus and Daniel Holbert, Jesse Ruderman, David Anderson, and Johnny Stenback
5) moz_bug_r_a4
8) Aki Helin, OUSPG
9) Yosuke Hasegawa
11) O. Andersen
12) Jordi Chancel
13) Chris Evans, Google
14) Soroush Dalili

Changelog
Further details available in Customer Area

Original Advisory
Mozilla:
http://www.mozilla.org/security/announce/2010/mfsa2010-34.html
http://www.mozilla.org/security/announce/2010/mfsa2010-35.html
http://www.mozilla.org/security/announce/2010/mfsa2010-36.html
http://www.mozilla.org/security/announce/2010/mfsa2010-37.html
http://www.mozilla.org/security/announce/2010/mfsa2010-38.html
http://www.mozilla.org/security/announce/2010/mfsa2010-39.html
http://www.mozilla.org/security/announce/2010/mfsa2010-40.html
http://www.mozilla.org/security/announce/2010/mfsa2010-41.html
http://www.mozilla.org/security/announce/2010/mfsa2010-42.html
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
http://www.mozilla.org/security/announce/2010/mfsa2010-44.html
http://www.mozilla.org/security/announce/2010/mfsa2010-45.html
http://www.mozilla.org/security/announce/2010/mfsa2010-46.html
http://www.mozilla.org/security/announce/2010/mfsa2010-47.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-130/
http://www.zerodayinitiative.com/advisories/ZDI-10-132/
http://www.zerodayinitiative.com/advisories/ZDI-10-134/
http://www.zerodayinitiative.com/advisories/ZDI-10-133/
http://www.zerodayinitiative.com/advisories/ZDI-10-131/

Soroush Dalili:
http://soroush.secproject.com/blog/2010/05/cross-site-url-hijacking-by-using-error-object-in-mozilla-firefox/

Chris Evans:
http://code.google.com/p/chromium/issues/detail?id=9877

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area