Multiple vulnerabilities have been reported in Mozilla Firefox and Thunderbird, which can be exploited by malicious people to bypass certain security restrictions and compromise a user's system.

For more information:
SA44972

1) Some unspecified errors can be exploited to corrupt memory. No further information is currently available.

This vulnerability affects Firefox 3.6.x only.

2) A use-after-free error in the "nsSVGPathSegList::ReplaceItem()" method when parsing SVG path segment object lists can be exploited to access an invalid list after a user supplied callback defined in DOMAttrModified EventListener deletes an object.

3) An error in the "nsSVGPointList::AppendElement()" method when parsing SVG polygon objects can be exploited to access a dangling pointer after a user defined getter method modifies the parent object.

4) A use-after-free error in nsXULCommandDispatcher.cpp when processing the NS_XUL_COMMAND_UPDATE event can be exploited to remove the currently used command updater within the "mUpdaters" chain.

Successful exploitation of vulnerabilities #1 - #4 may allow execution of arbitrary code.

5) An error when handling cookies for two domains where one contains a trailing dot character can be exploited to bypass the same-origin policy and disclose a cookie to a third party.

The vulnerabilities are reported in the following products:
* Firefox versions prior to 3.6.18.
* Thunderbird versions prior to 3.1.11.

Solution
Update to Firefox version 3.6.18 and Thunderbird version 3.1.11.

Provided and/or discovered by
2 - 4) regenrecht via ZDI.

The vendor also credits the following people:
1) Luke Wagner and Gary Kwong.
5) David Chan, Mozilla Security Researcher.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Mozilla:
http://www.mozilla.org/security/announce/2011/mfsa2011-19.html
http://www.mozilla.org/security/announce/2011/mfsa2011-20.html
http://www.mozilla.org/security/announce/2011/mfsa2011-21.html
http://www.mozilla.org/security/announce/2011/mfsa2011-22.html
http://www.mozilla.org/security/announce/2011/mfsa2011-23.html
http://www.mozilla.org/security/announce/2011/mfsa2011-24.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-223/
http://www.zerodayinitiative.com/advisories/ZDI-11-224/
http://www.zerodayinitiative.com/advisories/ZDI-11-225/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers