Overview
A vulnerability exists in the Mozilla LiveConnect that may allow a remote attacker to cause a denial of service.
Description
Mozilla LiveConnect, which allows communication between Java applets and web JavaScript, contains a vulnerability in the way freed objects are re-used that may result in a denial of service. According to the Mozilla Foundation Security Advisory 2006-71: The crash is due to re-use of an already-freed object and we presume this could be exploited with enough effort. |
Impact
A remote, unathenticated attacker may be able to cause a denial of service. |
Solution
Apply an update According to the Mozilla Foundation Security Advisory 2006-71, this vulnerability is addressed in Firefox 2.0.0.1, Firefox 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7. |
Disable Java
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://www.mozilla.org/security/announce/2006/mfsa2006-71.html
- http://secunia.com/advisories/23591/
- http://secunia.com/advisories/23598/
- http://secunia.com/advisories/23439/
- http://secunia.com/advisories/23514/
- http://secunia.com/advisories/23545/
- http://secunia.com/advisories/23601/
- http://secunia.com/advisories/23614/
- http://secunia.com/advisories/23618/
- http://secunia.com/advisories/23692/
- http://www.securityfocus.com/bid/21668
- http://secunia.com/advisories/23988/
- http://www.auscert.org.au/7372
- http://secunia.com/advisories/24390/
Acknowledgements
This vulnerability was reported in Mozilla Foundation Security Advisory 2006-71. Mozilla credits Steven Michaud with providing information about this issue.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2006-6502 |
| Severity Metric: | 3.65 |
| Date Public: | 2006-12-19 |
| Date First Published: | 2007-01-18 |
| Date Last Updated: | 2007-04-05 18:44 UTC |
| Document Revision: | 25 |