(This is not an official Mozilla advisory. My goal here is to bring awareness about these issues to the users of Mozilla-based products, and to provide some links to more detailed technical information about the security bugs I found.) Overview -------- Firefox Preview Release, Thunderbird 0.8, and Mozilla 1.7.3 are available for download at www.mozilla.org since Sept 13 and 14. These releases fix 7 critical security issues, detailed on the "Known Vulnerabilities in Mozilla" page: http://www.mozilla.org/projects/security/known-vulnerabilities.html Three of these issues are rated at maximum level "Severity: Critical" and "Risk: High": * Non-ascii hostname heap overrun (reported by Mats Palmgren, Gaël Delalleau) A link with a non-ascii hostname can cause a heap buffer overrun that could potentially be exploited to run arbitrary code. * BMP integer overflow (reported by Gaël Delalleau) Extremely wide BMP images trigger an integer overflow, leading to heap overruns that are potentially exploitable to run arbitrary code. * Buffer overflow when displaying VCard (reported by Georgi Guninski) A stack buffer overrun in VCard display routines could be exploited to run arbitrary code supplied by the attacker. Technical information about the security bugs I reported -------------------------------------------------------- These are some links to my original source code audit reports. I audited parts of the Mozilla 1.7.2 C++ source code tree during my free time, in an attempt to promote and participate to the Mozilla Security Bug Bounty Program. * Arbitrary code execution while parsing a malformed .BMP image http://www.zencomsec.com/advisories/mozilla-1.7.2-BMP.txt * Out of bounds writes in the POP3 protocol handler allows for arbitrary code execution http://www.zencomsec.com/advisories/mozilla-1.7.2-POP3.txt * Non-ascii hostname heap overrun http://www.zencomsec.com/advisories/mozilla-1.7.2-UTF8link.txt Other products at risk? ----------------------- Although not 100% verified, it is very likely some of these critical security bugs are also exploitable in other products based on Mozilla, like Netscape 7 and Galeon. Users of such products should ask vendors for a patch, and meanwhile apply the workarounds described on the "Known Vulnerabilities in Mozilla" page. Gaël Delalleau Zencom Secure Solutions 71 avenue d'Italie 75013 PARIS - FRANCE