CVE-2013-1694

La implementación PreserveWrapper en Mozilla Firefox antes de v22.0, Firefox ESR 17.x antes de v17.0.7, Thunderbird antes de v17.0.7, y Thunderbird ESR v17.x antes de v17.0.7 no maneja correctamente la pérdida del envoltorio, lo que permite a atacantes remotos causar una denegación del servicio (caída de la aplicación) o posiblemente ejecutar código arbitrario aprovechando la limpieza de la caché del envoltorio.

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Security researcher Abhishek Arya of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free problems rated critical as security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting additional use-after-free and buffer overflow flaws in code introduced during Firefox development. These were fixed before general release. Various other security issues were also addressed. The mozilla firefox packages have been upgraded to the latest ESR version which is unaffected by these security flaws.