Description
String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | firefox | 1.0.1-1.4.3 | RHSA-2005:176 |
| RHEL 4 | thunderbird | 1.0.2-1.4.1 | RHSA-2005:337 |
Advisories 2
- RHSA-2005:337 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:176 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 12659 vdb-entry
- SUSE-SA:2005:016 vendor-advisory
- 19823 third-party-advisory
- oval:org.mitre.oval:def:9111 vdb-entry signature
- http://www.mozilla.org/security/announce/mfsa2005-18.html
- oval:org.mitre.oval:def:100040 vdb-entry signature
- 20050228 Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error third-party-advisory
- RHSA-2005:176 vendor-advisory
- GLSA-200503-30 vendor-advisory
- RHSA-2005:277 vendor-advisory
- GLSA-200503-10 vendor-advisory
- SUSE-SA:2006:022 vendor-advisory
- RHSA-2005:337 vendor-advisory