Multiple security vulnerabilities in the Layout Engine in Mozilla 1.7 may allow a remote user who is able to create pages that are viewed with the Mozilla browser to crash the application or execute arbitrary code with the privileges of the user running Mozilla. The ability of a remote user to cause the Mozilla application to crash is a type of Denial of Service (DoS).

These issues are described in the following documents:

http://www.mozilla.org/security/announce/2006/mfsa2006-68.html

CVE-2006-6497 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497

CERT VU# 606260 at http://www.kb.cert.org/vuls/id/606260

These issues can occur in the following releases:

SPARC Platform

• Mozilla 1.7 (for Solaris 8 and 9) without patch 120671-05
• Mozilla 1.7 (for Solaris 10) without patch 119115-26

x86 Platform

• Mozilla 1.7 (for Solaris 8 and 9) without patch 120672-05
• Mozilla 1.7 (for Solaris 10) without patch 119116-26

Note: Mozilla 1.4 may be vulnerable to one or more of these security issues. Customers are advised to upgrade to Mozilla 1.7 to obtain these security fixes.

To determine the version of Mozilla on a Solaris system, the following command can be run:

    % /usr/sfw/bin/mozilla -version
    Mozilla 1.7, (Sun Java Desktop System), build 2005031721

There are no predictable symptoms that would indicate the described issues have been exploited.

There is no workaround for this issue. Please see the Resolution section below.

These issues are addressed in the following releases:

SPARC Platform

• Mozilla 1.7 (for Solaris 8 and 9) with patch 120671-05 or later
• Mozilla 1.7 (for Solaris 10) with patch 119115-26 or later

x86 Platform

• Mozilla 1.7 (for Solaris 8 and 9) with patch 120672-05 or later
• Mozilla 1.7 (for Solaris 10) with patch 119116-26 or later

• Updated Contributing Factors and Resolution sections
• State: Resolved

This solution has no attachment