A security vulnerability related to untimely "garbage collection" in Mozilla 1.7 for Solaris 8, 9 and 10 may result in the deletion of a temporary object that was in active use. This may allow a remote unprivileged user to run arbitrary code with the privileges of the user running Mozilla or create a Denial of Service (DoS) condition.

This issue is described in the following documents:

http://www.mozilla.org/security/announce/mfsa2006-50.html

CVE-2006-3805 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3805

CERT VU# 876420 at http://www.kb.cert.org/vuls/id/876420

This issue can occur in the following releases:

SPARC Platform

• Mozilla 1.7 (for Solaris 8) without patch 120671-05
• Mozilla 1.7 (for Solaris 9) without patch 120671-05
• Mozilla 1.7 (for Solaris 10) without patch 119115-25

x86 Platform

• Mozilla 1.7 (for Solaris 8) without patch 120672-05
• Mozilla 1.7 (for Solaris 9) without patch 120672-05
• Mozilla 1.7 (for Solaris 10) without patch 119116-25

Note: Mozilla 1.4 may be vulnerable to this security issue. Customers are advised to upgrade to Mozilla 1.7 to obtain these security fixes.

To determine the version of Mozilla on a Solaris system, the following command can be run:

    % /usr/sfw/bin/mozilla -version
    Mozilla 1.7, (Sun Java Desktop System), build 2005031721

There are no predictable symptoms that would indicate the described issue has been exploited.

To work around the described issue, JavaScript can be disabled with the following steps:

1. Open the "Preferences" dialog from the Edit menu
2. Select the "Advanced" tree
3. Select the "Scripts & Plug-ins" leaf
4. Uncheck the "Navigator and Mail & Newsgroups" check boxes
5. Click the OK button

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 120671-05 or later
• Solaris 9 with patch 120671-05 or later
• Solaris 10 with patch 119115-25 or later

x86 Platform

• Solaris 8 with patch 120672-05 or later
• Solaris 9 with patch 120672-05 or later
• Solaris 10 with patch 119116-25 or later

• Updated Contributing Factors and Resolution sections
• State: Resolved

This solution has no attachment