387881 - (CVE-2007-5338) Arbitrary code execution by polluting implicit XPCNativeWrapper (using Script object)

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

Does script_compile need the same fix as bug 369211?

This is 1.8/1.8.0 branches only, since Script object has been removed on trunk.

Comment 3

[moz_bug_r_a4]

Due to the fix in bug 388121, privilege escalation testcases that use location
setter and javascript: url no longer work without change.  I'll attach new
testcases that load a chrome: url before loading a javascript: url to
circumvent the fix.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Yeah, this just mimics what we do for eval.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 275053 [details] [diff] [review]
Fix

approved for 1.8.1.7 and 1.8.0.14, a=dveditz for release-drivers

Comment 8

[Daniel Veditz [:dveditz]]

Is this approved patch going to land?

Comment 9

[Daniel Veditz [:dveditz]]

Blake: what's the status of this patch? Can I land it for you?

Comment 10

[Daniel Veditz [:dveditz]]

Checked this in on the 1.8 branch for mrbkap.

Comment 11

[juan becerra [:juanb]]

Verified using testcases in comment #4 and comment #5 on: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.8) Gecko/2007100816 Firefox/2.0.0.8

Components.Stack dialog no longer appears.

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 275053 [details] [diff] [review]
Fix

Minusing for Thunderbird-focused 1.8.0.14 release, moving request to future release

Comment 13

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 275053 [details] [diff] [review]
Fix

a=caillon for 1.8.0.15

Comment 14

[Christopher Aillon (sabbatical, not receiving bugmail)]

fix committed to 1.8.0 branch

Checking in js/src/jsscript.c;
/cvsroot/mozilla/js/src/jsscript.c,v  <--  jsscript.c
new revision: 3.79.2.5.2.8; previous revision: 3.79.2.5.2.7
done