Security

» Added by:  SecurityReason Team

» Date:  20.11.2009

  Our team is pleased to present a new security notes of products such as
KDE, Opera, SeaMonkey and K-Meleon. Identified vulnerability, originally
was discovered in May this year in the standard C library.

The problem concerns the implementation gdtoa defective. Currently, our
team is at the phase of determining all possible vendors.

Array index error allows remote attackers to execute arbitrary code via a long string that triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
Until now, the security official notes were
released by Chrome, Mozilla and Opera Teams.

Chrome Note:
http://googlechromereleases.blogspot.com/2009/09/stable-channel-update_30.html

Mozilla Note:
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html

Opera Note:
http://www.opera.com/support/kb/view/942/

SecurityReason Research advisories :
http://securityreason.com/achievement_securityalert/71
http://securityreason.com/achievement_securityalert/72
http://securityreason.com/achievement_securityalert/73
http://securityreason.com/achievement_securityalert/74