Mozilla Firefox XSLT 漏洞

-- Affected Products:
Mozilla Firefox 3.6.x

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Mozilla Firefox. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or otherwise render a malicious file.

The specific flaw exists within a particular XSLT transformation when
applied to an XML document. If a large number of elements have this
transformation applied to them, the application will misallocate a
buffer. Upon usage of this buffer the application will copy more data
than allocated thus causing an overflow. This can lead to code execution
under the context of the application.

-- Vendor Response:
Mozilla Firefox has issued an update to correct this vulnerability. More
details can be found at:

http://www.mozilla.org/security/announce/2010/mfsa2010-30.html

-- Disclosure Timeline:
2010-03-22 - Vulnerability reported to vendor
2010-06-23 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by:
* Martin Barbella

-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.