February 7, 2006 -- US-CERT is aware of publicly available exploit code for a memory corruption vulnerability in the Mozilla Firefox web browser and Thunderbird mail client. If JavaScript is enabled in these applications, then the system is vulnerable to exploitation.

A vulnerable system may be successfully exploited if a user is convinced to visit a specially crafted web page or open a specially crafted email. A remote, unauthenticated attacker may be able to execute arbitrary code on a compromised system. If the user has elevated privileges, then the attacker will be able to exploit them.

* VU#759273 - Mozilla QueryInterface memory corruption vulnerability

US-CERT urges users and administrators to implement the following recommendations:

* Update to Firefox 1.5.0.1 or SeaMonkey 1.0.
* Disable JavaScript in Thunderbird and Mozilla Suite.

Source: US-CERT

Source: Wired News