Public Vulnerability Reports

Netscape/Mozilla Javascript Function.thaw() Vulnerabilities



The Netscape browser is a derivative of the Mozilla browser, an open
source webbrowser. More information is available from


Improper input to the Javascript Function.thaw() method in Netscape and
Mozilla allows execution of arbitrary code.

The Function object's thaw() method contains an integer overflow which
allows exploitable heap corruption.

Additionally a user suppliable array index is not checked for validity,
which allows a pointer to be stored at an arbitrary index. A webpage can
be constructed to leverage this into execution of arbitrary code.

This issue was resolved by removal of the thaw() and freeze() methods
from the Function object in Mozilla 1.5, however there has not been a
new release of Netscape since the fix was made.


Successful exploitation allows the remote attacker to execute abitrary
code in the context of the user running the browser.


DEFENSE has confirmed this vulnerability in Netscape 6.2.3, 7.0 and 7.1.
All versions from Netscape 6.0 upwards are vulnerable.

All versions of Mozilla prior to version 1.5 are also vulnerable.



Disabling Javascript will prevent exploitation of this vulnerability.
This may, however, reduce functionality of some sites.


Mozilla users should upgrade to the latest version.

A fix for Netscape is not available.


The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0508 to this issue. This is a candidate for inclusion in
the CVE list (, which standardizes names for
security problems.


10/13/2003    Exploit acquired by iDEFENSE
10/19/2003    Initial vendor notification
12/22/2003    iDEFENSE Clients notified
12/29/2003    Public Disclosure


zen-parse is credited with this discovery.

Get paid for vulnerability research


Copyright © 2004 Verisign, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.