Firefox before 1.0.5 Mozilla before 1.7.9 and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code by calling InstallVersion.compareTo with an object instead of a string.