The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[ GLSA 200703-04 ] Mozilla Firefox: Multiple vulnerabilities


<< Previous INDEX Search src / Print Next >>
Date: Sat, 3 Mar 2007 00:13:15 +0100
From: Raphael Marichez <falco@gentoo.org.>
To: [email protected]
Subject: [ GLSA 200703-04 ] Mozilla Firefox: Multiple vulnerabilities
Message-ID: <20070302231315.GA16853@falco.falcal.net.>
Mail-Followup-To: [email protected],
        [email protected], [email protected],
        [email protected]
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
        protocol="application/pgp-signature"; boundary="GvXjxJ+pjyke8COw"
Content-Disposition: inline
X-GPG-fingerprint: 04EB 153A 6B28 3E80 87A9  9B4F A77C 4BDE 021C 5BD2
X-GPG-Key: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x021C5BD2
X-GPG-Subkey: http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x0114FC45
Organization: Gentoo Linux Security Team
User-Agent: mutt-ng/devel-r804 (Linux)
X-Virus-Scanned: antivirus-gw at tyumen.ru


--GvXjxJ+pjyke8COw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200703-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


  Severity: Normal
     Title: Mozilla Firefox: Multiple vulnerabilities
      Date: March 02, 2007
      Bugs: #165555
        ID: 200703-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Synopsis
========

Multiple vulnerabilities have been reported in Mozilla Firefox, some of
which may allow user-assisted arbitrary remote code execution.

Background
==========

Mozilla Firefox is a popular open-source web browser from the Mozilla
Project.

Affected packages
=================

    -------------------------------------------------------------------
     Package                         /  Vulnerable  /       Unaffected
    -------------------------------------------------------------------
  1  www-client/mozilla-firefox          < 2.0.0.2        *>= 1.5.0.10
                                                            >= 2.0.0.2
  2  www-client/mozilla-firefox-bin      < 2.0.0.2        *>= 1.5.0.10
                                                            >= 2.0.0.2
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------


Description
===========

Tom Ferris reported a heap-based buffer overflow involving wide SVG
stroke widths that affects Mozilla Firefox 2 only. Various researchers
reported some errors in the JavaScript engine potentially leading to
memory corruption. Mozilla Firefox also contains minor vulnerabilities
involving cache collision and unsafe pop-up restrictions, filtering or
CSS rendering under certain conditions.

Impact
======

An attacker could entice a user to view a specially crafted web page
that will trigger one of the vulnerabilities, possibly leading to the
execution of arbitrary code. It is also possible for an attacker to
spoof the address bar, steal information through cache collision,
bypass the local files protection mechanism with pop-ups, or perform
cross-site scripting attacks, leading to the exposure of sensitive
information, like user credentials.

Workaround
==========

There is no known workaround at this time for all of these issues, but
most of them can be avoided by disabling JavaScript.

Resolution
==========

Users upgrading to the following releases of Mozilla Firefox should
note that this upgrade has been found to lose the saved passwords file
in some cases. The saved passwords are encrypted and stored in the
'signons.txt' file of ~/.mozilla/ and we advise our users to save that
file before performing the upgrade.

All Mozilla Firefox 1.5 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-1.5.0.10"


All Mozilla Firefox 1.5 binary users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-bin-1.5.0.10"


All Mozilla Firefox 2.0 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-2.0.0.2"


All Mozilla Firefox 2.0 binary users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-bin-2.0.0.2"


References
==========

  [ 1 ] CVE-2006-6077
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6077
  [ 2 ] CVE-2007-0775
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0775
  [ 3 ] CVE-2007-0776
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0776
  [ 4 ] CVE-2007-0777
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0777
  [ 5 ] CVE-2007-0778
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0778
  [ 6 ] CVE-2007-0779
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0779
  [ 7 ] CVE-2007-0780
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0780
  [ 8 ] CVE-2007-0800
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0800
  [ 9 ] CVE-2007-0801
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0801
  [ 10 ] CVE-2007-0981
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0981
  [ 11 ] CVE-2007-0995
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0995
  [ 12 ] Mozilla password loss bug
         https://bugzilla.mozilla.org/show_bug.cgi?id=360493#c366

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200703-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

--GvXjxJ+pjyke8COw
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBReivizvRww8BFPxFAQIoWgf/QYYL536pDiT+pv5Dluzt8BX8V8JnGDsv
5ArDXZ5I6CV7uBPWmYFiAf+T6gsu2LKob58uXycfthXoDsngFeRTGcHFZqCKypvd
4sYCW5Cu0T0CNjOqK4rCrFr6OtVV4XXuC32PZILi0t5FCXuofxZ1qejifNwe3cmX
x3wmetGx2+NOzEzB12H17ALbina/bpNybHBjRkTlBu4w9Vhpl9l5bXKcUN76PClx
oWsVxzV+5tzu5uHoRxmr7VdgluhbT+2+TQJz1C/FKiCpNSIVwrVqQyKp5Dbimx8u
78tYrgGN5NeLy1SKqadz/EzpY1X2iD4Z2OsauJetAFHtfHl5QOj19A==
=48Ke
-----END PGP SIGNATURE-----

--GvXjxJ+pjyke8COw--


<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру