| Beschreibung: | Description:
The remote host is missing an update to firefox
announced via advisory MDVSA-2012:145.
Security issues were identified and fixed in mozilla firefox:
Mozilla developers identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption under
certain circumstances, and we presume that with enough effort at least
some of these could be exploited to run arbitrary code (CVE-2012-1971).
Security researcher Abhishek Arya (Inferno) of Google Chrome Security
Team discovered a series of use-after-free issues using the Address
Sanitizer tool. Many of these issues are potentially exploitable,
allowing for remote code execution (CVE-2012-1972, CVE-2012-1973,
CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964).
Security researcher Mariusz Mlynski reported that it is possible to
shadow the location object using Object.defineProperty. This could
be used to confuse the current location to plugins, allowing for
possible cross-site scripting (XSS) attacks (CVE-2012-1956).
Security researcher Mariusz Mlynski reported that when a page opens a
new tab, a subsequent window can then be opened that can be navigated
to about:newtab, a chrome privileged page. Once about:newtab is loaded,
the special context can potentially be used to escalate privilege,
allowing for arbitrary code execution on the local system in a
maliciously crafted attack (CVE-2012-3965).
Security researcher Frederic Hoguin reported two related issues with
the decoding of bitmap (.BMP) format images embedded in icon (.ICO)
format files. When processing a negative height header value for
the bitmap image, a memory corruption can be induced, allowing an
attacker to write random memory and cause a crash. This crash may be
potentially exploitable (CVE-2012-3966).
Security researcher miaubiz used the Address Sanitizer tool to
discover two WebGL issues. The first issue is a use-after-free when
WebGL shaders are called after being destroyed. The second issue
exposes a problem with Mesa drivers on Linux, leading to a potentially
exploitable crash (CVE-2012-3968, CVE-2012-3967).
Security researcher Arthur Gerkis used the Address Sanitizer
tool to find two issues involving Scalable Vector Graphics (SVG)
files. The first issue is a buffer overflow in Gecko'
s SVG filter
code when the sum of two values is too large to be stored as a
signed 32-bit integer, causing the function to write past the end
of an array. The second issue is a use-after-free when an element
with a requiredFeatures attribute is moved between documents. In that
situation, the internal representation of the requiredFeatures value
could be freed prematurely. Both issues are potentially exploitable
(CVE-2012-3969, CVE-2012-3970).
Using the Address Sanitizer tool, Mozilla security researcher Christoph
Diehl discovered two memory corruption issues involving the Graphite
2 library used in Mozilla products. Both of these issues can cause
a potentially exploitable crash. These problems were fixed in the
Graphite 2 library, which has been updated for Mozilla products
(CVE-2012-3971).
Security research Nicolas Gregoire used the Address Sanitizer tool to
discover an out-of-bounds read in the format-number feature of XSLT,
which can cause inaccurate formatting of numbers and information
leakage. This is not directly exploitable (CVE-2012-3972).
Mozilla security researcher Mark Goodwin discovered an issue with the
Firefox developer tools'
debugger. If remote debugging is disabled,
but the experimental HTTPMonitor extension has been installed and
enabled, a remote user can connect to and use the remote debugging
service through the port used by HTTPMonitor. A remote-enabled flag
has been added to resolve this problem and close the port unless
debugging is explicitly enabled (CVE-2012-3973).
Security researcher Masato Kinugawa reported that if a crafted
executable is placed in the root partition on a Windows file system,
the Firefox and Thunderbird installer will launch this program after
a standard installation instead of Firefox or Thunderbird, running
this program with the user'
s privileges (CVE-2012-3974).
Security researcher vsemozhetbyt reported that when the DOMParser is
used to parse text/html data in a Firefox extension, linked resources
within this HTML data will be loaded. If the data being parsed in
the extension is untrusted, it could lead to information leakage and
can potentially be combined with other attacks to become exploitable
(CVE-2012-3975).
Security researcher Mark Poticha reported an issue where incorrect SSL
certificate information can be displayed on the addressbar, showing
the SSL data for a previous site while another has been loaded. This
is caused by two onLocationChange events being fired out of the
expected order, leading to the displayed certificate data to not be
updated. This can be used for phishing attacks by allowing the user
to input form or other data on a newer, attacking, site while the
credentials of an older site appear on the addressbar (CVE-2012-3976).
Mozilla security researcher moz_bug_r_a4 reported that certain
security checks in the location object can be bypassed if chrome code
is called content in a specific manner. This allowed for the loading
of restricted content. This can be combined with other issues to
become potentially exploitable (CVE-2012-3978).
Security researcher Colby Russell discovered that eval in the web
console can execute injected code with chrome privileges, leading to
the running of malicious code in a privileged context. This allows
for arbitrary code execution through a malicious web page if the web
console is invoked by the user (CVE-2012-3980).
The mozilla firefox packages has been upgraded to the latest versions
which is unaffected by these security flaws.
Additionally the sqlite3 packages has been upgraded to the 3.7.13
version as firefox 15.0 requires the 3.7.12.1+ version.
Affected: 2011.
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2012:145
http://www.mozilla.org/security/announce/2012/mfsa2012-57.html
http://www.mozilla.org/security/announce/2012/mfsa2012-58.html
http://www.mozilla.org/security/announce/2012/mfsa2012-59.html
http://www.mozilla.org/security/announce/2012/mfsa2012-60.html
http://www.mozilla.org/security/announce/2012/mfsa2012-61.html
http://www.mozilla.org/security/announce/2012/mfsa2012-62.html
http://www.mozilla.org/security/announce/2012/mfsa2012-63.html
http://www.mozilla.org/security/announce/2012/mfsa2012-64.html
http://www.mozilla.org/security/announce/2012/mfsa2012-65.html
http://www.mozilla.org/security/announce/2012/mfsa2012-66.html
http://www.mozilla.org/security/announce/2012/mfsa2012-67.html
http://www.mozilla.org/security/announce/2012/mfsa2012-68.html
http://www.mozilla.org/security/announce/2012/mfsa2012-69.html
http://www.mozilla.org/security/announce/2012/mfsa2012-70.html
http://www.mozilla.org/security/announce/2012/mfsa2012-72.html
Risk factor : High
|
