| Descripción: | Description:
The remote host is missing updates announced in
advisory CLA-2004:877.
Mozilla[1] is an open-source web browser designed for standards
compliance, performance and portability.
This announcement updates mozilla packages for Conectiva Linux 9 and
10 to mozilla version 1.7.3. This updates fixes lots of
vulnerabilities, which the most recent and important is listed
bellow:
CVE-2004-0597: multiple buffer overflows in libpng
CVE-2004-0598: denial of service via a certain PNG image
CVE-2004-0599: multiple integer overflows in libpng
CVE-2004-0718: content in unrelated windows could be modified
CVE-2004-0722: integer overflow in the SOAPParameter object
constructor
CVE-2004-0757: heap-based buffer overflow in the SendUidl of POP3
code
CVE-2004-0758: denial-of-service with malicious SSL certificates
CVE-2004-0759: read files via JavaScript
CVE-2004-0760: MIME code handles %00 incorrectly
CVE-2004-0761: spoofing of security lock icon
CVE-2004-0763: spoofing of SSL certificates by using redirects and
JavaScript
CVE-2004-0764: hijacking the user interface via the chrome flag and
XML User Interface Language (XUL) files
CVE-2004-0765: spoofing SSL certificates due to incorrecting
comparsion of hostnames
CVE-2004-0902: Several heap based buffer overflows in Mozilla
Browsers.
CVE-2004-0903: Stack-based buffer overflow in the writeGroup function
in vcard handling.
CVE-2004-0904: Buffer overflow in BMP images decoding.
CVE-2004-0905: Crossdomain scripting and possible code execution by
javascript drag and drop.
CVE-2004-0906: XPI Installer sets insecure permissions, allowing
local users to overwrite files of the user.
CVE-2004-0908: Allow untrusted javascript code to read and write to
the clipboard.
CVE-2004-0909: Allow remote attackers to trick the user into
performing dangerous operations by modifying security relevant dialog
boxes.
For further information on the vulnerabilities, please, refer to
mozilla's security page, located at
http://www.mozilla.org/projects/security/known-vulnerabilities.html
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://www.mozilla.org/
http://www.securityspace.com/smysecure/catid.html?in=CLA-2004:877
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002004
Risk factor : Critical
CVSS Score:
10.0
|
