ID de Prueba:	1.3.6.1.4.1.25623.1.0.70311
Categoría:	Mandrake Local Security Checks
Título:	Mandriva Security Advisory MDVSA-2011:139 (firefox)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to firefox announced via advisory MDVSA-2011:139. Security issues were identified and fixed in mozilla firefox and thunderbird: Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site (CVE-2011-2372). Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2995). Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2996). Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression (CVE-2011-2998). Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle location as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170 (CVE-2011-2999). Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values (CVE-2011-3000). Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error (CVE-2011-3001). Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression (CVE-2011-3867). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 Additionally, some packages which require so, have been rebuilt and are being provided as updates. Affected: 2009.0, 2010.1, Enterprise Server 5.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:139 http://www.mozilla.org/security/announce/2011/mfsa2011-36.html http://www.mozilla.org/security/announce/2011/mfsa2011-37.html http://www.mozilla.org/security/announce/2011/mfsa2011-38.html http://www.mozilla.org/security/announce/2011/mfsa2011-39.html http://www.mozilla.org/security/announce/2011/mfsa2011-40.html Risk factor : High
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-2372 Debian Security Information: DSA-2312 (Google Search) http://www.debian.org/security/2011/dsa-2312 Debian Security Information: DSA-2313 (Google Search) http://www.debian.org/security/2011/dsa-2313 Debian Security Information: DSA-2317 (Google Search) http://www.debian.org/security/2011/dsa-2317 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mandriva.com/security/advisories?name=MDVSA-2011:142 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13854 http://www.redhat.com/support/errata/RHSA-2011-1341.html http://secunia.com/advisories/46315 SuSE Security Announcement: SUSE-SU-2011:1256 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html SuSE Security Announcement: openSUSE-SU-2011:1076 (Google Search) http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html Common Vulnerability Exposure (CVE) ID: CVE-2011-2995 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13957 Common Vulnerability Exposure (CVE) ID: CVE-2011-2996 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14064 Common Vulnerability Exposure (CVE) ID: CVE-2011-2998 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14012 Common Vulnerability Exposure (CVE) ID: CVE-2010-0170 BugTraq ID: 38918 http://www.securityfocus.com/bid/38918 BugTraq ID: 38919 http://www.securityfocus.com/bid/38919 http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8602 http://www.vupen.com/english/advisories/2010/0692 Common Vulnerability Exposure (CVE) ID: CVE-2011-2999 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14252 Common Vulnerability Exposure (CVE) ID: CVE-2011-3000 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14361 Common Vulnerability Exposure (CVE) ID: CVE-2011-3001 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14442 Common Vulnerability Exposure (CVE) ID: CVE-2011-3867
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.