Test ID:	1.3.6.1.4.1.25623.1.0.55459
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2005:169 (mozilla-firefox)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to mozilla-firefox announced via advisory MDKSA-2005:169. A number of vulnerabilities have been discovered in Mozilla Firefox that have been corrected in version 1.0.7: A bug in the way Firefox processes XBM images could be used to execute arbitrary code via a specially crafted XBM image file (CVE-2005-2701). A bug in the way Firefox handles certain Unicode sequences could be used to execute arbitrary code via viewing a specially crafted Unicode sequence (CVE-2005-2702). A bug in the way Firefox makes XMLHttp requests could be abused by a malicious web page to exploit other proxy or server flaws from the victim's machine however, the default behaviour of the browser is to disallow this (CVE-2005-2703). A bug in the way Firefox implemented its XBL interface could be abused by a malicious web page to create an XBL binding in such a way as to allow arbitrary JavaScript execution with chrome permissions (CVE-2005-2704). An integer overflow in Firefox's JavaScript engine could be manipulated in certain conditions to allow a malicious web page to execute arbitrary code (CVE-2005-2705). A bug in the way Firefox displays about: pages could be used to execute JavaScript with chrome privileges (CVE-2005-2706). A bug in the way Firefox opens new windows could be used by a malicious web page to construct a new window without any user interface elements (such as address bar and status bar) that could be used to potentially mislead the user (CVE-2005-2707). A bug in the way Firefox proceesed URLs on the command line could be used to execute arbitary commands as the user running Firefox this could be abused by clicking on a supplied link, such as from an instant messaging client (CVE-2005-2968). The updated packages have been patched to address these issues and all users are urged to upgrade immediately. Affected versions: 10.2 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2005:169 http://www.mozilla.org/security/announce/mfsa2005-58.html Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2005-2701 1014954 http://securitytracker.com/id?1014954 14916 http://www.securityfocus.com/bid/14916 15495 http://www.securityfocus.com/bid/15495 16911 http://secunia.com/advisories/16911 16917 http://secunia.com/advisories/16917 16977 http://secunia.com/advisories/16977 17014 http://secunia.com/advisories/17014 17026 http://secunia.com/advisories/17026 17149 http://secunia.com/advisories/17149 17263 http://secunia.com/advisories/17263 17284 http://secunia.com/advisories/17284 19643 http://www.osvdb.org/19643 ADV-2005-1824 http://www.vupen.com/english/advisories/2005/1824 DSA-838 http://www.debian.org/security/2005/dsa-838 DSA-866 http://www.debian.org/security/2005/dsa-866 DSA-868 http://www.debian.org/security/2005/dsa-868 FLSA-2006:168375 http://www.redhat.com/archives/fedora-legacy-announce/2006-January/msg00004.html MDKSA-2005:169 http://www.mandriva.com/security/advisories?name=MDKSA-2005:169 MDKSA-2005:170 http://www.mandriva.com/security/advisories?name=MDKSA-2005:170 MDKSA-2005:174 http://www.mandriva.com/security/advisories?name=MDKSA-2005:174 RHSA-2005:785 http://www.redhat.com/support/errata/RHSA-2005-785.html RHSA-2005:789 http://www.redhat.com/support/errata/RHSA-2005-789.html SCOSA-2005.49 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt SUSE-SA:2005:058 http://www.novell.com/linux/security/advisories/2005_58_mozilla.html USN-200-1 http://www.ubuntu.com/usn/usn-200-1 http://www.mozilla.org/security/announce/mfsa2005-58.html mozilla-xbm-bo(22373) https://exchange.xforce.ibmcloud.com/vulnerabilities/22373 oval:org.mitre.oval:def:1480 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1480 oval:org.mitre.oval:def:9323 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9323 Common Vulnerability Exposure (CVE) ID: CVE-2005-2702 14918 http://www.securityfocus.com/bid/14918 17042 http://secunia.com/advisories/17042 17090 http://secunia.com/advisories/17090 RHSA-2005:791 http://www.redhat.com/support/errata/RHSA-2005-791.html mozilla-zerowidthnonjoiner-stack-corruption(22375) https://exchange.xforce.ibmcloud.com/vulnerabilities/22375 oval:org.mitre.oval:def:1150 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1150 oval:org.mitre.oval:def:11609 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11609 Common Vulnerability Exposure (CVE) ID: CVE-2005-2703 14923 http://www.securityfocus.com/bid/14923 mozilla-xmlhttprequest-spoofing(22376) https://exchange.xforce.ibmcloud.com/vulnerabilities/22376 oval:org.mitre.oval:def:10767 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10767 oval:org.mitre.oval:def:1089 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1089 Common Vulnerability Exposure (CVE) ID: CVE-2005-2704 14921 http://www.securityfocus.com/bid/14921 mozilla-thunderbird-xml-object-spoof(22824) https://exchange.xforce.ibmcloud.com/vulnerabilities/22824 oval:org.mitre.oval:def:1272 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1272 oval:org.mitre.oval:def:9784 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9784 Common Vulnerability Exposure (CVE) ID: CVE-2005-2705 14917 http://www.securityfocus.com/bid/14917 https://bugzilla.mozilla.org/show_bug.cgi?id=303213 mozilla-javascript-bo(22377) https://exchange.xforce.ibmcloud.com/vulnerabilities/22377 oval:org.mitre.oval:def:10367 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10367 oval:org.mitre.oval:def:1307 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1307 Common Vulnerability Exposure (CVE) ID: CVE-2005-2706 14920 http://www.securityfocus.com/bid/14920 19648 http://www.osvdb.org/19648 19823 http://secunia.com/advisories/19823 SUSE-SA:2006:022 http://www.novell.com/linux/security/advisories/2006_04_25.html mozilla-about-execute-code(22378) https://exchange.xforce.ibmcloud.com/vulnerabilities/22378 oval:org.mitre.oval:def:11317 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11317 oval:org.mitre.oval:def:1443 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1443 Common Vulnerability Exposure (CVE) ID: CVE-2005-2707 14919 http://www.securityfocus.com/bid/14919 http://www.mozilla.org/security/announce/mfsa2005-59.html mozilla-chrome-window-spoofing(22380) https://exchange.xforce.ibmcloud.com/vulnerabilities/22380 oval:org.mitre.oval:def:11130 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11130 oval:org.mitre.oval:def:1197 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1197 Common Vulnerability Exposure (CVE) ID: CVE-2005-2968 14888 http://www.securityfocus.com/bid/14888 16869 http://secunia.com/advisories/16869 ADV-2005-1794 http://www.vupen.com/english/advisories/2005/1794 USN-186-1 http://www.ubuntu.com/usn/usn-186-1 USN-186-2 http://www.ubuntu.com/usn/usn-186-2 VU#914681 http://www.kb.cert.org/vuls/id/914681 https://bugzilla.mozilla.org/show_bug.cgi?id=307185 oval:org.mitre.oval:def:11105 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11105
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.