Test ID:	1.3.6.1.4.1.25623.1.0.58468
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1336-1)
Summary:	The remote host is missing an update for the Debian 'mozilla-firefox' package(s) announced via the DSA-1336-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'mozilla-firefox' package(s) announced via the DSA-1336-1 advisory. Vulnerability Insight: Several remote vulnerabilities have been discovered in Mozilla Firefox. This will be the last security update of Mozilla-based products for the oldstable (sarge) distribution of Debian. We recommend to upgrade to stable (etch) as soon as possible. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2007-1282 It was discovered that an integer overflow in text/enhanced message parsing allows the execution of arbitrary code. CVE-2007-0994 It was discovered that a regression in the Javascript engine allows the execution of Javascript with elevated privileges. CVE-2007-0995 It was discovered that incorrect parsing of invalid HTML characters allows the bypass of content filters. CVE-2007-0996 It was discovered that insecure child frame handling allows cross-site scripting. CVE-2007-0981 It was discovered that Firefox handles URI with a null byte in the hostname insecurely. CVE-2007-0008 It was discovered that a buffer overflow in the NSS code allows the execution of arbitrary code. CVE-2007-0009 It was discovered that a buffer overflow in the NSS code allows the execution of arbitrary code. CVE-2007-0775 It was discovered that multiple programming errors in the layout engine allow the execution of arbitrary code. CVE-2007-0778 It was discovered that the page cache calculates hashes in an insecure manner. CVE-2006-6077 It was discovered that the password manager allows the disclosure of passwords. For the oldstable distribution (sarge) these problems have been fixed in version 1.0.4-2sarge17. You should upgrade to etch as soon as possible. The stable distribution (etch) isn't affected. These vulnerabilities have been fixed prior to the release of Debian etch. The unstable distribution (sid) no longer contains mozilla-firefox. Iceweasel is already fixed. Affected Software/OS: 'mozilla-firefox' package(s) on Debian 3.1. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-6077 BugTraq ID: 21240 http://www.securityfocus.com/bid/21240 BugTraq ID: 22694 http://www.securityfocus.com/bid/22694 Bugtraq: 20061122 Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (Google Search) http://www.securityfocus.com/archive/1/452382/100/0/threaded Bugtraq: 20061123 Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (Google Search) http://www.securityfocus.com/archive/1/452431/100/0/threaded Bugtraq: 20061123 Re: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (Google Search) http://www.securityfocus.com/archive/1/452440/100/0/threaded Bugtraq: 20061123 Re: Password Flaw also in Firefox 1.5.08. Was: Big Flaw in Firefox 2: Password Manager Bug Exposes Passwords (Google Search) http://www.securityfocus.com/archive/1/452463/100/0/threaded Bugtraq: 20061220 critical Flaw in Firefox 2.0.0.1 allows to steal the user passwords with a videoclip (Google Search) http://www.securityfocus.com/archive/1/454982/100/0/threaded Bugtraq: 20061221 Re: critical Flaw in Firefox 2.0.0.1 allows to steal the user passwords with a videoclip (Google Search) http://www.securityfocus.com/archive/1/455073/100/0/threaded Bugtraq: 20061222 Re[2]: critical Flaw in Firefox 2.0.0.1 allows to steal the user passwords with a videoclip (Google Search) http://www.securityfocus.com/archive/1/455148/100/0/threaded Bugtraq: 20070226 rPSA-2007-0040-1 firefox (Google Search) http://www.securityfocus.com/archive/1/461336/100/0/threaded Bugtraq: 20070303 rPSA-2007-0040-3 firefox thunderbird (Google Search) http://www.securityfocus.com/archive/1/461809/100/0/threaded Debian Security Information: DSA-1336 (Google Search) http://www.debian.org/security/2007/dsa-1336 http://fedoranews.org/cms/node/2713 http://fedoranews.org/cms/node/2728 http://security.gentoo.org/glsa/glsa-200703-04.xml http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml HPdes Security Advisory: HPSBUX02153 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 HPdes Security Advisory: SSRT061181 http://www.mandriva.com/security/advisories?name=MDKSA-2007:050 http://www.info-svc.com/news/11-21-2006/ http://www.info-svc.com/news/11-21-2006/rcsr1/ https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10031 RedHat Security Advisories: RHSA-2007:0077 http://rhn.redhat.com/errata/RHSA-2007-0077.html http://www.redhat.com/support/errata/RHSA-2007-0078.html http://www.redhat.com/support/errata/RHSA-2007-0079.html http://www.redhat.com/support/errata/RHSA-2007-0097.html http://www.redhat.com/support/errata/RHSA-2007-0108.html http://securitytracker.com/id?1017271 http://secunia.com/advisories/23046 http://secunia.com/advisories/23108 http://secunia.com/advisories/24205 http://secunia.com/advisories/24238 http://secunia.com/advisories/24287 http://secunia.com/advisories/24290 http://secunia.com/advisories/24293 http://secunia.com/advisories/24320 http://secunia.com/advisories/24328 http://secunia.com/advisories/24333 http://secunia.com/advisories/24342 http://secunia.com/advisories/24343 http://secunia.com/advisories/24384 http://secunia.com/advisories/24393 http://secunia.com/advisories/24395 http://secunia.com/advisories/24437 http://secunia.com/advisories/24457 http://secunia.com/advisories/24650 http://secunia.com/advisories/25588 SGI Security Advisory: 20070202-01-P ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc SGI Security Advisory: 20070301-01-P ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131 SuSE Security Announcement: SUSE-SA:2007:019 (Google Search) http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html SuSE Security Announcement: SUSE-SA:2007:022 (Google Search) http://www.novell.com/linux/security/advisories/2007_22_mozilla.html http://www.ubuntu.com/usn/usn-428-1 http://www.vupen.com/english/advisories/2006/4662 http://www.vupen.com/english/advisories/2007/0718 XForce ISS Database: firefox-passwordmgr-information-disclosure(30470) https://exchange.xforce.ibmcloud.com/vulnerabilities/30470 Common Vulnerability Exposure (CVE) ID: CVE-2007-0008 1017696 http://www.securitytracker.com/id?1017696 102856 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1 102945 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1 20070202-01-P 20070223 Mozilla Network Security Services SSLv2 Client Integer Underflow Vulnerability http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482 20070226 rPSA-2007-0040-1 firefox 20070301-01-P 20070303 rPSA-2007-0040-3 firefox thunderbird 22694 24205 24238 24252 http://secunia.com/advisories/24252 24253 http://secunia.com/advisories/24253 24277 http://secunia.com/advisories/24277 24287 24290 24293 24320 24328 24333 24342 24343 24384 24389 http://secunia.com/advisories/24389 24395 24406 http://secunia.com/advisories/24406 24410 http://secunia.com/advisories/24410 24455 http://secunia.com/advisories/24455 24456 http://secunia.com/advisories/24456 24457 24522 http://secunia.com/advisories/24522 24562 http://secunia.com/advisories/24562 24650 24703 http://secunia.com/advisories/24703 25588 25597 http://secunia.com/advisories/25597 32105 http://www.osvdb.org/32105 64758 http://www.securityfocus.com/bid/64758 ADV-2007-0718 ADV-2007-0719 http://www.vupen.com/english/advisories/2007/0719 ADV-2007-1165 http://www.vupen.com/english/advisories/2007/1165 ADV-2007-2141 http://www.vupen.com/english/advisories/2007/2141 DSA-1336 FEDORA-2007-278 http://fedoranews.org/cms/node/2709 FEDORA-2007-279 http://fedoranews.org/cms/node/2711 FEDORA-2007-281 FEDORA-2007-293 FEDORA-2007-308 http://fedoranews.org/cms/node/2747 FEDORA-2007-309 http://fedoranews.org/cms/node/2749 GLSA-200703-18 http://security.gentoo.org/glsa/glsa-200703-18.xml GLSA-200703-22 http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml HPSBUX02153 MDKSA-2007:050 MDKSA-2007:052 http://www.mandriva.com/security/advisories?name=MDKSA-2007:052 RHSA-2007:0077 RHSA-2007:0078 RHSA-2007:0079 RHSA-2007:0097 RHSA-2007:0108 SSA:2007-066-03 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851 SSA:2007-066-04 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947 SSA:2007-066-05 SSRT061181 SUSE-SA:2007:019 SUSE-SA:2007:022 USN-428-1 USN-431-1 http://www.ubuntu.com/usn/usn-431-1 VU#377812 http://www.kb.cert.org/vuls/id/377812 http://www.mozilla.org/security/announce/2007/mfsa2007-06.html http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html https://bugzilla.mozilla.org/show_bug.cgi?id=364319 https://issues.rpath.com/browse/RPL-1081 https://issues.rpath.com/browse/RPL-1103 nss-mastersecret-bo(32666) https://exchange.xforce.ibmcloud.com/vulnerabilities/32666 oval:org.mitre.oval:def:10502 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10502 Common Vulnerability Exposure (CVE) ID: CVE-2007-0009 20070223 Mozilla Network Security Services SSLv2 Server Stack Overflow Vulnerability http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483 32106 http://www.osvdb.org/32106 VU#592796 http://www.kb.cert.org/vuls/id/592796 https://bugzilla.mozilla.org/show_bug.cgi?id=364323 nss-clientmasterkey-bo(32663) https://exchange.xforce.ibmcloud.com/vulnerabilities/32663 oval:org.mitre.oval:def:10174 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10174 Common Vulnerability Exposure (CVE) ID: CVE-2007-0045 BugTraq ID: 21858 http://www.securityfocus.com/bid/21858 Bugtraq: 20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/455801/100/0/threaded Bugtraq: 20070103 RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Google Search) http://www.securityfocus.com/archive/1/455836/100/0/threaded Bugtraq: 20070103 Re: Universal XSS with PDF files: highly dangerous (Google Search) http://www.securityfocus.com/archive/1/455800/100/0/threaded Bugtraq: 20070103 Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous (Google Search) http://www.securityfocus.com/archive/1/455831/100/0/threaded Bugtraq: 20070103 Universal XSS with PDF files: highly dangerous (Google Search) http://www.securityfocus.com/archive/1/455790/100/0/threaded Bugtraq: 20070104 Universal PDF XSS After Party (Google Search) http://www.securityfocus.com/archive/1/455906/100/0/threaded Cert/CC Advisory: TA09-286B http://www.us-cert.gov/cas/techalerts/TA09-286B.html CERT/CC vulnerability note: VU#815960 http://www.kb.cert.org/vuls/id/815960 http://security.gentoo.org/glsa/glsa-200701-16.xml http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf http://www.disenchant.ch/blog/hacking-with-browser-plugins/34 http://www.gnucitizen.org/blog/universal-pdf-xss-after-party http://www.wisec.it/vulns.php?page=9 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693 RedHat Security Advisories: RHSA-2007:0017 https://rhn.redhat.com/errata/RHSA-2007-0017.html http://www.redhat.com/support/errata/RHSA-2007-0021.html http://securitytracker.com/id?1017469 http://securitytracker.com/id?1023007 http://secunia.com/advisories/23483 http://secunia.com/advisories/23691 http://secunia.com/advisories/23812 http://secunia.com/advisories/23877 http://secunia.com/advisories/23882 http://secunia.com/advisories/24533 http://secunia.com/advisories/33754 http://securityreason.com/securityalert/2090 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1 SuSE Security Announcement: SUSE-SA:2007:011 (Google Search) http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html http://www.vupen.com/english/advisories/2007/0032 http://www.vupen.com/english/advisories/2007/0957 http://www.vupen.com/english/advisories/2009/2898 XForce ISS Database: adobe-acrobat-pdf-xss(31271) https://exchange.xforce.ibmcloud.com/vulnerabilities/31271 Common Vulnerability Exposure (CVE) ID: CVE-2007-0775 1017698 http://www.securitytracker.com/id?1017698 24393 24437 32114 http://www.osvdb.org/32114 ADV-2008-0083 http://www.vupen.com/english/advisories/2008/0083 GLSA-200703-04 GLSA-200703-08 VU#761756 http://www.kb.cert.org/vuls/id/761756 http://www.mozilla.org/security/announce/2007/mfsa2007-01.html mozilla-multiple-layout-code-execution(32704) https://exchange.xforce.ibmcloud.com/vulnerabilities/32704 oval:org.mitre.oval:def:10012 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10012 Common Vulnerability Exposure (CVE) ID: CVE-2007-0778 1017699 http://securitytracker.com/id?1017699 32110 http://www.osvdb.org/32110 http://www.mozilla.org/security/announce/2007/mfsa2007-03.html https://bugzilla.mozilla.org/show_bug.cgi?id=347852 mozilla-diskcache-information-disclosure(32671) https://exchange.xforce.ibmcloud.com/vulnerabilities/32671 oval:org.mitre.oval:def:9151 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9151 Common Vulnerability Exposure (CVE) ID: CVE-2007-0981 BugTraq ID: 22566 http://www.securityfocus.com/bid/22566 Bugtraq: 20070214 Firefox: serious cookie stealing / same-domain bypass vulnerability (Google Search) http://www.securityfocus.com/archive/1/460126/100/200/threaded Bugtraq: 20070215 Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability (Google Search) http://www.securityfocus.com/archive/1/460217/100/0/threaded CERT/CC vulnerability note: VU#885753 http://www.kb.cert.org/vuls/id/885753 http://lcamtuf.dione.cc/ffhostname.html http://www.osvdb.org/32104 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9730 http://securitytracker.com/id?1017654 http://secunia.com/advisories/24175 http://securityreason.com/securityalert/2262 http://www.vupen.com/english/advisories/2007/0624 XForce ISS Database: firefox-locationhostname-security-bypass(32533) https://exchange.xforce.ibmcloud.com/vulnerabilities/32533 Common Vulnerability Exposure (CVE) ID: CVE-2007-0994 1017726 http://securitytracker.com/id?1017726 22826 http://www.securityfocus.com/bid/22826 ADV-2007-0823 http://www.vupen.com/english/advisories/2007/0823 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733 http://www.mozilla.org/security/announce/2007/mfsa2007-09.html oval:org.mitre.oval:def:9749 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9749 Common Vulnerability Exposure (CVE) ID: CVE-2007-0995 1017702 http://www.securitytracker.com/id?1017702 32111 http://www.osvdb.org/32111 32112 http://osvdb.org/32112 http://ha.ckers.org/xss.html#XSS_Non_alpha_non_digit2 http://www.mozilla.org/security/announce/2007/mfsa2007-02.html oval:org.mitre.oval:def:10164 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10164 Common Vulnerability Exposure (CVE) ID: CVE-2007-0996 20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability http://www.securityfocus.com/archive/1/461076/100/0/threaded 33812 http://osvdb.org/33812 http://www.hardened-php.net/advisory_032007.142.html oval:org.mitre.oval:def:10086 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10086 Common Vulnerability Exposure (CVE) ID: CVE-2007-1282 22845 http://www.securityfocus.com/bid/22845 33810 http://osvdb.org/33810 ADV-2007-0824 http://www.vupen.com/english/advisories/2007/0824 http://www.mozilla.org/security/announce/2007/mfsa2007-10.html https://bugzilla.mozilla.org/show_bug.cgi?id=362735 mozilla-email-messages-overflow(32810) https://exchange.xforce.ibmcloud.com/vulnerabilities/32810 oval:org.mitre.oval:def:11313 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11313
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.