| Description: | Summary:
The remote host is missing updates announced in
advisory SUSE-SA:2009:012.
Vulnerability Insight:
The Mozilla Firefox browser is updated to version 3.0.7 fixing various
security and stability issues.
Updates are provided for openSUSE 11.0 and 11.1 currently, backports
for other Mozilla Firefox browsers and Mozilla Suite programs will
follow.
MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 / CVE-2009-0773 /
CVE-2009-0774: Mozilla developers identified and fixed several
stability bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these crashes showed evidence of memory
corruption under certain circumstances and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.
MFSA 2009-08 / CVE-2009-0775: An anonymous researcher, via
TippingPoint's Zero Day Initiative program, reported a vulnerability in
Mozilla's garbage collection process. The vulnerability was caused by
improper memory management of a set of cloned XUL DOM elements which
were linked as a parent and child. After reloading the browser on a
page with such linked elements, the browser would crash when attempting
to access an object which was already destroyed. An attacker could
use this crash to run arbitrary code on the victim's computer.
MFSA 2009-09 / CVE-2009-0776: Mozilla security researcher Georgi
Guninski reported that a website could use nsIRDFService and a
cross-domain redirect to steal arbitrary XML data from another domain,
a violation of the same-origin policy. This vulnerability could be used
by a malicious website to steal private data from users authenticated
to the redirected website.
MFSA 2009-10 / CVE-2009-0040: libpng maintainer Glenn Randers-Pehrson
reported several memory safety hazards in PNG libraries used by
Mozilla. These vulnerabilities could be used by a malicious website
to crash a victim's browser and potentially execute arbitrary code
on their computer. libpng was upgraded to a version which contained
fixes for these flaws.
MFSA 2009-11 / CVE-2009-0777: Mozilla contributor Masahiro Yamada
reported that certain invisible control characters were being decoded
when displayed in the location bar, resulting in fewer visible
characters than were present in the actual location. An attacker
could use this vulnerability to spoof the location bar and display
a misleading URL for their malicious web page.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
