English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 74154 CVE descriptions
and 39337 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.67281
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-921-1 (xulrunner-1.9.1)
Summary:Ubuntu USN-921-1 (xulrunner-1.9.1)
Description:The remote host is missing an update to xulrunner-1.9.1
announced via advisory USN-921-1.

Details follow:

Martijn Wargers, Josh Soref, Jesse Ruderman, and Ehsan Akhgari discovered
flaws in the browser engine of Firefox. If a user were tricked into viewing
a malicious website, a remote attacker could cause a denial of service or
possibly execute arbitrary code with the privileges of the user invoking
the program. (CVE-2010-0173, CVE-2010-0174)

It was discovered that Firefox could be made to access previously freed
memory. If a user were tricked into viewing a malicious website, a remote
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. (CVE-2010-0175,
CVE-2010-0176, CVE-2010-0177)

Paul Stone discovered that Firefox could be made to change a mouse click
into a drag and drop event. If the user could be tricked into performing
this action twice on a crafted website, an attacker could execute
arbitrary JavaScript with chrome privileges. (CVE-2010-0178)

It was discovered that the XMLHttpRequestSpy module as used by the Firebug
add-on could be used to escalate privileges within the browser. If the user
had the Firebug add-on installed and were tricked into viewing a malicious
website, an attacker could potentially run arbitrary JavaScript.
(CVE-2010-0179)

Henry Sudhof discovered that an image tag could be used as a redirect to
a mailto: URL to launch an external mail handler. (CVE-2010-0181)

Wladimir Palant discovered that Firefox did not always perform security
checks on XML content. An attacker could exploit this to bypass security
policies to load certain resources. (CVE-2010-0182)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
firefox-3.5 3.5.9+nobinonly-0ubuntu0.9.10.1
xulrunner-1.9.1 1.9.1.9+nobinonly-0ubuntu0.9.10.1

After a standard system upgrade you need to restart Firefox and any
applications that use Xulrunner to effect the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-921-1

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-0173
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038367.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038378.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:070
SuSE Security Announcement: SUSE-SR:2010:013 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://ubuntu.com/usn/usn-921-1
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7467
http://securitytracker.com/id?1023775
http://securitytracker.com/id?1023781
http://secunia.com/advisories/39136
http://secunia.com/advisories/39204
http://secunia.com/advisories/39242
http://secunia.com/advisories/39243
http://secunia.com/advisories/39397
http://www.vupen.com/english/advisories/2010/0748
http://www.vupen.com/english/advisories/2010/0849
XForce ISS Database: firefox-browser-eng-code-execution(57388)
http://xforce.iss.net/xforce/xfdb/57388
Common Vulnerability Exposure (CVE) ID: CVE-2010-0174
Debian Security Information: DSA-2027 (Google Search)
http://www.debian.org/security/2010/dsa-2027
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038406.html
http://www.redhat.com/support/errata/RHSA-2010-0332.html
http://www.redhat.com/support/errata/RHSA-2010-0333.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7615
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9502
http://secunia.com/advisories/38566
http://secunia.com/advisories/39117
http://secunia.com/advisories/39240
http://secunia.com/advisories/39308
http://www.vupen.com/english/advisories/2010/0764
http://www.vupen.com/english/advisories/2010/0765
http://www.vupen.com/english/advisories/2010/0781
http://www.vupen.com/english/advisories/2010/0790
XForce ISS Database: mozilla-browser-eng-code-exec(57389)
http://xforce.iss.net/xforce/xfdb/57389
Common Vulnerability Exposure (CVE) ID: CVE-2010-0175
Bugtraq: 20100402 ZDI-10-050: Mozilla Firefox nsTreeSelection EventListener Remote Code Execution Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/archive/1/510542/100/0/threaded
http://www.zerodayinitiative.com/advisories/ZDI-10-050
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7546
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9834
http://securitytracker.com/id?1023780
http://securitytracker.com/id?1023782
XForce ISS Database: firefox-nstreeselection-code-execution(57390)
http://xforce.iss.net/xforce/xfdb/57390
Common Vulnerability Exposure (CVE) ID: CVE-2010-0176
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11052
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7222
http://securitytracker.com/id?1023776
XForce ISS Database: firefox-nstreecontentview-code-exec(57392)
http://xforce.iss.net/xforce/xfdb/57392
Common Vulnerability Exposure (CVE) ID: CVE-2010-0177
Bugtraq: 20100402 ZDI-10-049: Mozilla Firefox PluginArray nsMimeType Dangling Pointer Remote Code Execution Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/archive/1/510540/100/0/threaded
http://www.zerodayinitiative.com/advisories/ZDI-10-049
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10833
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7622
XForce ISS Database: firefox-nspluginarray-code-execution(57393)
http://xforce.iss.net/xforce/xfdb/57393
Common Vulnerability Exposure (CVE) ID: CVE-2010-0178
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10460
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6975
XForce ISS Database: firefox-draganddrop-code-execution(57391)
http://xforce.iss.net/xforce/xfdb/57391
Common Vulnerability Exposure (CVE) ID: CVE-2010-0179
http://www.mandriva.com/security/advisories?name=MDVSA-2010:251
SuSE Security Announcement: SUSE-SA:2011:003 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html
BugTraq ID: 39124
http://www.securityfocus.com/bid/39124
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6971
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9446
http://securitytracker.com/id?1023783
http://secunia.com/advisories/3924
http://secunia.com/advisories/42818
http://www.vupen.com/english/advisories/2011/0030
XForce ISS Database: firefox-firebug-code-execution(57394)
http://xforce.iss.net/xforce/xfdb/57394
Common Vulnerability Exposure (CVE) ID: CVE-2010-0181
Bugtraq: 20100518 DoS vulnerabilities in Firefox, Internet Explorer, Chrome, Opera and other browsers (Google Search)
http://www.securityfocus.com/archive/1/archive/1/511327/100/0/threaded
http://websecurity.com.ua/4206/
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6776
XForce ISS Database: firefox-mailto-weak-security(57395)
http://xforce.iss.net/xforce/xfdb/57395
Common Vulnerability Exposure (CVE) ID: CVE-2010-0182
http://www.redhat.com/support/errata/RHSA-2010-0500.html
http://www.redhat.com/support/errata/RHSA-2010-0501.html
BugTraq ID: 39479
http://www.securityfocus.com/bid/39479
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7618
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9375
http://www.vupen.com/english/advisories/2010/1557
XForce ISS Database: firefox-xmldocumentload-weak-security(57396)
http://xforce.iss.net/xforce/xfdb/57396
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 39337 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.