Test ID:	1.3.6.1.4.1.25623.1.0.68489
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-997-1 (xulrunner-1.9.2)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to xulrunner-1.9.2 announced via advisory USN-997-1. Details follow: Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary Kwong, Martijn Wargers, Siddharth Agarwal and Michal Zalewski discovered various flaws in the browser engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2010-3175, CVE-2010-3176) Alexander Miller, Sergey Glazunov, and others discovered several flaws in the JavaScript engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2010-3179, CVE-2010-3180, CVE-2010-3183) Robert Swiecki discovered that Firefox did not properly validate Gopher URLs. If a user were tricked into opening a crafted file via Gopher, an attacker could possibly run arbitrary JavaScript. (CVE-2010-3177) Eduardo Vela Nava discovered that Firefox could be made to violate the same-origin policy by using modal calls with JavaScript. An attacker could exploit this to steal information from another site. (CVE-2010-3178) Dmitri GribenkoDmitri Gribenko discovered that Firefox did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. (CVE-2010-3182) Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: firefox-3.0 3.6.11+build3+nobinonly-0ubuntu0.8.04.1 xulrunner-1.9.2 1.9.2.11+build3+nobinonly-0ubuntu0.8.04.1 Ubuntu 9.04: abrowser 3.6.11+build3+nobinonly-0ubuntu0.9.04.1 firefox-3.0 3.6.11+build3+nobinonly-0ubuntu0.9.04.1 xulrunner-1.9.2 1.9.2.11+build3+nobinonly-0ubuntu0.9.04.1 Ubuntu 9.10: firefox-3.5 3.6.11+build3+nobinonly-0ubuntu0.9.10.1 xulrunner-1.9.1 1.9.1.14+build4+nobinonly-0ubuntu0.9.10.1 xulrunner-1.9.2 1.9.2.11+build3+nobinonly-0ubuntu0.9.10.1 Ubuntu 10.04 LTS: abrowser 3.6.11+build3+nobinonly-0ubuntu0.10.04.1 firefox 3.6.11+build3+nobinonly-0ubuntu0.10.04.1 xulrunner-1.9.2 1.9.2.11+build3+nobinonly-0ubuntu0.10.04.1 Ubuntu 10.10: abrowser 3.6.11+build3+nobinonly-0ubuntu0.10.10.1 firefox 3.6.11+build3+nobinonly-0ubuntu0.10.10.1 xulrunner-1.9.2 1.9.2.11+build3+nobinonly-0ubuntu0.10.10.1 After a standard system update you need to restart Firefox and any applications that use Xulrunner to make all the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-997-1 Risk factor : Critical CVSS Score: 9.3
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3175 BugTraq ID: 44245 http://www.securityfocus.com/bid/44245 http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:210 http://www.mandriva.com/security/advisories?name=MDVSA-2010:211 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11943 http://www.redhat.com/support/errata/RHSA-2010-0782.html http://www.redhat.com/support/errata/RHSA-2010-0861.html http://www.redhat.com/support/errata/RHSA-2010-0896.html http://secunia.com/advisories/42867 http://www.ubuntu.com/usn/USN-997-1 http://www.ubuntu.com/usn/USN-998-1 http://www.vupen.com/english/advisories/2011/0061 Common Vulnerability Exposure (CVE) ID: CVE-2010-3176 BugTraq ID: 44243 http://www.securityfocus.com/bid/44243 Debian Security Information: DSA-2124 (Google Search) http://www.debian.org/security/2010/dsa-2124 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12132 http://www.redhat.com/support/errata/RHSA-2010-0780.html http://www.redhat.com/support/errata/RHSA-2010-0781.html Common Vulnerability Exposure (CVE) ID: CVE-2010-3177 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12202 Common Vulnerability Exposure (CVE) ID: CVE-2010-3178 BugTraq ID: 44252 http://www.securityfocus.com/bid/44252 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12120 Common Vulnerability Exposure (CVE) ID: CVE-2010-3179 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11675 Common Vulnerability Exposure (CVE) ID: CVE-2010-3180 BugTraq ID: 44248 http://www.securityfocus.com/bid/44248 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12158 Common Vulnerability Exposure (CVE) ID: CVE-2010-3182 BugTraq ID: 44251 http://www.securityfocus.com/bid/44251 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13844 Common Vulnerability Exposure (CVE) ID: CVE-2010-3183 BugTraq ID: 44249 http://www.securityfocus.com/bid/44249 http://www.zerodayinitiative.com/advisories/ZDI-10-219/ https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11891
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.