Test ID:	1.3.6.1.4.1.25623.1.0.70106
Category:	Mandrake Local Security Checks
Title:	Mandriva Security Advisory MDVSA-2011:127 (mozilla)
Summary:	Mandriva Security Advisory MDVSA-2011:127 (mozilla)
Description:	The remote host is missing an update to mozilla announced via advisory MDVSA-2011:127. Security issues were identified and fixed in mozilla firefox and thunderbird: Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Firefox 3.6 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2011-2982). Security researcher regenrecht reported via TippingPoint' s Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability (CVE-2011-0084). Mozilla security researcher moz_bug_r_a_4 reported a vulnerability in event management code that would permit JavaScript to be run in the wrong context, including that of a different website or potentially in a chrome-privileged context (CVE-2011-2981). Security researcher regenrecht reported via TippingPoint' s Zero Day Initiative that appendChild did not correctly account for DOM objects it operated upon and could be exploited to dereference an invalid pointer (CVE-2011-2378). Mozilla security researcher moz_bug_r_a4 reported that web content could receive chrome privileges if it registered for drop events and a browser tab element was dropped into the content area (CVE-2011-2984). Security researcher Mitja Kolsek of Acros Security reported that ThinkPadSensor::Startup could potentially be exploited to load a malicious DLL into the running process (CVE-2011-2980). Security researcher shutdown reported that data from other domains could be read when RegExp.input was set (CVE-2011-2983). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 Additionally, some packages which require so, have been rebuilt and are being provided as updates. Affected: 2009.0, 2010.1, Enterprise Server 5.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:127 http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.20 Risk factor : Critical
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-2982 Debian Security Information: DSA-2295 (Google Search) http://www.debian.org/security/2011/dsa-2295 Debian Security Information: DSA-2296 (Google Search) http://www.debian.org/security/2011/dsa-2296 Debian Security Information: DSA-2297 (Google Search) http://www.debian.org/security/2011/dsa-2297 http://www.mandriva.com/security/advisories?name=MDVSA-2011:127 http://www.redhat.com/support/errata/RHSA-2011-1164.html http://www.redhat.com/support/errata/RHSA-2011-1165.html http://www.redhat.com/support/errata/RHSA-2011-1166.html http://www.redhat.com/support/errata/RHSA-2011-1167.html SuSE Security Announcement: SUSE-SA:2011:037 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html SuSE Security Announcement: SUSE-SU-2011:0967 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14294 http://www.securitytracker.com/id?1025940 Common Vulnerability Exposure (CVE) ID: CVE-2011-0084 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14502 Common Vulnerability Exposure (CVE) ID: CVE-2011-2981 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14512 Common Vulnerability Exposure (CVE) ID: CVE-2011-2378 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14163 Common Vulnerability Exposure (CVE) ID: CVE-2011-2984 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14358 Common Vulnerability Exposure (CVE) ID: CVE-2011-2980 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14436 Common Vulnerability Exposure (CVE) ID: CVE-2011-2983 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14272
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: