Test ID:	1.3.6.1.4.1.25623.1.0.70669
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2012:0079
Summary:	Redhat Security Advisory RHSA-2012:0079
Description:	The remote host is missing updates announced in advisory RHSA-2012:0079. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A use-after-free flaw was found in the way Firefox removed nsDOMAttribute child nodes. In certain circumstances, due to the premature notification of AttributeChildRemoved, a malicious script could possibly use this flaw to cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3659) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0442) A flaw was found in the way Firefox parsed Ogg Vorbis media files. A web page containing a malicious Ogg Vorbis media file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0444) A flaw was found in the way Firefox parsed certain Scalable Vector Graphics (SVG) image files that contained eXtensible Style Sheet Language Transformations (XSLT). A web page containing a malicious SVG image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0449) The same-origin policy in Firefox treated http://example.com and http://[example.com] as interchangeable. A malicious script could possibly use this flaw to gain access to sensitive information (such as a client's IP and user e-mail address, or httpOnly cookies) that may be included in HTTP proxy error replies, generated in response to invalid URLs using square brackets. (CVE-2011-3670) For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.26. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.26, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2012-0079.html http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.26 Risk factor : High
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-3659 http://www.mandriva.com/security/advisories?name=MDVSA-2012:013 SuSE Security Announcement: SUSE-SU-2012:0198 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html SuSE Security Announcement: SUSE-SU-2012:0221 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html SuSE Security Announcement: openSUSE-SU-2012:0234 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14697 Common Vulnerability Exposure (CVE) ID: CVE-2011-3670 Debian Security Information: DSA-2400 (Google Search) http://www.debian.org/security/2012/dsa-2400 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14814 Common Vulnerability Exposure (CVE) ID: CVE-2012-0442 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14678 Common Vulnerability Exposure (CVE) ID: CVE-2012-0444 BugTraq ID: 51753 http://www.securityfocus.com/bid/51753 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14464 XForce ISS Database: mozilla-nschildview-code-exec(72858) http://xforce.iss.net/xforce/xfdb/72858 Common Vulnerability Exposure (CVE) ID: CVE-2012-0449 BugTraq ID: 51754 http://www.securityfocus.com/bid/51754 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14618 XForce ISS Database: mozilla-xsltstylesheets-code-execution(72868) http://xforce.iss.net/xforce/xfdb/72868
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: