Detections
Analytics
SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 4757)
high Nessus Plugin ID 29363
Synopsis
The remote SuSE 10 host is missing a security-related patch.Description
This update brings Mozilla Firefox to security update version 2.0.0.10Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947:
The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar:
URI.
- The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2007-38 / CVE-2007-5959)
- Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. (MFSA 2007-39 / CVE-2007-5960)
Solution
Apply ZYPP patch number 4757.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2007-37/
https://www.mozilla.org/en-US/security/advisories/mfsa2007-38/
https://www.mozilla.org/en-US/security/advisories/mfsa2007-39/
http://support.novell.com/security/cve/CVE-2007-5947.html
Plugin Details
Severity: High
ID: 29363
File Name: suse_MozillaFirefox-4757.nasl
Version: 1.19
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 12/13/2007
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 9.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/o:suse:suse_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Patch Publication Date: 11/27/2007
Vulnerability Publication Date: 11/13/2007