Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-764-1)

Ubuntu Security Notice (C) 2009-2013 Canonical, Inc. / NASL script (C) 2009-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

Several flaws were discovered in the browser engine. If a user were
tricked into viewing a malicious website, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-1302,
CVE-2009-1303, CVE-2009-1304, CVE-2009-1305)

It was discovered that Firefox displayed certain Unicode characters
which could be visually confused with punctuation in valid web
addresses in the location bar. An attacker could exploit this to spoof
the location bar, such as in a phishing attack. (CVE-2009-0652)

Several flaws were discovered in the way Firefox processed malformed
URI schemes. If a user were tricked into viewing a malicious website,
a remote attacker could execute arbitrary JavaScript or steal private
data. (CVE-2009-1306, CVE-2009-1307, CVE-2009-1309, CVE-2009-1310,
CVE-2009-1312)

Cefn Hoile discovered Firefox did not adequately protect against
embedded third-party stylesheets. An attacker could exploit this to
perform script injection attacks using XBL bindings. (CVE-2009-1308)

Paolo Amadini discovered that Firefox would submit POST data when
reloading an inner frame of a web page. If a user were tricked into
viewing a malicious website, a remote attacker could steal private
data. (CVE-2009-1311).

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)