Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-764-1)

Ubuntu Security Notice (C) 2009-2016 Canonical, Inc. / NASL script (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

Several flaws were discovered in the browser engine. If a user were
tricked into viewing a malicious website, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-1302,
CVE-2009-1303, CVE-2009-1304, CVE-2009-1305)

It was discovered that Firefox displayed certain Unicode characters
which could be visually confused with punctuation in valid web
addresses in the location bar. An attacker could exploit this to spoof
the location bar, such as in a phishing attack. (CVE-2009-0652)

Several flaws were discovered in the way Firefox processed malformed
URI schemes. If a user were tricked into viewing a malicious website,
a remote attacker could execute arbitrary JavaScript or steal private
data. (CVE-2009-1306, CVE-2009-1307, CVE-2009-1309, CVE-2009-1310,
CVE-2009-1312)

Cefn Hoile discovered Firefox did not adequately protect against
embedded third-party stylesheets. An attacker could exploit this to
perform script injection attacks using XBL bindings. (CVE-2009-1308)

Paolo Amadini discovered that Firefox would submit POST data when
reloading an inner frame of a web page. If a user were tricked into
viewing a malicious website, a remote attacker could steal private
data. (CVE-2009-1311).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
Public Exploit Available : true

Ready to Scan Unlimited IPs & Run Compliance Checks?

Upgrade to Nessus Professional today!

Buy Now

Combine the Power of Nessus with the Ease of Cloud

Start your free Nessus Cloud trial now!

Begin Free Trial