SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 656)

critical Nessus Plugin ID 41352

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

The Mozilla Firefox browser is updated to version 3.0.7 fixing various security and stability issues.

- Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 / CVE-2009-0773 / CVE-2009-0774)

- An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's garbage collection process. The vulnerability was caused by improper memory management of a set of cloned XUL DOM elements which were linked as a parent and child. After reloading the browser on a page with such linked elements, the browser would crash when attempting to access an object which was already destroyed. An attacker could use this crash to run arbitrary code on the victim's computer. (MFSA 2009-08 / CVE-2009-0775)

- Mozilla security researcher Georgi Guninski reported that a website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy.
This vulnerability could be used by a malicious website to steal private data from users authenticated to the redirected website. (MFSA 2009-09 / CVE-2009-0776)

- libpng maintainer Glenn Randers-Pehrson reported several memory safety hazards in PNG libraries used by Mozilla.
These vulnerabilities could be used by a malicious website to crash a victim's browser and potentially execute arbitrary code on their computer. libpng was upgraded to a version which contained fixes for these flaws. (MFSA 2009-10 / CVE-2009-0040)

- Mozilla contributor Masahiro Yamada reported that certain invisible control characters were being decoded when displayed in the location bar, resulting in fewer visible characters than were present in the actual location. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page. (MFSA 2009-11 / CVE-2009-0777)

Solution

Apply SAT patch number 656.

Plugin Details

Severity: Critical

ID: 41352

File Name: suse_11_MozillaFirefox-090319.nasl

Version: 1.13

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/24/2009

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:mozillafirefox, p-cpe:/a:novell:suse_linux:11:mozillafirefox-translations, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190-32bit, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190-gnomevfs, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190-gnomevfs-32bit, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190-translations, p-cpe:/a:novell:suse_linux:11:mozilla-xulrunner190-translations-32bit, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 3/19/2009

Reference Information

CVE: CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775, CVE-2009-0776, CVE-2009-0777

CWE: 20, 200, 399, 94

Detections

Analytics