Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox vulnerabilities (USN-1638-1)

Ubuntu Security Notice (C) 2012-2014 Canonical, Inc. / NASL script (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed
Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and
Andrew McCreight discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted
page, an attacker could possibly exploit these to cause a denial of
service via application crash, or potentially execute code with the
privileges of the user invoking Firefox. (CVE-2012-5842,
CVE-2012-5843)

Atte Kettunen discovered a buffer overflow while rendering GIF format
images. An attacker could exploit this to possibly execute arbitrary
code as the user invoking Firefox. (CVE-2012-4202)

It was discovered that the evalInSandbox function's JavaScript sandbox
context could be circumvented. An attacker could exploit this to
perform a cross-site scripting (XSS) attack or steal a copy of a local
file if the user has installed an add-on vulnerable to this attack.
With cross-site scripting vulnerabilities, if a user were tricked into
viewing a specially crafted page, a remote attacker could exploit this
to modify the contents, or steal confidential data, within the same
domain. (CVE-2012-4201)

Jonathan Stephens discovered that combining vectors involving the
setting of Cascading Style Sheets (CSS) properties in conjunction with
SVG text could cause Firefox to crash. If a user were tricked into
opening a malicious web page, an attacker could cause a denial of
service via application crash or execute arbitrary code with the
privliges of the user invoking the program. (CVE-2012-5836)

It was discovered that if a javascript: URL is selected from the list
of Firefox 'new tab' page, the script will inherit the privileges of
the privileged 'new tab' page. This allows for the execution of
locally installed programs if a user can be convinced to save a
bookmark of a malicious javascript: URL. (CVE-2012-4203)

Scott Bell discovered a memory corruption issue in the JavaScript
engine. If a user were tricked into opening a malicious website, an
attacker could exploit this to execute arbitrary JavaScript code
within the context of another website or arbitrary code as the user
invoking the program. (CVE-2012-4204)

Gabor Krizsanits discovered that XMLHttpRequest objects created within
sandboxes have the system principal instead of the sandbox principal.
This can lead to cross-site request forgery (CSRF) or information
theft via an add-on running untrusted code in a sandbox.
(CVE-2012-4205)

Peter Van der Beken discovered XrayWrapper implementation in Firefox
does not consider the compartment during property filtering. An
attacker could use this to bypass intended chrome-only restrictions on
reading DOM object properties via a crafted website. (CVE-2012-4208)

Bobby Holley discovered that cross-origin wrappers were allowing write
actions on objects when only read actions should have been properly
allowed. This can lead to cross-site scripting (XSS) attacks. With
cross-site scripting vulnerabilities, if a user were tricked into
viewing a specially crafted page, a remote attacker could exploit this
to modify the contents, or steal confidential data, within the same
domain. (CVE-2012-5841)

Masato Kinugawa discovered that when HZ-GB-2312 charset encoding is
used for text, the '~' character will destroy another character near
the chunk delimiter. This can lead to a cross-site scripting (XSS)
attack in pages encoded in HZ-GB-2312. With cross-site scripting
vulnerabilities, if a user were tricked into viewing a specially
crafted page, a remote attacker could exploit this to modify the
contents, or steal confidential data, within the same domain.
(CVE-2012-4207)

Masato Kinugawa discovered that scripts entered into the Developer
Toolbar could run in a chrome privileged context. An attacker could
use this vulnerability to conduct cross-site scripting (XSS) attacks
or execute arbitrary code as the user invoking Firefox. With
cross-site scripting vulnerabilities, if a user were tricked into
viewing a specially crafted page, a remote attacker could exploit this
to modify the contents, or steal confidential data, within the same
domain. (CVE-2012-5837)

Mariusz Mlynski discovered that the location property can be accessed
by binary plugins through top.location with a frame whose name
attribute's value is set to 'top'. This can allow for possible
cross-site scripting (XSS) attacks through plugins. With cross-site
scripting vulnerabilities, if a user were tricked into viewing a
specially crafted page, a remote attacker could exploit this to modify
the contents, or steal confidential data, within the same domain.
(CVE-2012-4209)

Mariusz Mlynski discovered that when a maliciously crafted stylesheet
is inspected in the Style Inspector, HTML and CSS can run in a chrome
privileged context without being properly sanitized first. If a user
were tricked into opening a malicious web page, an attacker could
execute arbitrary code with the privliges of the user invoking the
program. (CVE-2012-4210)

Abhishek Arya discovered multiple use-after-free and buffer overflow
issues in Firefox. If a user were tricked into opening a malicious
page, an attacker could exploit these to execute arbitrary code as the
user invoking the program. (CVE-2012-4214, CVE-2012-4215,
CVE-2012-4216, CVE-2012-5829, CVE-2012-5839, CVE-2012-5840,
CVE-2012-4212, CVE-2012-4213, CVE-2012-4217, CVE-2012-4218)

Several memory corruption flaws were discovered in Firefox. If a user
were tricked into opening a malicious page, an attacker could exploit
these to execute arbitrary code as the user invoking the program.
(CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5838).

Solution :

Update the affected firefox package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false