Integer overflow in Apple CoreGraphics, as used in Safari before 4.0.3, Mozilla Firefox before 3.0.12, and Mac OS X 10.4.11 and 10.5.8, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a heap-based buffer overflow during font glyph rendering, a related issue to CVE-2009-1194.

The remote host is affected by the vulnerability described in GLSA-201405-13 (Pango: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pango. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to load specially       crafted text using an application linked against Pango, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

The version of Safari installed on the remote host is earlier than 4.0.3.  Such versions are potentially affected by several issues : 

  - A buffer overflow exists in the handling of EXIF metadata could lead to a crash or arbitrary code execution. (CVE-2009-2188)

  - A vulnerability in WebKit's parsing of floating point numbers may allow for remote code execution. (CVE-2009-2195)

  - A vulnerability in Safari may let a malicious website to be promoted in Safari's Top Sites. (CVE-2009-2196)

  - A vulnerability in how WebKit renders an URL with look alike characters could be used to masquerade a website. (CVE-2009-2199)

  - A vulnerability in WebKit may lead to the disclosure of sensitive information. (CVE-2009-2200)

  - A heap buffer overflow in CoreGraphics involving the drawing of long text strings could lead to a crash or arbitrary code execution. (CVE-2009-2468)

The version of Safari installed on the remote Windows host is earlier than 4.0.3.  Such versions are potentially affected by several issues :

  - A buffer overflow exists in the handling of EXIF     metadata that ccould lead to a crash or arbitrary code     execution. (CVE-2009-2188)

  - A vulnerability in WebKit's parsing of floating point     numbers may allow for remote code execution.
    (CVE-2009-2195)

  - A vulnerability in Safari may allow a malicious website     to be promoted in Safari's Top Sites. (CVE-2009-2196)

  - A vulnerability in how WebKit renders an URL with look-     alike characters could be used to masquerade a website.
    (CVE-2009-2199)

  - A vulnerability in WebKit may lead to the disclosure of     sensitive information. (CVE-2009-2200)

  - A heap-based buffer overflow in CoreGraphics involving     the drawing of long text strings could lead to a crash     or arbitrary code execution. (CVE-2009-2468)

Security vulnerabilities have been discovered and corrected in Mozilla Firefox 3.0.x :

Several flaws were discovered in the Firefox browser and JavaScript engines, which could allow a malicious website to cause a denial of service or possibly execute arbitrary code with user privileges.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2468, CVE-2009-2471)

Attila Suszter discovered a flaw in the way Firefox processed Flash content, which could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2467)

It was discovered that Firefox did not properly handle some SVG content, which could lead to a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2469)

A flaw was discovered in the JavaScript engine which could be used to perform cross-site scripting attacks. (CVE-2009-2472)

This update provides the latest Mozilla Firefox 3.0.x to correct these issues.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Versions of Firefox prior to 3.0.12 are affected by the following security issues :

 - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-34)
 - It may be possible to crash the browser or potentially execute arbitrary code by using a flash object that presents a slow script dialog. (MFSA 2009-35)
 - Glyph rendering libraries are affected by multiple heap/integer overflows. (MFSA 2009-36)
 - A vulnerability involving SVG element could be exploited to crash the browser or execute arbitrary code on the remote system. (MFSA 2009-37)
 - A vulnerability in 'setTimeout' could allow unsafe access to the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary JavaScript with chrome privileges. (MFSA 2009-39)
 - It may be possible for JavaScript from one website to bypass cross-origin wrapper, and unsafely access properties of an object from another website. (MFSA 2009-40)  

The installed version of Firefox is earlier than 3.0.12. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could     potentially be exploited to execute arbitrary code.     (MFSA 2009-34)

  - It may be possible to crash the browser or potentially     execute arbitrary code by using a flash object that     presents a slow script dialog. (MFSA 2009-35) 

  - Glyph rendering libraries are affected by multiple heap/     integer overflows. (MFSA 2009-36)

  - A vulnerability involving SVG element could be exploited     to crash the browser or execute arbitrary code on the     remote system. (MFSA 2009-37)

  - A SOCKS5 proxy that replies with a hostname containing     more than 15 characters can corrupt the subsequent     data stream.  This can lead to a denial of service,     though there is reportedly no memory corruption.
    (MFSA 2009-38)

  - A vulnerability in 'setTimeout' could allow unsafe     access to the 'this' object from chrome code. An     attacker could exploit this flaw to run arbitrary     JavaScript with chrome privileges. (MFSA 2009-39)

  - It may be possible for JavaScript from one website     to bypass cross origin wrapper, and unsafely access     properties of an object from another website.
    (MFSA 2009-40)

ID	Name	Product	Family	Type	Severity
74056	GLSA-201405-13 : Pango: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
43769	CentOS 5 : firefox (CESA-2009:1162)	Nessus	CentOS Local Security Checks	Local	critical
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	Local	critical
5125	Safari < 4.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
40554	Safari < 4.0.3 Multiple Vulnerabilities	Nessus	Windows	Local	high
40438	Mandriva Linux Security Advisory : firefox (MDVSA-2009:182)	Nessus	Mandriva Local Security Checks	Local	critical
5101	Mozilla Firefox < 3.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
40351	Firefox < 3.0.12 Multiple Vulnerabilities	Nessus	Windows	Local	high
40340	RHEL 4 / 5 : firefox (RHSA-2009:1162)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2009-2468

high

Tenable Plugins

critical

critical

critical

medium

high

critical

medium

high

critical