The oggplay_data_handle_theora_frame function in media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a crafted .ogg video file.

From Red Hat Security Advisory 2009:1530 :

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR).

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370)

A flaw was found in the way Firefox creates temporary file names for downloaded files. If a local attacker knows the name of a file Firefox is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274)

A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file processor. If Firefox loads a malicious PAC file, it could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3372)

A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3373)

A heap-based buffer overflow flaw was found in the Firefox string to floating point conversion routines. A web page containing malicious JavaScript could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-1563)

A flaw was found in the way Firefox handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375)

A flaw was found in the way Firefox displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body.
An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.15. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.15, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues.

The following security issues have been fixed :

  - Security researcher Paul Stone reported that a user's     form history, both from web content as well as the smart     location bar, was vulnerable to theft. A malicious web     page could synthesize events such as mouse focus and key     presses on behalf of the victim and trick the browser     into auto-filling the form fields with history entries     and then reading the entries. (MFSA 2009-52 /     CVE-2009-3370)

  - Security researcher Jeremy Brown reported that the file     naming scheme used for downloading a file which already     exists in the downloads folder is predictable. If an     attacker had local access to a victim's computer and     knew the name of a file the victim intended to open     through the Download Manager, he could use this     vulnerability to place a malicious file in the     world-writable directory used to save temporary     downloaded files and cause the browser to choose the     incorrect file when opening it. Since this attack     requires local access to the victim's machine, the     severity of this vulnerability was determined to be low.
    (MFSA 2009-53 / CVE-2009-3274)

  - Security researcher Orlando Berrera of Sec Theory     reported that recursive creation of JavaScript     web-workers can be used to create a set of objects whose     memory could be freed prior to their use. These     conditions often result in a crash which could     potentially be used by an attacker to run arbitrary code     on a victim's computer. (MFSA 2009-54 / CVE-2009-3371)

  - Security researcher Marco C. reported a flaw in the     parsing of regular expressions used in Proxy     Auto-configuration (PAC) files. In certain cases this     flaw could be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. Since     this vulnerability requires the victim to have PAC     configured in their environment with specific regular     expresssions which can trigger the crash, the severity     of the issue was determined to be moderate. (MFSA     2009-55 / CVE-2009-3372)

  - Security research firm iDefense reported that researcher     regenrecht discovered a heap-based buffer overflow in     Mozilla's GIF image parser. This vulnerability could     potentially be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. (MFSA     2009-56 / CVE-2009-3373)

  - Mozilla security researcher moz_bug_r_a4 reported that     the XPCOM utility XPCVariant::VariantDataToJS unwrapped     doubly-wrapped objects before returning them to chrome     callers. This could result in chrome privileged code     calling methods on an object which had previously been     created or modified by web content, potentially     executing malicious JavaScript code with chrome     privileges. (MFSA 2009-57 / CVE-2009-3374)

  - Security researcher Alin Rad Pop of Secunia Research     reported a heap-based buffer overflow in Mozilla's     string to floating point number conversion routines.
    Using this vulnerability an attacker could craft some     malicious JavaScript code containing a very long string     to be converted to a floating point number which would     result in improper memory allocation and the execution     of an arbitrary memory location. This vulnerability     could thus be leveraged by the attacker to run arbitrary     code on a victim's computer. (MFSA 2009-59 /     CVE-2009-1563)

  - Security researcher Gregory Fleischer reported that text     within a selection on a web page can be read by     JavaScript in a different domain using the     document.getSelection function, violating the     same-origin policy. Since this vulnerability requires     user interaction to exploit, its severity was determined     to be moderate. (MFSA 2009-61 / CVE-2009-3375)

  - Mozilla security researchers Jesse Ruderman and Sid     Stamm reported that when downloading a file containing a     right-to-left override character (RTL) in the filename,     the name displayed in the dialog title bar conflicts     with the name of the file shown in the dialog body. An     attacker could use this vulnerability to obfuscate the     name and file extension of a file to be downloaded and     opened, potentially causing a user to run an executable     file when they expected to open a non-executable file.
    (MFSA 2009-62 / CVE-2009-3376)

  - Mozilla upgraded several thirdparty libraries used in     media rendering to address multiple memory safety and     stability bugs identified by members of the Mozilla     community. Some of the bugs discovered could potentially     be used by an attacker to crash a victim's browser and     execute arbitrary code on their computer. liboggz,     libvorbis, and liboggplay were all upgraded to address     these issues. Audio and video capabilities were added in     Firefox 3.5 so prior releases of Firefox were not     affected. Georgi Guninski reported a crash in liboggz.
    (CVE-2009-3377), Lucas Adamski, Matthew Gregan, David     Keeler, and Dan Kaminsky reported crashes in libvorbis.
    (CVE-2009-3379), Juan Becerra reported a crash in     liboggplay. (CVE-2009-3378). (MFSA 2009-63 /     CVE-2009-3377 / CVE-2009-3379 / CVE-2009-3378)

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-64 / CVE-2009-3380 /     CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383)

Security issues were identified and fixed in firefox 3.5.x :

Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location.
This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer (CVE-2009-1563).

Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer and knew the name of a file the victim intended to open through the Download Manager, he could use this vulnerability to place a malicious file in the world-writable directory used to save temporary downloaded files and cause the browser to choose the incorrect file when opening it. Since this attack requires local access to the victim's machine, the severity of this vulnerability was determined to be low (CVE-2009-3274).

Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to theft. A malicious web page could synthesize events such as mouse focus and key presses on behalf of the victim and trick the browser into auto-filling the form fields with history entries and then reading the entries (CVE-2009-3370).

Security researcher Orlando Berrera of Sec Theory reported that recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. These conditions often result in a crash which could potentially be used by an attacker to run arbitrary code on a victim's computer (CVE-2009-3371).

Security researcher Marco C. reported a flaw in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. In certain cases this flaw could be used by an attacker to crash a victim's browser and run arbitrary code on their computer. Since this vulnerability requires the victim to have PAC configured in their environment with specific regular expresssions which can trigger the crash, the severity of the issue was determined to be moderate (CVE-2009-3372).

Security research firm iDefense reported that researcher regenrecht discovered a heap-based buffer overflow in Mozilla's GIF image parser.
This vulnerability could potentially be used by an attacker to crash a victim's browser and run arbitrary code on their computer (CVE-2009-3373).

Mozilla security researcher moz_bug_r_a4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web content, potentially executing malicious JavaScript code with chrome privileges (CVE-2009-3374).

Security researcher Gregory Fleischer reported that text within a selection on a web page can be read by JavaScript in a different domain using the document.getSelection function, violating the same-origin policy. Since this vulnerability requires user interaction to exploit, its severity was determined to be moderate (CVE-2009-3375).

Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file (CVE-2009-3376).

Mozilla upgraded several third-party libraries used in media rendering to address multiple memory safety and stability bugs identified by members of the Mozilla community. Some of the bugs discovered could potentially be used by an attacker to crash a victim's browser and execute arbitrary code on their computer. liboggz, libvorbis, and liboggplay were all upgraded to address these issues (CVE-2009-3377, CVE-2009-3379, CVE-2009-3378).

Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2009-3380).

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The installed version of Firefox 3.5 is earlier than 3.5.4.  Such versions are potentially affected by the following security issues :

  - It may be possible for a malicious web page to     steal form history. (MFSA 2009-52)

  - By predicting the filename of an already     downloaded file in the downloads directory, a     local attacker may be able to trick the browser     into opening an incorrect file. (MFSA 2009-53)

  - Recursive creation of JavaScript web-workers     could crash the browser or allow execution of     arbitrary code on the remote system.
    (MFSA 2009-54)

  - Provided the browser is configured to use Proxy     Auto-configuration it may be possible for an     attacker to crash the browser or execute     arbitrary code. (MFSA 2009-55)

  - Mozilla's GIF image parser is affected by a     heap-based buffer overflow. (MFSA 2009-56)

  - A vulnerability in XPCOM utility     'XPCVariant::VariantDataToJS' could allow     executing arbitrary JavaScript code with chrome     privileges. (MFSA 2009-57)

  - A vulnerability in Mozilla's string to floating     point number conversion routine could allow     arbitrary code execution on the remote system.     (MFSA 2009-59)

  - It may be possible to read text from a web page     using JavaScript function 'document.getSelection()     from a different domain. (MFSA 2009-61)

  - If a file contains right-to-left override     character (RTL) in the filename it may be possible     for an attacker to obfuscate the filename and     extension of the file being downloaded.     (MFSA 2009-62)

  - Multiple memory safety bugs in media libraries     could potentially allow arbitrary code execution.
    (MFSA 2009-63)

  - Multiple memory corruption vulnerabilities could     potentially allow arbitrary code execution.
    (MFSA 2009-64)

Mozilla Foundation reports :

MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)

MFSA 2009-63 Upgrade media libraries to fix memory safety bugs

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-61 Cross-origin data theft through document.getSelection()

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()

MFSA 2009-56 Heap buffer overflow in GIF color map parser

MFSA 2009-55 Crash in proxy auto-configuration regexp parsing

MFSA 2009-54 Crash with recursive web-worker calls

MFSA 2009-53 Local downloaded file tampering

MFSA 2009-52 Form history vulnerable to stealing

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR).

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370)

A flaw was found in the way Firefox creates temporary file names for downloaded files. If a local attacker knows the name of a file Firefox is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274)

A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file processor. If Firefox loads a malicious PAC file, it could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3372)

A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3373)

A heap-based buffer overflow flaw was found in the Firefox string to floating point conversion routines. A web page containing malicious JavaScript could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-1563)

A flaw was found in the way Firefox handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375)

A flaw was found in the way Firefox displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body.
An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.15. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.15, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host has a version of Mozilla Firefox earlier than 3.0.15 / 3.5.4 installed.  Such versions are potentially affected by multiple vulnerabilities : 

  - A user's form history, both from web content as well as the smart location bar, was vulnerable to theft. (MFSA 2009-52)

  - The file naming scheme used for downloading a file which already exists in the download folder is predictable.  An attacker with local access could exploit this to trick the browser into opening the incorrect downloaded file. (MFSA 2009-53)

  - Recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. Note that this only affects Firefox 3.5.x. (MFSA 2009-54)

  - A flaw exists in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. (MFSA 2009-55)

  - A heap-based overflow exists in Mozilla's GIF image parser. (MFSA 2009-56)

  - The XPCOM utility 'XPCVariant: : VariantDataToJS' unwrapped doubly-wrapped objects before returning them to chrome callers which could lead to chrome privileged code calling methods on an object which had previously been created or modified by web content. (MFSA 2009-57)

  - A heap-based overflow exists in Mozilla's string to floating point number conversion routines. (MFSA 2009-59)

  - The text within a selection on a web page can be read by JavaScript in a different domain using the 'document.getSelection' function, violating the same-origin policy. (MFSA 2009-61)

  - When downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. (MFSA 2009-62)

  - Multiple memory safety and stability bugs exist in the 'liboggz', 'libvorbis', and 'liboggplay' libraries.  Note that this issue only affects Firefox 3.5.x. (MFSA 2009-63)

  - Several memory corruption issues exist in the browser engine. (MFSA 2009-64)

The remote host has a version of Mozilla Firefox earlier than 3.0.15 / 3.5.4 installed.  Such versions are potentially affected by multiple vulnerabilities : 

 - A user's form history, both from web content as well as the smart location bar, was vulnerable to theft. (MFSA 2009-52)
 - The file naming scheme used for downloading a file which already exists in the download folder is predictable.  An attacker with local access could exploit this to trick the browser into opening the incorrect downloaded file. (MFSA 2009-53)
 - Recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. Note that this only affects Firefox 3.5.x. (MFSA 2009-54)
 - A flaw exists in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. (MFSA 2009-55)
 - A heap-based overflow exists in Mozilla's GIF image parser. (MFSA 2009-56)
 - The XPCOM utility 'XPCVariant: : VariantDataToJS' unwrapped doubly-wrapped objects before returning them to chrome callers which could lead to chrome privileged code calling methods on an object which had previously been created or modified by web content. (MFSA 2009-57)
 - A heap-based overflow exists in Mozilla's string to floating point number conversion routines. (MFSA 2009-59)
 - The text within a selection on a web page can be read by JavaScript in a different domain using the 'document.getSelection' function, violating the same-origin policy. (MFSA 2009-61)
 - When downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. (MFSA 2009-62)
 - Multiple memory safety and stability bugs exist in the 'liboggz', 'libvorbis', and 'liboggplay' libraries.  Note that this issue only affects Firefox 3.5.x. (MFSA 2009-63)
 - Several memory corruption issues exist in the browser engine. (MFSA 2009-64)

ID	Name	Product	Family	Severity
67948	Oracle Linux 4 / 5 : firefox (ELSA-2009-1530)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
49887	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6609)	Nessus	SuSE Local Security Checks	critical
48157	Mandriva Linux Security Advisory : firefox (MDVSA-2009:294)	Nessus	Mandriva Local Security Checks	critical
42365	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6606)	Nessus	SuSE Local Security Checks	critical
42363	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1488)	Nessus	SuSE Local Security Checks	critical
42306	Firefox 3.5.x < 3.5.4 Multiple Vulnerabilities	Nessus	Windows	high
42298	FreeBSD : mozilla -- multiple vulnerabilities (c87aa2d2-c3c4-11de-ab08-000f20797ede)	Nessus	FreeBSD Local Security Checks	critical
42295	CentOS 4 : firefox (CESA-2009:1530)	Nessus	CentOS Local Security Checks	critical
801352	Mozilla Firefox < 3.0.15 / 3.5.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5218	Mozilla Firefox < 3.0.15 / 3.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
42287	RHEL 4 / 5 : firefox (RHSA-2009:1530)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2009-3378

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical

critical

high

medium

critical