Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.

The remote Solaris system is missing necessary patches to address security updates :

  - The qcms_transform_data_rgb_out_lut_sse2 function in the     QCMS implementation in Mozilla Firefox 4.x through 13.0,     Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11     might allow remote attackers to obtain sensitive     information from process memory via a crafted color     profile that triggers an out-of-bounds read operation.
    (CVE-2012-1960)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 15.0, Firefox ESR 10.x     before 10.0.7, Thunderbird before 15.0, Thunderbird ESR     10.x before 10.0.7, and SeaMonkey before 2.12 allow     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2012-1970)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 15.0, Thunderbird     before 15.0, and SeaMonkey before 2.12 allow remote     attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via vectors related to garbage collection     after certain MethodJIT execution, and unknown other     vectors. (CVE-2012-1971)

  - Use-after-free vulnerability in the     nsHTMLEditor::CollapseAdjacentTextNodes function in     Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1972)

  - Use-after-free vulnerability in the     nsObjectLoadingContent::LoadObject function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1973)

  - Use-after-free vulnerability in the     gfxTextRun::CanBreakLineBefore function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1974)

  - Use-after-free vulnerability in the     PresShell::CompleteMove function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute     arbitrary code or cause a denial of service (heap memory     corruption) via unspecified vectors. (CVE-2012-1975)

  - Use-after-free vulnerability in the     nsHTMLSelectElement::SubmitNamesValues function in     Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1976)

  - Use-after-free vulnerability in the     MediaStreamGraphThreadRunnable::Run function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-3956)

  - Heap-based buffer overflow in the     nsBlockFrame::MarkLineDirty function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute     arbitrary code via unspecified vectors. (CVE-2012-3957)

  - Use-after-free vulnerability in the     nsHTMLEditRules::DeleteNonTableElements function in     Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-3958)

  - Use-after-free vulnerability in the     nsRangeUpdater::SelAdjDeleteNode function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-3959)

  - Use-after-free vulnerability in the     mozSpellChecker::SetCurrentDictionary function in     Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-3960)

  - Use-after-free vulnerability in the RangeData     implementation in Mozilla Firefox before 15.0, Firefox     ESR 10.x before 10.0.7, Thunderbird before 15.0,     Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before     2.12 allows remote attackers to execute arbitrary code     or cause a denial of service (heap memory corruption)     via unspecified vectors. (CVE-2012-3961)

  - Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 do not properly     iterate through the characters in a text run, which     allows remote attackers to execute arbitrary code via a     crafted document. (CVE-2012-3962)

  - Use-after-free vulnerability in the     js::gc::MapAllocToTraceKind function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute     arbitrary code via unspecified vectors. (CVE-2012-3963)

  - Use-after-free vulnerability in the     gfxTextRun::GetUserData function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute     arbitrary code or cause a denial of service (heap memory     corruption) via unspecified vectors. (CVE-2012-3964)

  - Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allow remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a negative height value     in a BMP image within a .ICO file, related to (1)     improper handling of the transparency bitmask by the     nsICODecoder component and (2) improper processing of     the alpha channel by the nsBMPDecoder component.
    (CVE-2012-3966)

  - The WebGL implementation in Mozilla Firefox before 15.0,     Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0,     Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before     2.12 on Linux, when a large number of sampler uniforms     are used, does not properly interact with Mesa drivers,     which allows remote attackers to execute arbitrary code     or cause a denial of service (stack memory corruption)     via a crafted web site. (CVE-2012-3967)

  - Use-after-free vulnerability in the WebGL implementation     in Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code via vectors related     to deletion of a fragment shader by its accessor.
    (CVE-2012-3968)

  - Integer overflow in the nsSVGFEMorphologyElement::Filter     function in Mozilla Firefox before 15.0, Firefox ESR     10.x before 10.0.7, Thunderbird before 15.0, Thunderbird     ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows     remote attackers to execute arbitrary code via a crafted     SVG filter that triggers an incorrect sum calculation,     leading to a heap-based buffer overflow. (CVE-2012-3969)

  - Use-after-free vulnerability in the     nsTArray_base::Length function in Mozilla Firefox before     15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before     15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey     before 2.12 allows remote attackers to execute arbitrary     code or cause a denial of service (heap memory     corruption) via vectors involving movement of a     requiredFeatures attribute from one SVG document to     another. (CVE-2012-3970)

  - The format-number functionality in the XSLT     implementation in Mozilla Firefox before 15.0, Firefox     ESR 10.x before 10.0.7, Thunderbird before 15.0,     Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before     2.12 allows remote attackers to obtain sensitive     information via unspecified vectors that trigger a     heap-based buffer over-read. (CVE-2012-3972)

  - Untrusted search path vulnerability in the installer in     Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, and Thunderbird ESR     10.x before 10.0.7 on Windows allows local users to gain     privileges via a Trojan horse executable file in a root     directory. (CVE-2012-3974)

  - Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, and SeaMonkey before 2.12 do not properly handle     onLocationChange events during navigation between     different https sites, which allows remote attackers to     spoof the X.509 certificate information in the address     bar via a crafted web page. (CVE-2012-3976)

  - The nsLocation::CheckURL function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 does not properly follow the     security model of the location object, which allows     remote attackers to bypass intended content-loading     restrictions or possibly have unspecified other impact     via vectors involving chrome code. (CVE-2012-3978)

  - The web console in Mozilla Firefox before 15.0, Firefox     ESR 10.x before 10.0.7, Thunderbird before 15.0, and     Thunderbird ESR 10.x before 10.0.7 allows user-assisted     remote attackers to execute arbitrary JavaScript code     with chrome privileges via a crafted web site that     injects this code and triggers an eval operation.
    (CVE-2012-3980)

Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update (bnc#777588)

  - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety     hazards

  - MFSA     2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20     12-1975     CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/     CVE-2012-3959     CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/     CVE-2012-3964 Use-after-free issues found using Address     Sanitizer

  - MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object     can be shadowed using Object.defineProperty

  - MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of     privilege through about:newtab

  - MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793)     Memory corruption with bitmap format images with     negative height

  - MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL     use-after-free and memory corruption

  - MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer     overflow and use-after-free issues

  - MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption

  - MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds     read in format-number in XSLT

  - MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor     extension allows for remote debugging without explicit     activation

  - MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads     linked resources in extensions when parsing text/html

  - MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site     SSL certificate data display

  - MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object     security checks bypassed by chrome code

  - MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval     capable of executing chrome-privileged code

  - fix HTML5 video crash with GStreamer enabled     (bmo#761030)

  - GStreamer is only used for MP4 (no WebM, OGG)

  - updated filelist

  - moved browser specific preferences to correct location

From Red Hat Security Advisory 2012:1210 :

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1970, CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3969, CVE-2012-3970)

Two flaws were found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3967, CVE-2012-3968)

A flaw was found in the way Firefox decoded embedded bitmap images in Icon Format (ICO) files. A web page containing a malicious ICO file could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3966)

A flaw was found in the way the 'eval' command was handled by the Firefox Web Console. Running 'eval' in the Web Console while viewing a web page containing malicious content could possibly cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3980)

An out-of-bounds memory read flaw was found in the way Firefox used the format-number feature of XSLT (Extensible Stylesheet Language Transformations). A web page containing malicious content could possibly cause an information leak, or cause Firefox to crash.
(CVE-2012-3972)

It was found that the SSL certificate information for a previously visited site could be displayed in the address bar while the main window displayed a new page. This could lead to phishing attacks as attackers could use this flaw to trick users into believing they are viewing a trusted site. (CVE-2012-3976)

A flaw was found in the location object implementation in Firefox.
Malicious content could use this flaw to possibly allow restricted content to be loaded. (CVE-2012-3978)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.7 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic, Daniel Holbert, Abhishek Arya, Frederic Hoguin, miaubiz, Arthur Gerkis, Nicolas Gregoire, Mark Poticha, moz_bug_r_a4, and Colby Russell as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Mozilla Firefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems.

The following security issues have been addressed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-57)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Gary Kwong, Christian Holler, Jesse Ruderman, Steve     Fink, Bob Clary, Andrew Sutherland, and Jason Smith     reported memory safety problems and crashes that affect     Firefox 14. (CVE-2012-1971)

  - Gary Kwong, Christian Holler, Jesse Ruderman, John     Schoenick, Vladimir Vukicevic and Daniel Holbert     reported memory safety problems and crashes that affect     Firefox ESR 10 and Firefox 14. (CVE-2012-1970)

  - Security researcher Abhishek Arya (Inferno) of Google     Chrome Security Team discovered a series of     use-after-free issues using the Address Sanitizer tool.
    Many of these issues are potentially exploitable,     allowing for remote code execution. (MFSA 2012-58)

  - Heap-use-after-free in     nsHTMLEditor::CollapseAdjacentTextNodes. (CVE-2012-1972)

  - Heap-use-after-free in     nsObjectLoadingContent::LoadObject. (CVE-2012-1973)

  - Heap-use-after-free in gfxTextRun::CanBreakLineBefore.
    (CVE-2012-1974)

  - Heap-use-after-free in PresShell::CompleteMove.
    (CVE-2012-1975)

  - Heap-use-after-free in     nsHTMLSelectElement::SubmitNamesValues. (CVE-2012-1976)

  - Heap-use-after-free in     MediaStreamGraphThreadRunnable::Run(). (CVE-2012-3956)

  - Heap-buffer-overflow in nsBlockFrame::MarkLineDirty.
    (CVE-2012-3957)

  - Heap-use-after-free in     nsHTMLEditRules::DeleteNonTableElements. (CVE-2012-3958)

  - Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode.
    (CVE-2012-3959)

  - Heap-use-after-free in     mozSpellChecker::SetCurrentDictionary. (CVE-2012-3960)

  - Heap-use-after-free in RangeData::~RangeData.
    (CVE-2012-3961)

  - Bad iterator in text runs. (CVE-2012-3962)

  - use after free in js::gc::MapAllocToTraceKind.
    (CVE-2012-3963)

  - Heap-use-after-free READ 8 in gfxTextRun::GetUserData.
    (CVE-2012-3964)

  - Security researcher Mariusz Mlynski reported that it is     possible to shadow the location object using     Object.defineProperty. This could be used to confuse the     current location to plugins, allowing for possible     cross-site scripting (XSS) attacks. (MFSA 2012-59 /     CVE-2012-1956)

  - Security researcher Mariusz Mlynski reported that when a     page opens a new tab, a subsequent window can then be     opened that can be navigated to about:newtab, a chrome     privileged page. Once about:newtab is loaded, the     special context can potentially be used to escalate     privilege, allowing for arbitrary code execution on the     local system in a maliciously crafted attack. (MFSA     2012-60 / CVE-2012-3965)

  - Security researcher Frederic Hoguin reported two related     issues with the decoding of bitmap (.BMP) format images     embedded in icon (.ICO) format files. When processing a     negative 'height' header value for the bitmap image, a     memory corruption can be induced, allowing an attacker     to write random memory and cause a crash. This crash may     be potentially exploitable. (MFSA 2012-61 /     CVE-2012-3966)

  - Security researcher miaubiz used the Address Sanitizer     tool to discover two WebGL issues. The first issue is a     use-after-free when WebGL shaders are called after being     destroyed. The second issue exposes a problem with Mesa     drivers on Linux, leading to a potentially exploitable     crash. (MFSA 2012-62)

  - use after free, webgl fragment shader deleted by     accessor. (CVE-2012-3968)

  - stack scribbling with 4-byte values choosable among a     few values, when using more than 16 sampler uniforms, on     Mesa, with all drivers CVE-2012-3967

  - Security researcher Arthur Gerkis used the Address     Sanitizer tool to find two issues involving Scalable     Vector Graphics (SVG) files. The first issue is a buffer     overflow in Gecko's SVG filter code when the sum of two     values is too large to be stored as a signed 32-bit     integer, causing the function to write past the end of     an array. The second issue is a use-after-free when an     element with a 'requiredFeatures' attribute is moved     between documents. In that situation, the internal     representation of the 'requiredFeatures' value could be     freed prematurely. Both issues are potentially     exploitable. (MFSA 2012-63)

  - Heap-buffer-overflow in     nsSVGFEMorphologyElement::Filter. (CVE-2012-3969)

  - Heap-use-after-free in nsTArray_base::Length().
    (CVE-2012-3970)

  - Using the Address Sanitizer tool, Mozilla security     researcher Christoph Diehl discovered two memory     corruption issues involving the Graphite 2 library used     in Mozilla products. Both of these issues can cause a     potentially exploitable crash. These problems were fixed     in the Graphite 2 library, which has been updated for     Mozilla products. (MFSA 2012-64 / CVE-2012-3971)

  - Security research Nicolas Gregoire used the Address     Sanitizer tool to discover an out-of-bounds read in the     format-number feature of XSLT, which can cause     inaccurate formatting of numbers and information     leakage. This is not directly exploitable. (MFSA 2012-65     / CVE-2012-3972)

  - Mozilla security researcher Mark Goodwin discovered an     issue with the Firefox developer tools' debugger. If     remote debugging is disabled, but the experimental     HTTPMonitor extension has been installed and enabled, a     remote user can connect to and use the remote debugging     service through the port used by HTTPMonitor. A     remote-enabled flag has been added to resolve this     problem and close the port unless debugging is     explicitly enabled. (MFSA 2012-66 / CVE-2012-3973)

  - Security researcher Masato Kinugawa reported that if a     crafted executable is placed in the root partition on a     Windows file system, the Firefox and Thunderbird     installer will launch this program after a standard     installation instead of Firefox or Thunderbird, running     this program with the user's privileges. (MFSA 2012-67 /     CVE-2012-3974)

  - Security researcher vsemozhetbyt reported that when the     DOMParser is used to parse text/html data in a Firefox     extension, linked resources within this HTML data will     be loaded. If the data being parsed in the extension is     untrusted, it could lead to information leakage and can     potentially be combined with other attacks to become     exploitable. (MFSA 2012-68 / CVE-2012-3975)

  - Security researcher Mark Poticha reported an issue where     incorrect SSL certificate information can be displayed     on the addressbar, showing the SSL data for a previous     site while another has been loaded. This is caused by     two onLocationChange events being fired out of the     expected order, leading to the displayed certificate     data to not be updated. This can be used for phishing     attacks by allowing the user to input form or other data     on a newer, attacking, site while the credentials of an     older site appear on the addressbar. (MFSA 2012-69 /     CVE-2012-3976)

  - Mozilla security researcher moz_bug_r_a4 reported that     certain security checks in the location object can be     bypassed if chrome code is called content in a specific     manner. This allowed for the loading of restricted     content. This can be combined with other issues to     become potentially exploitable. (MFSA 2012-70 /     CVE-2012-3978)

  - Mozilla developer Blake Kaplan reported that
    __android_log_print is called insecurely in places. If a     malicious web page used a dump() statement with a     specially crafted string, it can trigger a potentially     exploitable crash. (MFSA 2012-71 / CVE-2012-3979)

    This vulnerability only affects Firefox for Android.

  - Security researcher Colby Russell discovered that eval     in the web console can execute injected code with chrome     privileges, leading to the running of malicious code in     a privileged context. This allows for arbitrary code     execution through a malicious web page if the web     console is invoked by the user. (MFSA 2012-72 /     CVE-2012-3980)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

MozillaFirefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems.

The following security issues have been addressed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-57)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Gary Kwong, Christian Holler, Jesse Ruderman, Steve     Fink, Bob Clary, Andrew Sutherland, and Jason Smith     reported memory safety problems and crashes that affect     Firefox 14. (CVE-2012-1971)

  - Gary Kwong, Christian Holler, Jesse Ruderman, John     Schoenick, Vladimir Vukicevic and Daniel Holbert     reported memory safety problems and crashes that affect     Firefox ESR 10 and Firefox 14. (CVE-2012-1970)

  - Security researcher Abhishek Arya (Inferno) of Google     Chrome Security Team discovered a series of     use-after-free issues using the Address Sanitizer tool.
    Many of these issues are potentially exploitable,     allowing for remote code execution. (MFSA 2012-58)

    o Heap-use-after-free in     nsHTMLEditor::CollapseAdjacentTextNodes CVE-2012-1972: o     Heap-use-after-free in     nsObjectLoadingContent::LoadObject CVE-2012-1973: o     Heap-use-after-free in gfxTextRun::CanBreakLineBefore     CVE-2012-1974: o Heap-use-after-free in     PresShell::CompleteMove CVE-2012-1975 o     Heap-use-after-free in     nsHTMLSelectElement::SubmitNamesValues CVE-2012-1976: o     Heap-use-after-free in     MediaStreamGraphThreadRunnable::Run() CVE-2012-3956: o     Heap-buffer-overflow in nsBlockFrame::MarkLineDirty     CVE-2012-3957: o Heap-use-after-free in     nsHTMLEditRules::DeleteNonTableElements CVE-2012-3958: o     Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode     CVE-2012-3959: o Heap-use-after-free in     mozSpellChecker::SetCurrentDictionary CVE-2012-3960: o     Heap-use-after-free in RangeData::~RangeData     CVE-2012-3961 o Bad iterator in text runs CVE-2012-3962     o use after free in js::gc::MapAllocToTraceKind     CVE-2012-3963 o Heap-use-after-free READ 8 in     gfxTextRun::GetUserData CVE-2012-3964: * MFSA 2012-59 /     CVE-2012-1956: Security researcher Mariusz Mlynski     reported that it is possible to shadow the location     object using Object.defineProperty. This could be used     to confuse the current location to plugins, allowing for     possible cross-site scripting (XSS) attacks.

  - Security researcher Mariusz Mlynski reported that when a     page opens a new tab, a subsequent window can then be     opened that can be navigated to about:newtab, a chrome     privileged page. Once about:newtab is loaded, the     special context can potentially be used to escalate     privilege, allowing for arbitrary code execution on the     local system in a maliciously crafted attack. (MFSA     2012-60 / CVE-2012-3965)

  - Security researcher Frederic Hoguin reported two related     issues with the decoding of bitmap (.BMP) format images     embedded in icon (.ICO) format files. When processing a     negative 'height' header value for the bitmap image, a     memory corruption can be induced, allowing an attacker     to write random memory and cause a crash. This crash may     be potentially exploitable. (MFSA 2012-61 /     CVE-2012-3966)

  - Security researcher miaubiz used the Address Sanitizer     tool to discover two WebGL issues. The first issue is a     use-after-free when WebGL shaders are called after being     destroyed. The second issue exposes a problem with Mesa     drivers on Linux, leading to a potentially exploitable     crash. (MFSA 2012-62)

    o

    use after free, webgl fragment shader deleted by     accessor CVE-2012-3968: o

    stack scribbling with 4-byte values choosable among a     few values, when using more than 16 sampler uniforms, on     Mesa, with all drivers CVE-2012-3967

  - Security researcher Arthur Gerkis used the Address     Sanitizer tool to find two issues involving Scalable     Vector Graphics (SVG) files. The first issue is a buffer     overflow in Gecko's SVG filter code when the sum of two     values is too large to be stored as a signed 32-bit     integer, causing the function to write past the end of     an array. The second issue is a use-after-free when an     element with a 'requiredFeatures' attribute is moved     between documents. In that situation, the internal     representation of the 'requiredFeatures' value could be     freed prematurely. Both issues are potentially     exploitable. (MFSA 2012-63)

    o

    Heap-buffer-overflow in nsSVGFEMorphologyElement::Filter     CVE-2012-3969: o

    Heap-use-after-free in nsTArray_base::Length()     CVE-2012-3970

  - Using the Address Sanitizer tool, Mozilla security     researcher Christoph Diehl discovered two memory     corruption issues involving the Graphite 2 library used     in Mozilla products. Both of these issues can cause a     potentially exploitable crash. These problems were fixed     in the Graphite 2 library, which has been updated for     Mozilla products. (MFSA 2012-64 / CVE-2012-3971)

  - Security research Nicolas Gregoire used the Address     Sanitizer tool to discover an out-of-bounds read in the     format-number feature of XSLT, which can cause     inaccurate formatting of numbers and information     leakage. This is not directly exploitable. (MFSA 2012-65     / CVE-2012-3972)

  - Mozilla security researcher Mark Goodwin discovered an     issue with the Firefox developer tools' debugger. If     remote debugging is disabled, but the experimental     HTTPMonitor extension has been installed and enabled, a     remote user can connect to and use the remote debugging     service through the port used by HTTPMonitor. A     remote-enabled flag has been added to resolve this     problem and close the port unless debugging is     explicitly enabled. (MFSA 2012-66 / CVE-2012-3973)

  - Security researcher Masato Kinugawa reported that if a     crafted executable is placed in the root partition on a     Windows file system, the Firefox and Thunderbird     installer will launch this program after a standard     installation instead of Firefox or Thunderbird, running     this program with the user's privileges. (MFSA 2012-67 /     CVE-2012-3974)

  - Security researcher vsemozhetbyt reported that when the     DOMParser is used to parse text/html data in a Firefox     extension, linked resources within this HTML data will     be loaded. If the data being parsed in the extension is     untrusted, it could lead to information leakage and can     potentially be combined with other attacks to become     exploitable. (MFSA 2012-68 / CVE-2012-3975)

  - Security researcher Mark Poticha reported an issue where     incorrect SSL certificate information can be displayed     on the addressbar, showing the SSL data for a previous     site while another has been loaded. This is caused by     two onLocationChange events being fired out of the     expected order, leading to the displayed certificate     data to not be updated. This can be used for phishing     attacks by allowing the user to input form or other data     on a newer, attacking, site while the credentials of an     older site appear on the addressbar. (MFSA 2012-69 /     CVE-2012-3976)

  - Mozilla security researcher moz_bug_r_a4 reported that     certain security checks in the location object can be     bypassed if chrome code is called content in a specific     manner. This allowed for the loading of restricted     content. This can be combined with other issues to     become potentially exploitable. (MFSA 2012-70 /     CVE-2012-3978)

  - Mozilla developer Blake Kaplan reported that
    __android_log_print is called insecurely in places. If a     malicious web page used a dump() statement with a     specially crafted string, it can trigger a potentially     exploitable crash. (MFSA 2012-71 / CVE-2012-3979)

    This vulnerability only affects Firefox for Android.

  - Security researcher Colby Russell discovered that eval     in the web console can execute injected code with chrome     privileges, leading to the running of malicious code in     a privileged context. This allows for arbitrary code     execution through a malicious web page if the web     console is invoked by the user. (MFSA 2012-72 /     CVE-2012-3980)

USN-1548-1 fixed vulnerabilities in Firefox. The new package caused a regression in Private Browsing which could leak sites visited to the browser cache. This update fixes the problem.

Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971)

Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain.
(CVE-2012-1956)

Mariusz Mlynski discovered an escalation of privilege vulnerability through about:newtab. This could possibly lead to potentially code execution with the privileges of the user invoking Firefox. (CVE-2012-3965)

Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3966)

It was discovered that Firefox's WebGL implementation was vulnerable to multiple memory safety issues. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3967, CVE-2012-3968)

Arthur Gerkis discovered multiple memory safety issues in Firefox's Scalable Vector Graphics (SVG) implementation. If the user were tricked into opening a specially crafted image, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-3969, CVE-2012-3970)

Christoph Diehl discovered multiple memory safety issues in the bundled Graphite 2 library. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3971)

Nicolas Gregoire discovered an out-of-bounds read in the format-number feature of XSLT. This could potentially cause inaccurate formatting of numbers and information leakage.
(CVE-2012-3972)

Mark Goodwin discovered that under certain circumstances, Firefox's developer tools could allow remote debugging even when disabled. (CVE-2012-3973)

It was discovered that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and potentially be combined with other attacks to become exploitable. (CVE-2012-3975)

Mark Poticha discovered that under certain circumstances incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This could potentially be used for phishing attacks. (CVE-2012-3976)

It was discovered that, in some instances, certain security checks in the location object could be bypassed. This could allow for the loading of restricted content and can potentially be combined with other issues to become exploitable. (CVE-2012-3978)

Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3980).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security issues were identified and fixed in mozilla firefox :

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1971).

Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964).

Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks (CVE-2012-1956).

Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack (CVE-2012-3965).

Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative height header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable (CVE-2012-3966).

Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash (CVE-2012-3968, CVE-2012-3967).

Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko's SVG filter code when the sum of two values is too large to be stored as a signed 32-bit integer, causing the function to write past the end of an array. The second issue is a use-after-free when an element with a requiredFeatures attribute is moved between documents. In that situation, the internal representation of the requiredFeatures value could be freed prematurely. Both issues are potentially exploitable (CVE-2012-3969, CVE-2012-3970).

Using the Address Sanitizer tool, Mozilla security researcher Christoph Diehl discovered two memory corruption issues involving the Graphite 2 library used in Mozilla products. Both of these issues can cause a potentially exploitable crash. These problems were fixed in the Graphite 2 library, which has been updated for Mozilla products (CVE-2012-3971).

Security research Nicolas Gregoire used the Address Sanitizer tool to discover an out-of-bounds read in the format-number feature of XSLT, which can cause inaccurate formatting of numbers and information leakage. This is not directly exploitable (CVE-2012-3972).

Mozilla security researcher Mark Goodwin discovered an issue with the Firefox developer tools' debugger. If remote debugging is disabled, but the experimental HTTPMonitor extension has been installed and enabled, a remote user can connect to and use the remote debugging service through the port used by HTTPMonitor. A remote-enabled flag has been added to resolve this problem and close the port unless debugging is explicitly enabled (CVE-2012-3973).

Security researcher Masato Kinugawa reported that if a crafted executable is placed in the root partition on a Windows file system, the Firefox and Thunderbird installer will launch this program after a standard installation instead of Firefox or Thunderbird, running this program with the user's privileges (CVE-2012-3974).

Security researcher vsemozhetbyt reported that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and can potentially be combined with other attacks to become exploitable (CVE-2012-3975).

Security researcher Mark Poticha reported an issue where incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This is caused by two onLocationChange events being fired out of the expected order, leading to the displayed certificate data to not be updated. This can be used for phishing attacks by allowing the user to input form or other data on a newer, attacking, site while the credentials of an older site appear on the addressbar (CVE-2012-3976).

Mozilla security researcher moz_bug_r_a4 reported that certain security checks in the location object can be bypassed if chrome code is called content in a specific manner. This allowed for the loading of restricted content. This can be combined with other issues to become potentially exploitable (CVE-2012-3978).

Security researcher Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. This allows for arbitrary code execution through a malicious web page if the web console is invoked by the user (CVE-2012-3980).

The mozilla firefox packages has been upgraded to the latest versions which is unaffected by these security flaws.

Additionally the sqlite3 packages has been upgraded to the 3.7.13 version as firefox 15.0 requires the 3.7.12.1+ version.

The Mozilla Project reports :

MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)

MFSA 2012-58 Use-after-free issues found using Address Sanitizer

MFSA 2012-59 Location object can be shadowed using Object.defineProperty

MFSA 2012-60 Escalation of privilege through about:newtab

MFSA 2012-61 Memory corruption with bitmap format images with negative height

MFSA 2012-62 WebGL use-after-free and memory corruption

MFSA 2012-63 SVG buffer overflow and use-after-free issues

MFSA 2012-64 Graphite 2 memory corruption

MFSA 2012-65 Out-of-bounds read in format-number in XSLT

MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation

MFSA 2012-67 Installer will launch incorrect executable following new installation

MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html

MFSA 2012-69 Incorrect site SSL certificate data display

MFSA 2012-70 Location object security checks bypassed by chrome code

MFSA 2012-71 Insecure use of __android_log_print

MFSA 2012-72 Web console eval capable of executing chrome-privileged code

Versions of SeaMonkey 2.x earlier than 2.12 are potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty' and the location object that could allow cross-site scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970, CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

  - An error exists related to bitmap (BMP) and icon (ICO) file decoding that can lead to memory corruption, causing application crashes and potentially arbitrary code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders. (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters. (CVE-2012-3969)

  - A use-after-free error exists related to elements having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists. (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to 'format-number'. (CVE-2012-3972)

  - The DOM parser can unintentionally load linked resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed in the address bar when two 'onLocationChange' events fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be bypassed if crafted calls are made to the browser chrome code. (CVE-2012-3978)

Versions of Firefox 14.x  are potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty' and the location object and  can allow cross-site scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

  - An error exists related to 'about:newtab' and the browser's history. This error can allow a newly opened tab to further open a new window and navigate to the privileged 'about:newtab' page leading to possible privilege escalation. (CVE-2012-3965)

  - An error exists related to bitmap (BMP) and icon (ICO) file decoding that can lead to memory corruption causing application crashes and potentially arbitrary code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders. (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters. (CVE-2012-3969)

  A use-after-free error exists related to elements having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists. (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to 'format-number'. (CVE-2012-3972)

  - Remote debugging is possible even when disabled and the 'HTTPMonitor' extension is enabled. (CVE-2012-3973)

  - The installer can be ticked into running unauthorized executables. (CVE-2012-3974)

  - The DOM parser can unintentionally load linked resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed in the address bar when two 'onLocationChange' events fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be bypassed if crafted calls are made to the browser chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected code to be executed with browser chrome privileges. (CVE-2012-3980)

Versions of Firefox prior to 15.0 are potentially affected by the following security issues :

 - An error exists related to 'Object.defineProperty' and the location object and  can allow cross-site scripting attacks. (CVE-2012-1956)
 - Unspecified memory safety issues exist. (CVE-2012-1970,CVE-2012-1971)
 - Multiple use-after-free errors exist. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
 - An error exists related to 'about:newtab' and the browser's history. This error can allow a newly opened tab to further open a new window and navigate to the privileged 'about:newtab' page leading to possible privilege escalation. (CVE-2012-3965)
 - An error exists related to bitmap (BMP) and icon (ICO) file decoding that can lead to memory corruption causing application crashes and potentially arbitrary code execution. (CVE-2012-3966)
 - A use-after-free error exists related to WebGL shaders. (CVE-2012-3968)
 - A buffer overflow exists related to SVG filters. (CVE-2012-3969)
 A use-after-free error exists related to elements having 'requiredFeatures' attributes. (CVE-2012-3970)
 - A 'Graphite 2' library memory corruption error exists. (CVE-2012-3971)
 - An XSLT out-of-bounds read error exists related to 'format-number'. (CVE-2012-3972)
 - Remote debugging is possible even when disabled and the 'HTTPMonitor' extension is enabled. (CVE-2012-3973)
 - The installer can be ticked into running unauthorized executables. (CVE-2012-3974)
 - The DOM parser can unintentionally load linked resources in extensions. (CVE-2012-3975)
 - Incorrect SSL certificate information can be displayed in the address bar when two 'onLocationChange' events fire out of order. (CVE-2012-3976)
 - Security checks related to location objects can be bypassed if crafted calls are made to the browser chrome code. (CVE-2012-3978)
 - Calling 'eval' in the web console can allow injected code to be executed with browser chrome privileges. (CVE-2012-3980)

Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971)

Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain.
(CVE-2012-1956)

Mariusz Mlynski discovered an escalation of privilege vulnerability through about:newtab. This could possibly lead to potentially code execution with the privileges of the user invoking Firefox.
(CVE-2012-3965)

Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3966)

It was discovered that Firefox's WebGL implementation was vulnerable to multiple memory safety issues. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-3967, CVE-2012-3968)

Arthur Gerkis discovered multiple memory safety issues in Firefox's Scalable Vector Graphics (SVG) implementation. If the user were tricked into opening a specially crafted image, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3969, CVE-2012-3970)

Christoph Diehl discovered multiple memory safety issues in the bundled Graphite 2 library. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3971)

Nicolas Gregoire discovered an out-of-bounds read in the format-number feature of XSLT. This could potentially cause inaccurate formatting of numbers and information leakage. (CVE-2012-3972)

Mark Goodwin discovered that under certain circumstances, Firefox's developer tools could allow remote debugging even when disabled.
(CVE-2012-3973)

It was discovered that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and potentially be combined with other attacks to become exploitable. (CVE-2012-3975)

Mark Poticha discovered that under certain circumstances incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This could potentially be used for phishing attacks. (CVE-2012-3976)

It was discovered that, in some instances, certain security checks in the location object could be bypassed. This could allow for the loading of restricted content and can potentially be combined with other issues to become exploitable. (CVE-2012-3978)

Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-3980).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1970, CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3969, CVE-2012-3970)

Two flaws were found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3967, CVE-2012-3968)

A flaw was found in the way Firefox decoded embedded bitmap images in Icon Format (ICO) files. A web page containing a malicious ICO file could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3966)

A flaw was found in the way the 'eval' command was handled by the Firefox Web Console. Running 'eval' in the Web Console while viewing a web page containing malicious content could possibly cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3980)

An out-of-bounds memory read flaw was found in the way Firefox used the format-number feature of XSLT (Extensible Stylesheet Language Transformations). A web page containing malicious content could possibly cause an information leak, or cause Firefox to crash.
(CVE-2012-3972)

It was found that the SSL certificate information for a previously visited site could be displayed in the address bar while the main window displayed a new page. This could lead to phishing attacks as attackers could use this flaw to trick users into believing they are viewing a trusted site. (CVE-2012-3976)

A flaw was found in the location object implementation in Firefox.
Malicious content could use this flaw to possibly allow restricted content to be loaded. (CVE-2012-3978)

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1970, CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3969, CVE-2012-3970)

Two flaws were found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3967, CVE-2012-3968)

A flaw was found in the way Firefox decoded embedded bitmap images in Icon Format (ICO) files. A web page containing a malicious ICO file could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3966)

A flaw was found in the way the 'eval' command was handled by the Firefox Web Console. Running 'eval' in the Web Console while viewing a web page containing malicious content could possibly cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3980)

An out-of-bounds memory read flaw was found in the way Firefox used the format-number feature of XSLT (Extensible Stylesheet Language Transformations). A web page containing malicious content could possibly cause an information leak, or cause Firefox to crash.
(CVE-2012-3972)

It was found that the SSL certificate information for a previously visited site could be displayed in the address bar while the main window displayed a new page. This could lead to phishing attacks as attackers could use this flaw to trick users into believing they are viewing a trusted site. (CVE-2012-3976)

A flaw was found in the location object implementation in Firefox.
Malicious content could use this flaw to possibly allow restricted content to be loaded. (CVE-2012-3978)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.7 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic, Daniel Holbert, Abhishek Arya, Frederic Hoguin, miaubiz, Arthur Gerkis, Nicolas Gregoire, Mark Poticha, moz_bug_r_a4, and Colby Russell as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The installed version of SeaMonkey is earlier than 2.12.0. Such versions are potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty'     and the location object that could allow cross-site     scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,     CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption,     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists.
    (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - The DOM parser can unintentionally load linked     resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - SPDY's request header compression leads to information     leakage, which can allow private data such as session     cookies to be extracted, even over an SSL connection.
    (CVE-2012-4930)

The installed version of Firefox is earlier than 15.0 and thus, is potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty'     and the location object and  can allow cross-site     scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,     CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to 'about:newtab' and the     browser's history. This error can allow a newly opened     tab to further open a new window and navigate to the     privileged 'about:newtab' page leading to possible     privilege escalation. (CVE-2012-3965)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists.
    (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - Remote debugging is possible even when disabled and the     'HTTPMonitor' extension is enabled. (CVE-2012-3973)

  - The installer can be ticked into running unauthorized     executables. (CVE-2012-3974)

  - The DOM parser can unintentionally load linked     resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected     code to be executed with browser chrome privileges.
    (CVE-2012-3980)

  - SPDY's request header compression leads to information     leakage, which can allow private data such as session     cookies to be extracted, even over an SSL connection.
    (CVE-2012-4930)

The installed version of Firefox 10.0.x is potentially affected by the following security issues :

  - Unspecified memory safety issues exist. (CVE-2012-1970)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption,     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - The installer can be tricked into running unauthorized     executables. (CVE-2012-3974)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected     code to be executed with browser chrome privileges.
    (CVE-2012-3980)

The installed version of Firefox is earlier than 15.0 and thus, is potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty'     and the location object that could allow cross-site     scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,     CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to 'about:newtab' and the     browser's history. This error can allow a newly opened     tab to further open a new window and navigate to the     privileged 'about:newtab' page leading to possible     privilege escalation. (CVE-2012-3965)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists.
    (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - Remote debugging is possible even when disabled and the     'HTTPMonitor' extension is enabled. (CVE-2012-3973)

  - The DOM parser can unintentionally load linked     resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected     code to be executed with browser chrome privileges.
    (CVE-2012-3980)

  - SPDY's request header compression leads to information     leakage, which can allow private data such as session     cookies to be extracted, even over an SSL connection.
    (CVE-2012-4930)

The installed version of Firefox is earlier than 10.0.7 and thus, is potentially affected by the following security issues :

  - Unspecified memory safety issues exist. (CVE-2012-1970)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected     code to be executed with browser chrome privileges.
    (CVE-2012-3980)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1210 advisory.

  - Mozilla: Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7) (MFSA 2012-57) (CVE-2012-1970)

  - Mozilla: Multiple Use-after-free issues (MFSA 2012-58) (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974,     CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

  - Mozilla: Memory corruption with bitmap format images with negative height (MFSA 2012-61) (CVE-2012-3966)

  - Mozilla: WebGL use-after-free and memory corruption (MFSA 2012-62) (CVE-2012-3967, CVE-2012-3968)

  - Mozilla: SVG buffer overflow and use-after-free issues (MFSA 2012-63) (CVE-2012-3969, CVE-2012-3970)

  - Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65) (CVE-2012-3972)

  - Mozilla: Incorrect site SSL certificate data display (MFSA 2012-69) (CVE-2012-3976)

  - Mozilla: Location object security checks bypassed by chrome code (MFSA 2012-70) (CVE-2012-3978)

  - Mozilla: Web console eval capable of executing chrome-privileged code (MFSA 2012-72) (CVE-2012-3980)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
80609	Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_in_firefox)	Nessus	Solaris Local Security Checks	critical
74729	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1065-1)	Nessus	SuSE Local Security Checks	critical
74725	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1064-1)	Nessus	SuSE Local Security Checks	critical
68607	Oracle Linux 5 / 6 : firefox (ELSA-2012-1210)	Nessus	Oracle Linux Local Security Checks	critical
64132	SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 6763)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
62096	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8269)	Nessus	SuSE Local Security Checks	critical
62062	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox regression (USN-1548-2)	Nessus	Ubuntu Local Security Checks	critical
61989	Mandriva Linux Security Advisory : firefox (MDVSA-2012:145)	Nessus	Mandriva Local Security Checks	critical
61741	FreeBSD : mozilla -- multiple vulnerabilities (2b8cad90-f289-11e1-a215-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	critical
801356	Mozilla SeaMonkey 2.x < 2.12 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801230	Mozilla Firefox 14.x <= 14 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6561	SeaMonkey 2.x < 2.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6559	Mozilla Firefox < 15.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
61730	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1548-1)	Nessus	Ubuntu Local Security Checks	critical
61726	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120829)	Nessus	Scientific Linux Local Security Checks	critical
61721	CentOS 5 / 6 : firefox (CESA-2012:1210)	Nessus	CentOS Local Security Checks	critical
61718	SeaMonkey < 2.12.0 Multiple Vulnerabilities	Nessus	Windows	critical
61715	Firefox < 15.0 Multiple Vulnerabilities	Nessus	Windows	critical
61714	Firefox 10.0.x < 10.0.7 Multiple Vulnerabilities	Nessus	Windows	critical
61711	Firefox < 15.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
61710	Firefox < 10.0.7 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
61704	RHEL 5 / 6 : firefox (RHSA-2012:1210)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2012-3976

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high