openSUSE Security Update : MozillaFirefox (MozillaFirefox-591)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

The Mozilla Firefox browser is updated to version 3.0.7 fixing various
security and stability issues.

MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 / CVE-2009-0773 /
CVE-2009-0774: Mozilla developers identified and fixed several
stability bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these crashes showed evidence of
memory corruption under certain circumstances and we presume that with
enough effort at least some of these could be exploited to run
arbitrary code.

MFSA 2009-08 / CVE-2009-0775: An anonymous researcher, via
TippingPoint's Zero Day Initiative program, reported a vulnerability
in Mozilla's garbage collection process. The vulnerability was caused
by improper memory management of a set of cloned XUL DOM elements
which were linked as a parent and child. After reloading the browser
on a page with such linked elements, the browser would crash when
attempting to access an object which was already destroyed. An
attacker could use this crash to run arbitrary code on the victim's
computer.

MFSA 2009-09 / CVE-2009-0776: Mozilla security researcher Georgi
Guninski reported that a website could use nsIRDFService and a
cross-domain redirect to steal arbitrary XML data from another domain,
a violation of the same-origin policy. This vulnerability could be
used by a malicious website to steal private data from users
authenticated to the redirected website.

MFSA 2009-10 / CVE-2009-0040: libpng maintainer Glenn Randers-Pehrson
reported several memory safety hazards in PNG libraries used by
Mozilla. These vulnerabilities could be used by a malicious website to
crash a victim's browser and potentially execute arbitrary code on
their computer. libpng was upgraded to a version which contained fixes
for these flaws.

MFSA 2009-11 / CVE-2009-0777: Mozilla contributor Masahiro Yamada
reported that certain invisible control characters were being decoded
when displayed in the location bar, resulting in fewer visible
characters than were present in the actual location. An attacker could
use this vulnerability to spoof the location bar and display a
misleading URL for their malicious web page.

See also :

https://bugzilla.novell.com/show_bug.cgi?id=465284
https://bugzilla.novell.com/show_bug.cgi?id=478625
https://bugzilla.novell.com/show_bug.cgi?id=479610

Solution :

Update the affected MozillaFirefox packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 40170 ()

Bugtraq ID:

CVE ID: CVE-2009-0040
CVE-2009-0771
CVE-2009-0772
CVE-2009-0773
CVE-2009-0774
CVE-2009-0775
CVE-2009-0776
CVE-2009-0777

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now