This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.
The remote Mandriva Linux host is missing one or more security
Security issues were identified and fixed in firefox 3.0.x :
Security researcher Juan Pablo Lopez Yacubian reported that an
attacker could call window.open() on an invalid URL which looks
similar to a legitimate URL and then use document.write() to place
content within the new document, appearing to have come from the
spoofed location (CVE-2009-2654).
Moxie Marlinspike reported a heap overflow vulnerability in the code
that handles regular expressions in certificate names. This
vulnerability could be used to compromise the browser and run
arbitrary code by presenting a specially crafted certificate to the
IOActive security researcher Dan Kaminsky reported a mismatch in the
treatment of domain names in SSL certificates between SSL clients and
the Certificate Authorities (CA) which issue server certificates.
These certificates could be used to intercept and potentially alter
encrypted communication between the client and a server such as
sensitive bank account transactions (CVE-2009-2408).
This update provides the latest Mozilla Firefox 3.0.x to correct these
Additionally, some packages which require so, have been rebuilt and
are being provided as updates.
See also :
Update the affected packages.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 8.1
Public Exploit Available : true
Family: Mandriva Local Security Checks
Nessus Plugin ID: 40523 (mandriva_MDVSA-2009-198.nasl)
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now