openSUSE Security Update : MozillaFirefox (MozillaFirefox-1202)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

MozillaFirefox was updated to the 3.0.13 release, fixing some security
issues and bugs :

MFSA 2009-44 / CVE-2009-2654: Security researcher Juan Pablo Lopez
Yacubian reported that an attacker could call window.open() on an
invalid URL which looks similar to a legitimate URL and then use
document.write() to place content within the new document, appearing
to have come from the spoofed location. Additionally, if the spoofed
document was created by a document with a valid SSL certificate, the
SSL indicators would be carried over into the spoofed document. An
attacker could use these issues to display misleading location and SSL
information for a malicious web page.

MFSA 2009-45 / CVE-2009-2662:The browser engine in Mozilla Firefox
before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to
cause a denial of service (memory corruption and application crash) or
possibly execute arbitrary code via vectors related to the
TraceRecorder::snapshot function in js/src/jstracer.cpp, and
unspecified other vectors.

CVE-2009-2663 / MFSA 2009-45: libvorbis before r16182, as used in
Mozilla Firefox before 3.0.13 and 3.5.x before 3.5.2 and other
products, allows context-dependent attackers to cause a denial of
service (memory corruption and application crash) or possibly execute
arbitrary code via a crafted .ogg file.

CVE-2009-2664 / MFSA 2009-45: The js_watch_set function in
js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before
3.0.13, and 3.5.x before 3.5.2, allows remote attackers to cause a
denial of service (assertion failure and application exit) or possibly
execute arbitrary code via a crafted .js file, related to a 'memory
safety bug.'

See also :

https://bugzilla.novell.com/show_bug.cgi?id=527489

Solution :

Update the affected MozillaFirefox packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 40641 ()

Bugtraq ID:

CVE ID: CVE-2009-2654
CVE-2009-2662
CVE-2009-2663
CVE-2009-2664

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now