SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 656)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing one or more security updates.

Description :

The Mozilla Firefox browser is updated to version 3.0.7 fixing various
security and stability issues.

- Mozilla developers identified and fixed several
stability bugs in the browser engine used in Firefox and
other Mozilla-based products. Some of these crashes
showed evidence of memory corruption under certain
circumstances and we presume that with enough effort at
least some of these could be exploited to run arbitrary
code. (MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 /
CVE-2009-0773 / CVE-2009-0774)

- An anonymous researcher, via TippingPoint's Zero Day
Initiative program, reported a vulnerability in
Mozilla's garbage collection process. The vulnerability
was caused by improper memory management of a set of
cloned XUL DOM elements which were linked as a parent
and child. After reloading the browser on a page with
such linked elements, the browser would crash when
attempting to access an object which was already
destroyed. An attacker could use this crash to run
arbitrary code on the victim's computer. (MFSA 2009-08 /
CVE-2009-0775)

- Mozilla security researcher Georgi Guninski reported
that a website could use nsIRDFService and a
cross-domain redirect to steal arbitrary XML data from
another domain, a violation of the same-origin policy.
This vulnerability could be used by a malicious website
to steal private data from users authenticated to the
redirected website. (MFSA 2009-09 / CVE-2009-0776)

- libpng maintainer Glenn Randers-Pehrson reported several
memory safety hazards in PNG libraries used by Mozilla.
These vulnerabilities could be used by a malicious
website to crash a victim's browser and potentially
execute arbitrary code on their computer. libpng was
upgraded to a version which contained fixes for these
flaws. (MFSA 2009-10 / CVE-2009-0040)

- Mozilla contributor Masahiro Yamada reported that
certain invisible control characters were being decoded
when displayed in the location bar, resulting in fewer
visible characters than were present in the actual
location. An attacker could use this vulnerability to
spoof the location bar and display a misleading URL for
their malicious web page. (MFSA 2009-11 / CVE-2009-0777)

See also :

http://www.mozilla.org/security/announce/2009/mfsa2009-07.html
http://www.mozilla.org/security/announce/2009/mfsa2009-08.html
http://www.mozilla.org/security/announce/2009/mfsa2009-09.html
http://www.mozilla.org/security/announce/2009/mfsa2009-10.html
http://www.mozilla.org/security/announce/2009/mfsa2009-11.html
https://bugzilla.novell.com/show_bug.cgi?id=465284
https://bugzilla.novell.com/show_bug.cgi?id=478625
https://bugzilla.novell.com/show_bug.cgi?id=479610
http://support.novell.com/security/cve/CVE-2009-0040.html
http://support.novell.com/security/cve/CVE-2009-0771.html
http://support.novell.com/security/cve/CVE-2009-0772.html
http://support.novell.com/security/cve/CVE-2009-0773.html
http://support.novell.com/security/cve/CVE-2009-0774.html
http://support.novell.com/security/cve/CVE-2009-0775.html
http://support.novell.com/security/cve/CVE-2009-0776.html
http://support.novell.com/security/cve/CVE-2009-0777.html

Solution :

Apply SAT patch number 656.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 41352 ()

Bugtraq ID:

CVE ID: CVE-2009-0040
CVE-2009-0771
CVE-2009-0772
CVE-2009-0773
CVE-2009-0774
CVE-2009-0775
CVE-2009-0776
CVE-2009-0777

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now