Mandriva Linux Security Advisory : firefox (MDVSA-2009:290-1)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Security issues were identified and fixed in firefox 3.0.x :

Security researcher Alin Rad Pop of Secunia Research reported a
heap-based buffer overflow in Mozilla's string to floating point
number conversion routines. Using this vulnerability an attacker could
craft some malicious JavaScript code containing a very long string to
be converted to a floating point number which would result in improper
memory allocation and the execution of an arbitrary memory location.
This vulnerability could thus be leveraged by the attacker to run
arbitrary code on a victim's computer (CVE-2009-1563).

Security researcher Jeremy Brown reported that the file naming scheme
used for downloading a file which already exists in the downloads
folder is predictable. If an attacker had local access to a victim's
computer and knew the name of a file the victim intended to open
through the Download Manager, he could use this vulnerability to place
a malicious file in the world-writable directory used to save
temporary downloaded files and cause the browser to choose the
incorrect file when opening it. Since this attack requires local
access to the victim's machine, the severity of this vulnerability was
determined to be low (CVE-2009-3274).

Security researcher Paul Stone reported that a user's form history,
both from web content as well as the smart location bar, was
vulnerable to theft. A malicious web page could synthesize events such
as mouse focus and key presses on behalf of the victim and trick the
browser into auto-filling the form fields with history entries and
then reading the entries (CVE-2009-3370).

Security researcher Marco C. reported a flaw in the parsing of regular
expressions used in Proxy Auto-configuration (PAC) files. In certain
cases this flaw could be used by an attacker to crash a victim's
browser and run arbitrary code on their computer. Since this
vulnerability requires the victim to have PAC configured in their
environment with specific regular expresssions which can trigger the
crash, the severity of the issue was determined to be moderate
(CVE-2009-3372).

Security research firm iDefense reported that researcher regenrecht
discovered a heap-based buffer overflow in Mozilla's GIF image parser.
This vulnerability could potentially be used by an attacker to crash a
victim's browser and run arbitrary code on their computer
(CVE-2009-3373).

Mozilla security researcher moz_bug_r_a4 reported that the XPCOM
utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects
before returning them to chrome callers. This could result in chrome
privileged code calling methods on an object which had previously been
created or modified by web content, potentially executing malicious
JavaScript code with chrome privileges (CVE-2009-3374).

Security researcher Gregory Fleischer reported that text within a
selection on a web page can be read by JavaScript in a different
domain using the document.getSelection function, violating the
same-origin policy. Since this vulnerability requires user interaction
to exploit, its severity was determined to be moderate
(CVE-2009-3375).

Mozilla security researchers Jesse Ruderman and Sid Stamm reported
that when downloading a file containing a right-to-left override
character (RTL) in the filename, the name displayed in the dialog
title bar conflicts with the name of the file shown in the dialog
body. An attacker could use this vulnerability to obfuscate the name
and file extension of a file to be downloaded and opened, potentially
causing a user to run an executable file when they expected to open a
non-executable file (CVE-2009-3376).

Mozilla developers and community members identified and fixed several
stability bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these crashes showed evidence of
memory corruption under certain circumstances and we presume that with
enough effort at least some of these could be exploited to run
arbitrary code. Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers,
Daniel Banchero, David Keeler, and Boris Zbarsky reported crashes in
the browser engine which affected both Firefox 3 and Firefox 3.5
(CVE-2009-3380). Carsten Book reported a crash in the browser engine
which affected only Firefox 3 (CVE-2009-3382).

This update provides the latest Mozilla Firefox 3.0.x to correct these
issues.

Additionally, some packages which require so, have been rebuilt and
are being provided as updates.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers

See also :

http://www.nessus.org/u?86e96787

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now