Firefox < 3.0.8 Multiple Vulnerabilities

High Log Correlation Engine Plugin ID 800774

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

The installed version of Firefox is earlier than 3.0.8. Such versions are potentially affected by the following security issues :

- An XSL transformation vulnerability can be leveraged with a specially crafted stylesheet to crash the browser or to execute arbitrary code. (MFSA 2009-12)

- An error in the XUL tree method '_moveToEdgeShift()' can be leveraged to trigger garbage collection routines on objects that are still in use, leading to a browser crash and possibly execution of arbitrary code. (MFSA 2009-13)

Solution

Upgrade to version 3.0.8 or higher.

See Also

http://www.mozilla.org/security/announce/2009/mfsa2009-13.html

http://www.mozilla.com/en-US/firefox/3.0.8/releasenotes

http://www.mozilla.org/security/announce/2009/mfsa2009-12.html

Plugin Details

Severity: High

ID: 800774

File Name: 800774.prm

Family: Web Clients

Nessus ID: 36045

Risk Information

Risk Factor: High

CVSSv2

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Reference Information

CVE: CVE-2009-1044, CVE-2009-1169

BID: 34181, 34235