Fedora Core 3 : firefox-1.0.6-1.1.fc3 (2005-603)
High Nessus Plugin ID 19260
SynopsisThe remote Fedora Core host is missing a security update.
DescriptionMozilla Firefox is an open source Web browser.
A bug was found in the way Firefox set an image as the desktop wallpaper. If a user chooses the 'Set As Wallpaper...' context menu item on a specially crafted image, it is possible for an attacker to execute arbitrary code on a victim's machine. (CVE-2005-2262)
A bug was found in the way Firefox installed its extensions. If a user can be tricked into visiting a malicious web page, it may be possible to obtain sensitive information such as cookies or passwords.
A bug was found in the way Firefox handled multiple frame domains. It is possible for a frame as part of a malicious website to inject content into a frame that belongs to another domain. This issue was previously fixed as CVE-2004-0718 but was accidentally disabled.
A bug was found in the way Firefox handled child frames. It is possible for a malicious framed page to steal sensitive information from its parent page. (CVE-2005-2266)
A bug was found in the way Firefox cloned base objects. It is possible for Web content to navigate up the prototype chain to gain access to privileged chrome objects. (CVE-2005-2270)
Users of Firefox are advised to upgrade to this updated package that contains Firefox version 1.0.6 and is not vulnerable to these issues.
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected firefox and / or firefox-debuginfo packages.