Fedora Core 4 : firefox-1.0.8-1.1.fc4 (2006-410)

Critical Nessus Plugin ID 21250


The remote Fedora Core host is missing a security update.


Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox.
(CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740)

A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected firefox and / or firefox-debuginfo packages.

See Also


Plugin Details

Severity: Critical

ID: 21250

File Name: fedora_2006-410.nasl

Version: $Revision: 1.14 $

Type: local

Agent: unix

Published: 2006/04/21

Modified: 2016/12/08

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:firefox, p-cpe:/a:fedoraproject:fedora:firefox-debuginfo, cpe:/o:fedoraproject:fedora_core:4

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2006/04/18

Reference Information

CVE: CVE-2006-0749, CVE-2006-1724, CVE-2006-1727, CVE-2006-1728, CVE-2006-1729, CVE-2006-1730, CVE-2006-1731, CVE-2006-1732, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1740, CVE-2006-1741, CVE-2006-1742, CVE-2006-1790

FEDORA: 2006-410

CWE: 20, 79, 119, 189, 264, 399