Ubuntu 4.10 / 5.04 / 5.10 : mozilla vulnerabilities (USN-275-1)
Critical Nessus Plugin ID 21301
SynopsisThe remote Ubuntu host is missing one or more security-related patches.
DescriptionWeb pages with extremely long titles caused subsequent launches of Mozilla browser to hang for up to a few minutes, or caused Mozilla to crash on computers with insufficient memory. (CVE-2005-4134)
Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious website could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0748)
An invalid ordering of table-related tags caused Mozilla to use a negative array index. A malicious website could exploit this to execute arbitrary code with the privileges of the user.
Georgi Guninski discovered that embedded XBL scripts of websites could escalate their (normally reduced) privileges to get full privileges of the user if that page is viewed with 'Print Preview'. (CVE-2006-1727)
The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges.
Claus Jorgensen and Jesse Ruderman discovered that a text input box could be pre-filled with a filename and then turned into a file-upload control with the contents intact. A malicious website could exploit this to read any local file the user has read privileges for.
An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious website could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730)
The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious website could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages.
(CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack.
Michael Krax discovered that by layering a transparent image link to an executable on top of a visible (and presumably desirable) image a malicious site could fool the user to right-click and choose 'Save image as...' from the context menu, which would download the executable instead of the image. (CVE-2006-1736)
Several crashes have been fixed which could be triggered by websites and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
If the user has turned on the 'Entering secure site' modal warning dialog, it was possible to spoof the browser's secure-site indicators (the lock icon and the gold URL field background) by first loading the target secure site in a pop-up window, then changing its location to a different site, which retained the displayed secure-browsing indicators from the original site. (CVE-2006-1740).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected packages.