Debian DSA-2124-1 : xulrunner - several vulnerabilities

High Nessus Plugin ID 50453

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 8.9

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in Xulrunner, the component that provides the core functionality of Iceweasel, Debian's variant of Mozilla's browser technology.

The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2010-3765 Xulrunner allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.

- CVE-2010-3174 CVE-2010-3176 Multiple unspecified vulnerabilities in the browser engine in Xulrunner allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

- CVE-2010-3177 Multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser in Xulrunner allow remote attackers to inject arbitrary web script or HTML via a crafted name of a (1) file or (2) directory on a Gopher server.

- CVE-2010-3178 Xulrunner does not properly handle certain modal calls made by javascript: URLs in circumstances related to opening a new window and performing cross-domain navigation, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document.

- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Xulrunner allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a long argument to the document.write method.

- CVE-2010-3180 Use-after-free vulnerability in the nsBarProp function in Xulrunner allows remote attackers to execute arbitrary code by accessing the locationbar property of a closed window.

- CVE-2010-3183 The LookupGetterOrSetter function in Xulrunner does not properly support window.__lookupGetter__ function calls that lack arguments, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted HTML document.

In addition, this security update includes corrections for regressions caused by the fixes for CVE-2010-0654 and CVE-2010-2769 in DSA-2075-1 and DSA-2106-1.

Solution

Upgrade the Xulrunner packages.

For the stable distribution (lenny), these problems have been fixed in version 1.9.0.19-6.

See Also

https://security-tracker.debian.org/tracker/CVE-2010-3765

https://security-tracker.debian.org/tracker/CVE-2010-3174

https://security-tracker.debian.org/tracker/CVE-2010-3176

https://security-tracker.debian.org/tracker/CVE-2010-3177

https://security-tracker.debian.org/tracker/CVE-2010-3178

https://security-tracker.debian.org/tracker/CVE-2010-3179

https://security-tracker.debian.org/tracker/CVE-2010-3180

https://security-tracker.debian.org/tracker/CVE-2010-3183

https://security-tracker.debian.org/tracker/CVE-2010-0654

https://security-tracker.debian.org/tracker/CVE-2010-2769

https://www.debian.org/security/2010/dsa-2124

Plugin Details

Severity: High

ID: 50453

File Name: debian_DSA-2124.nasl

Version: 1.20

Type: local

Agent: unix

Published: 2010/11/03

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 8.9

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:xulrunner, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/11/01

Exploitable With

CANVAS (CANVAS)

Metasploit (Mozilla Firefox Interleaved document.write/appendChild Memory Corruption)

Reference Information

CVE: CVE-2010-3174, CVE-2010-3176, CVE-2010-3177, CVE-2010-3178, CVE-2010-3179, CVE-2010-3180, CVE-2010-3183, CVE-2010-3765

BID: 44246, 44253

DSA: 2124