An updated firefox package that fixes one security issue is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Mozilla Firefox is an open source web browser.

A race condition flaw was found in the way Firefox handled Document Object Model (DOM) element properties. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
(CVE-2010-3765)

For technical details regarding this flaw, refer to the Mozilla security advisories for Firefox 3.6.12. You can find a link to the Mozilla advisories in the References section of this erratum.

All Firefox users should upgrade to this updated package, which contains a backported patch to correct this issue. After installing the update, Firefox must be restarted for the changes to take effect.

Updated xulrunner packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

XULRunner provides the XUL Runtime environment for applications using the Gecko layout engine.

A race condition flaw was found in the way XULRunner handled Document Object Model (DOM) element properties. Malicious HTML content could cause an application linked against XULRunner (such as Firefox) to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-3765)

For technical details regarding this flaw, refer to the Mozilla security advisories for Firefox 3.6.12. You can find a link to the Mozilla advisories in the References section of this erratum.

All XULRunner users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, applications using XULRunner must be restarted for the changes to take effect.

An updated thunderbird package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A race condition flaw was found in the way Thunderbird handled Document Object Model (DOM) element properties. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-3765)

Note: JavaScript support is disabled by default in Thunderbird. The CVE-2010-3765 issue is not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to this updated package, which resolves this issue. All running instances of Thunderbird must be restarted for the update to take effect.

This update brings Mozilla Firefox to version 3.6.12, fixing various bugs and security issues.

The following security issues were fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. References. (MFSA 2010-64)

    Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor     Bukanov and Josh Soref reported memory safety problems     that affected Firefox 3.6 and Firefox 3.5.

  - Memory safety bugs - Firefox 3.6, Firefox 3.5

  - Gary Kwong, Martijn Wargers and Siddharth Agarwal     reported memory safety problems that affected Firefox     3.6 only. (CVE-2010-3176)

  - Memory safety bugs - Firefox 3.6

  - CVE-2010-3175

  - Security researcher Alexander Miller reported that     passing an excessively long string to document.write     could cause text rendering routines to end up in an     inconsistent state with sections of stack memory being     overwritten with the string data. An attacker could use     this flaw to crash a victim's browser and potentially     run arbitrary code on their computer. (MFSA 2010-65 /     CVE-2010-3179)

  - Security researcher Sergey Glazunov reported that it was     possible to access the locationbar property of a window     object after it had been closed. Since the closed     window's memory could have been subsequently reused by     the system it was possible that an attempt to access the     locationbar property could result in the execution of     attacker-controlled memory. (MFSA 2010-66 /     CVE-2010-3180)

  - Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that when     window.lookupGetter is called with no arguments the code     assumes the top JavaScript stack value is a property     name. Since there were no arguments passed into the     function, the top value could represent uninitialized     memory or a pointer to a previously freed JavaScript     object. Under such circumstances the value is passed to     another subroutine which calls through the dangling     pointer, potentially executing attacker-controlled     memory. (MFSA 2010-67 / CVE-2010-3183)

  - Google security researcher Robert Swiecki reported that     functions used by the Gopher parser to convert text to     HTML tags could be exploited to turn text into     executable JavaScript. If an attacker could create a     file or directory on a Gopher server with the encoded     script as part of its name the script would then run in     a victim's browser within the context of the site. (MFSA     2010-68 / CVE-2010-3177)

  - Security researcher Eduardo Vela Nava reported that if a     web page opened a new window and used a javascript: URL     to make a modal call, such as alert(), then subsequently     navigated the page to a different domain, once the modal     call returned the opener of the window could get access     to objects in the navigated window. This is a violation     of the same-origin policy and could be used by an     attacker to steal information from another web site.
    (MFSA 2010-69 / CVE-2010-3178)

  - Security researcher Richard Moore reported that when an     SSL certificate was created with a common name     containing a wildcard followed by a partial IP address a     valid SSL connection could be established with a server     whose IP address matched the wildcard range by browsing     directly to the IP address. It is extremely unlikely     that such a certificate would be issued by a Certificate     Authority. (MFSA 2010-70 / CVE-2010-3170)

  - Dmitri Gribenko reported that the script used to launch     Mozilla applications on Linux was effectively including     the current working directory in the LDLIBRARYPATH     environment variable. If an attacker was able to place     into the current working directory a malicious shared     library with the same name as a library that the     bootstrapping script depends on the attacker could have     their library loaded instead of the legitimate library.
    (MFSA 2010-71 / CVE-2010-3182)

  - Morten Krokvik of Telenor SOC reported an exploit     targeting particular versions of Firefox 3.6 on Windows     XP that Telenor found while investigating an intrusion     attempt on a customer network. The underlying     vulnerability, however, was present on both the Firefox     3.5 and Firefox 3.6 development branches and affected     all supported platforms. (MFSA 2010-73 / CVE-2010-3765)

A race condition flaw was found in the way Firefox handled Document Object Model (DOM) element properties. Malicious HTML content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3765)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3175, CVE-2010-3176, CVE-2010-3179, CVE-2010-3183, CVE-2010-3180)

A flaw was found in the way the Gopher parser in Firefox converted text into HTML. A malformed file name on a Gopher server could, when accessed by a victim running Firefox, allow arbitrary JavaScript to be executed in the context of the Gopher domain. (CVE-2010-3177)

A same-origin policy bypass flaw was found in Firefox. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim had loaded with Firefox. (CVE-2010-3178)

A flaw was found in the script that launches Firefox. The LD_LIBRARY_PATH variable was appending a '.' character, which could allow a local attacker to execute arbitrary code with the privileges of a different user running Firefox, if that user ran Firefox from within an attacker-controlled directory. (CVE-2010-3182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.11 and 3.6.12.

After installing the update, Firefox must be restarted for the changes to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0809 advisory.

    [1.9.2.11-4.0.1.el5_5]
    - Added xulrunner-oracle-default-prefs.js and removed the corresponding       RedHat one.

    [1.9.2.11-4.el5_5]
    - Add upstream patch for CVE-2010-3765

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0810 :

Updated SeaMonkey packages that fix one security issue are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

A race condition flaw was found in the way SeaMonkey handled Document Object Model (DOM) element properties. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey.
(CVE-2010-3765)

All SeaMonkey users should upgrade to these updated packages, which correct this issue. After installing the update, SeaMonkey must be restarted for the changes to take effect.

ID	Name	Product	Family	Published	Updated	Severity
50799	CentOS 4 : firefox (CESA-2010:0808)	Nessus	CentOS Local Security Checks	11/24/2010	10/6/2025	critical
50800	CentOS 5 : xulrunner (CESA-2010:0809)	Nessus	CentOS Local Security Checks	11/24/2010	10/6/2025	critical
50803	CentOS 4 / 5 : thunderbird (CESA-2010:0812)	Nessus	CentOS Local Security Checks	11/24/2010	10/6/2025	critical
50876	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 3455 / 3456)	Nessus	SuSE Local Security Checks	12/2/2010	10/6/2025	critical
60889	Scientific Linux Security Update : firefox on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	10/6/2025	critical
68128	Oracle Linux 5 : xulrunner (ELSA-2010-0809)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/6/2025	critical
68129	Oracle Linux 3 / 4 : seamonkey (ELSA-2010-0810)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/6/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical