Text 12375, 256 rader
Skriven 2006-08-03 16:12:28 av Geo. (1:379/45)
Ärende: firefox
===============
From: "Geo." <geo@nls.net>

less secure than IE, now there is an acheivement!

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 200608-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal

Title: Mozilla Firefox: Multiple vulnerabilities

Date: August 03, 2006

Bugs: #141842

ID: 200608-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis

========

The Mozilla Foundation has reported numerous security vulnerabilities

related to Mozilla Firefox.

Background

==========

Mozilla Firefox is a redesign of the Mozilla Navigator component. The

goal is to produce a cross-platform stand-alone browser application.

Affected packages

=================

-------------------------------------------------------------------

Package / Vulnerable / Unaffected

-------------------------------------------------------------------

1 www-client/mozilla-firefox < 1.5.0.5 >= 1.5.0.5

2 www-client/mozilla-firefox-bin < 1.5.0.5 >= 1.5.0.5

-------------------------------------------------------------------

2 affected packages on all of their supported architectures.

-------------------------------------------------------------------

Description

===========

The following vulnerabilities have been reported:

* Benjamin Smedberg discovered that chrome URL's could be made to

reference remote files.

* Developers in the Mozilla community looked for and fixed several

crash bugs to improve the stability of Mozilla clients.

* "shutdown" reports that cross-site scripting (XSS) attacks could be

performed using the construct XPCNativeWrapper(window).Function(...),

which created a function that appeared to belong to the window in

question even after it had been navigated to the target site.

* "shutdown" reports that scripts granting the UniversalBrowserRead

privilege can leverage that into the equivalent of the far more

powerful UniversalXPConnect since they are allowed to "read" into a

privileged context.

* "moz_bug_r_a4" reports that A malicious Proxy AutoConfig (PAC)

server could serve a PAC script that can execute code with elevated

privileges by setting the required FindProxyForURL function to the

eval method on a privileged object that leaked into the PAC sandbox.

* "moz_bug_r_a4" discovered that Named JavaScript functions have a

parent object created using the standard Object() constructor

(ECMA-specified behavior) and that this constructor can be redefined

by script (also ECMA-specified behavior).

* Igor Bukanov and shutdown found additional places where an untimely

garbage collection could delete a temporary object that was in active

use.

* Georgi Guninski found potential integer overflow issues with long

strings in the toSource() methods of the Object, Array and String

objects as well as string function arguments.

* H. D. Moore reported a testcase that was able to trigger a race

condition where JavaScript garbage collection deleted a temporary

variable still being used in the creation of a new Function object.

* A malicious page can hijack native DOM methods on a document object

in another domain, which will run the attacker's script when called

by the victim page.

* Secunia Research has discovered a vulnerability which is caused due

to an memory corruption error within the handling of simultaneously

happening XPCOM events. This leads to use of a deleted timer object.

* An anonymous researcher for TippingPoint and the Zero Day

Initiative showed that when used in a web page Java would reference

properties of the window.navigator object as it started up.

* Thilo Girmann discovered that in certain circumstances a JavaScript

reference to a frame or window was not properly cleared when the

referenced content went away.

Impact

======

A user can be enticed to open specially crafted URLs, visit webpages

containing malicious JavaScript or execute a specially crafted script.

These events could lead to the execution of arbitrary code, or the

installation of malware on the user's computer.

Workaround

==========

There is no known workaround at this time.

Resolution

==========

All Mozilla Firefox users should upgrade to the latest version:

# emerge --sync

# emerge --ask --oneshot --verbose

">=www-client/mozilla-firefox-1.5.0.5"

Users of the binary package should upgrade as well:

# emerge --sync

# emerge --ask --oneshot --verbose

">=www-client/mozilla-firefox-bin-1.5.0.5"

References

==========

[ 1 ] CVE-2006-3113

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113

[ 2 ] CVE-2006-3677

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677

[ 3 ] CVE-2006-3801

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801

[ 4 ] CVE-2006-3802

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802

[ 5 ] CVE-2006-3803

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803

[ 6 ] CVE-2006-3805

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805

[ 7 ] CVE-2006-3806

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806

[ 8 ] CVE-2006-3807

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807

[ 9 ] CVE-2006-3808

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808

[ 10 ] CVE-2006-3809

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809

[ 11 ] CVE-2006-3810

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810

[ 12 ] CVE-2006-3811

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811

[ 13 ] CVE-2006-3812

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812

Availability

============

This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200608-03.xml

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)