Mozilla Firefox May Disclose Files or Information to Remote Users
|
|
SecurityTracker Alert ID: 1018837
|
|
SecurityTracker URL: http://securitytracker.com/id?1018837
|
|
CVE Reference: CVE-2006-2894
, CVE-2007-1095
, CVE-2007-3511
, CVE-2007-5334
, CVE-2007-5337
(Links to External Site)
|
Updated: Oct 19 2007
|
Original Entry Date: Oct 19 2007
|
Impact: Disclosure of system information, Disclosure of user information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Mozilla Foundation Security Advisory
|
Version(s): prior to 2.0.0.8
|
Description: A vulnerability was reported in Mozilla Firefox. A remote user may be able to obtain certain files or information from the target user's system. A remote user may be able to spoof elements of the browser interface.
A remote user can create HTML that, when loaded by the target user, will obtain files or information.
OnUnload event handlers
can access to the address of certain other pages [CVE-2007-1095]. A remote user can exploit this to obtain bookmarks.
A file
upload control can be automatically filled out by a remote user to steal known files from the target user's system [CVE-2006-2894,
CVE-2007-3511].
An XUL markup language page can hide the page window's titlebar [CVE-2007-5334].
A remote user can create
a page on an SMB share or SFTP site that, when loaded by the target user, will access files on the target system with the privileges
of the target user [CVE-2007-5337]. Linux machines with gnome-vfs are affected.
Michal Zalewski, hong, Eli Friedman, and Georgi
Guninski reported these vulnerabilities.
|
Impact: A remote user obtain certain files or information from the target user's system.
A remote user can spoof elements of the browser interface.
|
Solution: The vendor has issued a fixed version (2.0.0.8).
The Mozilla advisories are available at:
http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.
mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa200
7-34.html
|
Vendor URL: www.mozilla.org/security/announce/2007/mfsa2007-34.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 18 Oct 2007 23:34:31 -0400
Subject: Mozilla Firefox
|
http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html
CVE-2007-1095
CVE-2007-3511
CVE-2006-2894
CVE-2007-5334
CVE-2007-5337
|
|
