SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Web Browser)  >   Mozilla Firefox Vendors:   Mozilla.org
(Red Hat Issues Fix) Mozilla Firefox Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Execute Arbitrary Code
SecurityTracker Alert ID:  1024727
SecurityTracker URL:  http://securitytracker.com/id/1024727
CVE Reference:   CVE-2010-3175, CVE-2010-3176, CVE-2010-3177, CVE-2010-3178, CVE-2010-3179, CVE-2010-3180, CVE-2010-3182, CVE-2010-3183, CVE-2010-3765   (Links to External Site)
Date:  Nov 11 2010
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 3.5.14, 3.6 prior to 3.6.11
Description:   Multiple vulnerabilities were reported in Mozilla Firefox. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can conduct cross-site scripting attacks. A remote user can obtain potentially sensitive information.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger memory corruption errors and execute arbitrary code on the target system [CVE-2010-3174, CVE-2010-3175, CVE-2010-3176]. The code will run with the privileges of the target user.

A specially crafted 'document.write' call can trigger a stack memory error [CVE-2010-3179].

A use-after-free error in nsBarProp can trigger code execution [CVE-2010-3180].

A dangling pointer vulnerability in LookupGetterOrSetter() can trigger code execution [CVE-2010-3183].

Specially crafted Gopher content can cause JavaScript execution when converted to HTML tags [CVE-2010-3177].

A page that opens a new window and uses a javascript: URL to make a modal call can access information from a different domain [CVE-2010-3178].

When an SSL certificate is created with a common name containing a wildcard followed by a partial IP address, the browser can establish a valid SSL connection with a server with an IP address that matches the wildcard range [CVE-2010-3170].

The browser may load external libraries on Windows-based systems using a relative path, allowing a user to conduct binary planting attacks [CVE-2010-3181]. A script on Linux-based systems is also affected [CVE-2010-3182].

A server can use Diffie-Hellman Ephemeral mode (DHE) with too short of a minimum key length [CVE-2010-3173].

Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary Kwong, Martijn Wargers, Siddharth Agarwal, Alexander Miller, Sergey Glazunov, regenrecht (via TippingPoint's Zero Day Initiative), Robert Swiecki, Eduardo Vela Nava, Richard Moore, Ehsan Akhgari, Dmitri Gribenko, and Nelson Bolyard reported these vulnerabilities.
Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user can conduct cross-site scripting attacks.

A remote user can obtain potentially sensitive information.
Solution:   Red Hat has issued a fix for CVE-2010-3175, CVE-2010-3176, CVE-2010-3177, CVE-2010-3178, CVE-2010-3179, CVE-2010-3180, CVE-2010-3182, CVE-2010-3183, and CVE-2010-3765.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2010-0861.html
Vendor URL:  www.mozilla.org/security/announce/2010/mfsa2010-64.html (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 20 2010 Mozilla Firefox Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Execute Arbitrary Code


 Source Message Contents
Date:  Wed, 10 Nov 2010 12:31:57 -0700
Subject:  [RHSA-2010:0861-02] Critical: firefox security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: firefox security update
Advisory ID:       RHSA-2010:0861-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2010-0861.html
Issue date:        2010-11-10
CVE Names:         CVE-2010-3175 CVE-2010-3176 CVE-2010-3177 
                   CVE-2010-3178 CVE-2010-3179 CVE-2010-3180 
                   CVE-2010-3182 CVE-2010-3183 CVE-2010-3765 
=====================================================================

1. Summary:

Updated firefox packages that fix several security issues are now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Mozilla Firefox is an open source web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.

A race condition flaw was found in the way Firefox handled Document Object
Model (DOM) element properties. Malicious HTML content could cause Firefox
to crash or, potentially, execute arbitrary code with the privileges of the
user running Firefox. (CVE-2010-3765)

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2010-3175, CVE-2010-3176, CVE-2010-3179, CVE-2010-3183,
CVE-2010-3180)

A flaw was found in the way the Gopher parser in Firefox converted text
into HTML. A malformed file name on a Gopher server could, when accessed by
a victim running Firefox, allow arbitrary JavaScript to be executed in the
context of the Gopher domain. (CVE-2010-3177)

A same-origin policy bypass flaw was found in Firefox. An attacker could
create a malicious web page that, when viewed by a victim, could steal
private data from a different website the victim had loaded with Firefox.
(CVE-2010-3178)

A flaw was found in the script that launches Firefox. The LD_LIBRARY_PATH
variable was appending a "." character, which could allow a local attacker
to execute arbitrary code with the privileges of a different user running
Firefox, if that user ran Firefox from within an attacker-controlled
directory. (CVE-2010-3182)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 3.6.11 and 3.6.12. You can find links to the Mozilla
advisories in the References section of this erratum.

All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.6.12, which corrects these issues. After installing the
update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

642272 - CVE-2010-3176 Mozilla miscellaneous memory safety hazards
642275 - CVE-2010-3175 Mozilla miscellaneous memory safety hazards
642277 - CVE-2010-3179 Mozilla buffer overflow and memory corruption using document.write
642283 - CVE-2010-3180 Mozilla use-after-free error in nsBarProp
642286 - CVE-2010-3183 Mozilla dangling pointer vulnerability in LookupGetterOrSetter
642290 - CVE-2010-3177 Mozilla XSS in gopher parser when parsing hrefs
642294 - CVE-2010-3178 Mozilla cross-site information disclosure via modal calls
642300 - CVE-2010-3182 Mozilla unsafe library loading flaw
646997 - CVE-2010-3765 Firefox race condition flaw (MFSA 2010-73)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-3.6.12-1.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
firefox-3.6.12-1.el6_0.i686.rpm
firefox-debuginfo-3.6.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm

x86_64:
firefox-3.6.12-1.el6_0.x86_64.rpm
firefox-debuginfo-3.6.12-1.el6_0.x86_64.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

x86_64:
firefox-3.6.12-1.el6_0.x86_64.rpm
firefox-debuginfo-3.6.12-1.el6_0.x86_64.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-3.6.12-1.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
firefox-3.6.12-1.el6_0.i686.rpm
firefox-debuginfo-3.6.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm

ppc64:
firefox-3.6.12-1.el6_0.ppc64.rpm
firefox-debuginfo-3.6.12-1.el6_0.ppc64.rpm
xulrunner-1.9.2.12-1.el6_0.ppc.rpm
xulrunner-1.9.2.12-1.el6_0.ppc64.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.ppc.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.ppc64.rpm

s390x:
firefox-3.6.12-1.el6_0.s390x.rpm
firefox-debuginfo-3.6.12-1.el6_0.s390x.rpm
xulrunner-1.9.2.12-1.el6_0.s390.rpm
xulrunner-1.9.2.12-1.el6_0.s390x.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.s390.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.s390x.rpm

x86_64:
firefox-3.6.12-1.el6_0.x86_64.rpm
firefox-debuginfo-3.6.12-1.el6_0.x86_64.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm

ppc64:
xulrunner-debuginfo-1.9.2.12-1.el6_0.ppc.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.ppc64.rpm
xulrunner-devel-1.9.2.12-1.el6_0.ppc.rpm
xulrunner-devel-1.9.2.12-1.el6_0.ppc64.rpm

s390x:
xulrunner-debuginfo-1.9.2.12-1.el6_0.s390.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.s390x.rpm
xulrunner-devel-1.9.2.12-1.el6_0.s390.rpm
xulrunner-devel-1.9.2.12-1.el6_0.s390x.rpm

x86_64:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-3.6.12-1.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
firefox-3.6.12-1.el6_0.i686.rpm
firefox-debuginfo-3.6.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm

x86_64:
firefox-3.6.12-1.el6_0.x86_64.rpm
firefox-debuginfo-3.6.12-1.el6_0.x86_64.rpm
xulrunner-1.9.2.12-1.el6_0.i686.rpm
xulrunner-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.12-1.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.12-1.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.12-1.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.12-1.el6_0.i686.rpm
xulrunner-devel-1.9.2.12-1.el6_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-3175.html
https://www.redhat.com/security/data/cve/CVE-2010-3176.html
https://www.redhat.com/security/data/cve/CVE-2010-3177.html
https://www.redhat.com/security/data/cve/CVE-2010-3178.html
https://www.redhat.com/security/data/cve/CVE-2010-3179.html
https://www.redhat.com/security/data/cve/CVE-2010-3180.html
https://www.redhat.com/security/data/cve/CVE-2010-3182.html
https://www.redhat.com/security/data/cve/CVE-2010-3183.html
https://www.redhat.com/security/data/cve/CVE-2010-3765.html
http://www.redhat.com/security/updates/classification/#critical
http://www.mozilla.com/en-US/firefox/3.6.11/releasenotes/
http://www.mozilla.com/en-US/firefox/3.6.12/releasenotes/
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.11
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.12

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2010 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFM2vMWXlSAg2UNWIIRApOkAJsHsYKuJS6rZV/wiB/t3rVMmXCSCQCfdcZe
msXDY+N3K39YWrJoxpY7dLM=
=xA4/
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2013, SecurityGlobal.net LLC