[ MDVSA-2009:290-1 ] firefox

[dude67]

_______________________________________________________________________

Package : firefox
Date : December 2, 2009
Affected: 2008.0
_______________________________________________________________________

Problem Description:

Security issues were identified and fixed in firefox 3.0.x:

Security researcher Alin Rad Pop of Secunia Research reported a
heap-based buffer overflow in Mozilla's string to floating point
number conversion routines. Using this vulnerability an attacker
could craft some malicious JavaScript code containing a very long
string to be converted to a floating point number which would result
in improper memory allocation and the execution of an arbitrary memory
location. This vulnerability could thus be leveraged by the attacker
to run arbitrary code on a victim's computer (CVE-2009-1563).

Security researcher Jeremy Brown reported that the file naming scheme
used for downloading a file which already exists in the downloads
folder is predictable. If an attacker had local access to a victim's
computer and knew the name of a file the victim intended to open
through the Download Manager, he could use this vulnerability to
place a malicious file in the world-writable directory used to save
temporary downloaded files and cause the browser to choose the
incorrect file when opening it. Since this attack requires local
access to the victim's machine, the severity of this vulnerability
was determined to be low (CVE-2009-3274).

Security researcher Paul Stone reported that a user's form history,
both from web content as well as the smart location bar, was vulnerable
to theft. A malicious web page could synthesize events such as mouse
focus and key presses on behalf of the victim and trick the browser
into auto-filling the form fields with history entries and then
reading the entries (CVE-2009-3370).

Security researcher Marco C. reported a flaw in the parsing of regular
expressions used in Proxy Auto-configuration (PAC) files. In certain
cases this flaw could be used by an attacker to crash a victim's
browser and run arbitrary code on their computer. Since this
vulnerability requires the victim to have PAC configured in their
environment with specific regular expresssions which can trigger
the crash, the severity of the issue was determined to be moderate
(CVE-2009-3372).

Security research firm iDefense reported that researcher regenrecht
discovered a heap-based buffer overflow in Mozilla's GIF image
parser. This vulnerability could potentially be used by an attacker
to crash a victim's browser and run arbitrary code on their computer
(CVE-2009-3373).

Mozilla security researcher moz_bug_r_a4 reported that the XPCOM
utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects
before returning them to chrome callers. This could result in chrome
privileged code calling methods on an object which had previously been
created or modified by web content, potentially executing malicious
JavaScript code with chrome privileges (CVE-2009-3374).

Security researcher Gregory Fleischer reported that text within a
selection on a web page can be read by JavaScript in a different domain
using the document.getSelection function, violating the same-origin
policy. Since this vulnerability requires user interaction to exploit,
its severity was determined to be moderate (CVE-2009-3375).

Mozilla security researchers Jesse Ruderman and Sid Stamm reported
that when downloading a file containing a right-to-left override
character (RTL) in the filename, the name displayed in the dialog
title bar conflicts with the name of the file shown in the dialog
body. An attacker could use this vulnerability to obfuscate the name
and file extension of a file to be downloaded and opened, potentially
causing a user to run an executable file when they expected to open
a non-executable file (CVE-2009-3376).

Mozilla developers and community members identified and fixed
several stability bugs in the browser engine used in Firefox and
other Mozilla-based products. Some of these crashes showed evidence
of memory corruption under certain circumstances and we presume that
with enough effort at least some of these could be exploited to run
arbitrary code. Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers,
Daniel Banchero, David Keeler, and Boris Zbarsky reported crashes
in the browser engine which affected both Firefox 3 and Firefox 3.5
(CVE-2009-3380). Carsten Book reported a crash in the browser engine
which affected only Firefox 3 (CVE-2009-3382).

This update provides the latest Mozilla Firefox 3.0.x to correct
these issues.

Additionally, some packages which require so, have been rebuilt and
are being provided as updates.

Update:

Packages for 2008.0 are being provided due to extended support for
Corporate products.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1563
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3274
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3370
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3372
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3373
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3374
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3375
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3376
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3380
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3382
http://www.mozilla.org/security/known-v ... efox3.0.15
_______________________________________________________________________