The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues.

The following security issues have been fixed :

  - Security researcher Paul Stone reported that a user's     form history, both from web content as well as the smart     location bar, was vulnerable to theft. A malicious web     page could synthesize events such as mouse focus and key     presses on behalf of the victim and trick the browser     into auto-filling the form fields with history entries     and then reading the entries. (MFSA 2009-52 /     CVE-2009-3370)

  - Security researcher Jeremy Brown reported that the file     naming scheme used for downloading a file which already     exists in the downloads folder is predictable. If an     attacker had local access to a victim's computer and     knew the name of a file the victim intended to open     through the Download Manager, he could use this     vulnerability to place a malicious file in the     world-writable directory used to save temporary     downloaded files and cause the browser to choose the     incorrect file when opening it. Since this attack     requires local access to the victim's machine, the     severity of this vulnerability was determined to be low.
    (MFSA 2009-53 / CVE-2009-3274)

  - Security researcher Orlando Berrera of Sec Theory     reported that recursive creation of JavaScript     web-workers can be used to create a set of objects whose     memory could be freed prior to their use. These     conditions often result in a crash which could     potentially be used by an attacker to run arbitrary code     on a victim's computer. (MFSA 2009-54 / CVE-2009-3371)

  - Security researcher Marco C. reported a flaw in the     parsing of regular expressions used in Proxy     Auto-configuration (PAC) files. In certain cases this     flaw could be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. Since     this vulnerability requires the victim to have PAC     configured in their environment with specific regular     expresssions which can trigger the crash, the severity     of the issue was determined to be moderate. (MFSA     2009-55 / CVE-2009-3372)

  - Security research firm iDefense reported that researcher     regenrecht discovered a heap-based buffer overflow in     Mozilla's GIF image parser. This vulnerability could     potentially be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. (MFSA     2009-56 / CVE-2009-3373)

  - Mozilla security researcher moz_bug_r_a4 reported that     the XPCOM utility XPCVariant::VariantDataToJS unwrapped     doubly-wrapped objects before returning them to chrome     callers. This could result in chrome privileged code     calling methods on an object which had previously been     created or modified by web content, potentially     executing malicious JavaScript code with chrome     privileges. (MFSA 2009-57 / CVE-2009-3374)

  - Security researcher Alin Rad Pop of Secunia Research     reported a heap-based buffer overflow in Mozilla's     string to floating point number conversion routines.
    Using this vulnerability an attacker could craft some     malicious JavaScript code containing a very long string     to be converted to a floating point number which would     result in improper memory allocation and the execution     of an arbitrary memory location. This vulnerability     could thus be leveraged by the attacker to run arbitrary     code on a victim's computer. (MFSA 2009-59 /     CVE-2009-1563)

  - Security researcher Gregory Fleischer reported that text     within a selection on a web page can be read by     JavaScript in a different domain using the     document.getSelection function, violating the     same-origin policy. Since this vulnerability requires     user interaction to exploit, its severity was determined     to be moderate. (MFSA 2009-61 / CVE-2009-3375)

  - Mozilla security researchers Jesse Ruderman and Sid     Stamm reported that when downloading a file containing a     right-to-left override character (RTL) in the filename,     the name displayed in the dialog title bar conflicts     with the name of the file shown in the dialog body. An     attacker could use this vulnerability to obfuscate the     name and file extension of a file to be downloaded and     opened, potentially causing a user to run an executable     file when they expected to open a non-executable file.
    (MFSA 2009-62 / CVE-2009-3376)

  - Mozilla upgraded several thirdparty libraries used in     media rendering to address multiple memory safety and     stability bugs identified by members of the Mozilla     community. Some of the bugs discovered could potentially     be used by an attacker to crash a victim's browser and     execute arbitrary code on their computer. liboggz,     libvorbis, and liboggplay were all upgraded to address     these issues. Audio and video capabilities were added in     Firefox 3.5 so prior releases of Firefox were not     affected. Georgi Guninski reported a crash in liboggz.
    (CVE-2009-3377), Lucas Adamski, Matthew Gregan, David     Keeler, and Dan Kaminsky reported crashes in libvorbis.
    (CVE-2009-3379), Juan Becerra reported a crash in     liboggplay. (CVE-2009-3378). (MFSA 2009-63 /     CVE-2009-3377 / CVE-2009-3379 / CVE-2009-3378)

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-64 / CVE-2009-3380 /     CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383)

a. Update for Service Console packages nss and nspr

   Service console packages for Network Security Services (NSS) and    NetScape Portable Runtime (NSPR) are updated to versions    nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This    patch fixes several security issues in the service console    packages for NSS and NSPR.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-2409, CVE-2009-2408, CVE-2009-2404,    CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372,    CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376,    CVE-2009-3380, and CVE-2009-3382 to these issues.

Mozilla Foundation reports :

MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)

MFSA 2009-63 Upgrade media libraries to fix memory safety bugs

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-61 Cross-origin data theft through document.getSelection()

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()

MFSA 2009-56 Heap buffer overflow in GIF color map parser

MFSA 2009-55 Crash in proxy auto-configuration regexp parsing

MFSA 2009-54 Crash with recursive web-worker calls

MFSA 2009-53 Local downloaded file tampering

MFSA 2009-52 Form history vulnerable to stealing

The Mozilla XULRunner engine was updated to version 1.9.0.15 to fix various bugs and security issues.

The following security issues have been fixed :

  - Security researcher Paul Stone reported that a user's     form history, both from web content as well as the smart     location bar, was vulnerable to theft. A malicious web     page could synthesize events such as mouse focus and key     presses on behalf of the victim and trick the browser     into auto-filling the form fields with history entries     and then reading the entries. (MFSA 2009-52 /     CVE-2009-3370)

  - Security researcher Jeremy Brown reported that the file     naming scheme used for downloading a file which already     exists in the downloads folder is predictable. If an     attacker had local access to a victim's computer and     knew the name of a file the victim intended to open     through the Download Manager, he could use this     vulnerability to place a malicious file in the     world-writable directory used to save temporary     downloaded files and cause the browser to choose the     incorrect file when opening it. Since this attack     requires local access to the victim's machine, the     severity of this vulnerability was determined to be low.
    (MFSA 2009-53 / CVE-2009-3274)

  - Security researcher Orlando Berrera of Sec Theory     reported that recursive creation of JavaScript     web-workers can be used to create a set of objects whose     memory could be freed prior to their use. These     conditions often result in a crash which could     potentially be used by an attacker to run arbitrary code     on a victim's computer. (MFSA 2009-54 / CVE-2009-3371)

  - Security researcher Marco C. reported a flaw in the     parsing of regular expressions used in Proxy     Auto-configuration (PAC) files. In certain cases this     flaw could be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. Since     this vulnerability requires the victim to have PAC     configured in their environment with specific regular     expresssions which can trigger the crash, the severity     of the issue was determined to be moderate. (MFSA     2009-55 / CVE-2009-3372)

  - Security research firm iDefense reported that researcher     regenrecht discovered a heap-based buffer overflow in     Mozilla's GIF image parser. This vulnerability could     potentially be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. (MFSA     2009-56 / CVE-2009-3373)

  - Mozilla security researcher moz_bug_r_a4 reported that     the XPCOM utility XPCVariant::VariantDataToJS unwrapped     doubly-wrapped objects before returning them to chrome     callers. This could result in chrome privileged code     calling methods on an object which had previously been     created or modified by web content, potentially     executing malicious JavaScript code with chrome     privileges. (MFSA 2009-57 / CVE-2009-3374)

  - Security researcher Alin Rad Pop of Secunia Research     reported a heap-based buffer overflow in Mozilla's     string to floating point number conversion routines.
    Using this vulnerability an attacker could craft some     malicious JavaScript code containing a very long string     to be converted to a floating point number which would     result in improper memory allocation and the execution     of an arbitrary memory location. This vulnerability     could thus be leveraged by the attacker to run arbitrary     code on a victim's computer. (MFSA 2009-59 /     CVE-2009-1563)

  - Security researcher Gregory Fleischer reported that text     within a selection on a web page can be read by     JavaScript in a different domain using the     document.getSelection function, violating the     same-origin policy. Since this vulnerability requires     user interaction to exploit, its severity was determined     to be moderate. (MFSA 2009-61 / CVE-2009-3375)

  - Mozilla security researchers Jesse Ruderman and Sid     Stamm reported that when downloading a file containing a     right-to-left override character (RTL) in the filename,     the name displayed in the dialog title bar conflicts     with the name of the file shown in the dialog body. An     attacker could use this vulnerability to obfuscate the     name and file extension of a file to be downloaded and     opened, potentially causing a user to run an executable     file when they expected to open a non-executable file.
    (MFSA 2009-62 / CVE-2009-3376)

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-64 / CVE-2009-3380 /     CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383)

Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-853-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream changes introduced regressions that could lead to crashes when processing certain malformed GIF images, fonts and web pages. This update fixes the problem.

We apologize for the inconvenience.

Alin Rad Pop discovered a heap-based buffer overflow in Firefox when it converted strings to floating point numbers. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1563)

Jeremy Brown discovered that the Firefox Download Manager was vulnerable to symlink attacks. A local attacker could exploit this to create or overwrite files with the privileges of the user invoking the program. (CVE-2009-3274)

Paul Stone discovered a flaw in the Firefox form history. If a user were tricked into viewing a malicious website, a remote attacker could access this data to steal confidential information. (CVE-2009-3370)

Orlando Berrera discovered that Firefox did not properly free memory when using web-workers. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 9.10. (CVE-2009-3371)

A flaw was discovered in the way Firefox processed Proxy Auto-configuration (PAC) files. If a user configured the browser to use PAC files with certain regular expressions, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3372)

A heap-based buffer overflow was discovered in Mozilla's GIF image parser. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3373)

A flaw was discovered in the JavaScript engine of Firefox.
An attacker could exploit this to execute scripts from page content with chrome privileges. (CVE-2009-3374)

Gregory Fleischer discovered that the same-origin check in Firefox could be bypassed by utilizing the document.getSelection function. An attacker could exploit this to read data from other domains. (CVE-2009-3375)

Jesse Ruderman and Sid Stamm discovered that Firefox did not properly display filenames containing right-to-left (RTL) override characters. If a user were tricked into downloading a malicious file with a crafted filename, an attacker could exploit this to trick the user into opening a different file than the user expected. (CVE-2009-3376)

Several flaws were discovered in third-party media libraries. If a user were tricked into opening a crafted media file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 9.10. (CVE-2009-3377)

Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel Banchero, David Keeler, Boris Zbarsky, Thomas Frederiksen, Marcia Knous, Carsten Book, Kevin Brosnan, David Anderson and Jeff Walden discovered various flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-3380, CVE-2009-3381, CVE-2009-3382, CVE-2009-3383).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42363	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1488)	Nessus	SuSE Local Security Checks	2009/11/4	2021/1/14	critical
43826	VMSA-2010-0001 : ESX Service Console and vMA updates for nss and nspr	Nessus	VMware ESX Local Security Checks	2010/1/8	2021/1/6	critical
42298	FreeBSD : mozilla -- multiple vulnerabilities (c87aa2d2-c3c4-11de-ab08-000f20797ede)	Nessus	FreeBSD Local Security Checks	2009/10/29	2021/1/6	critical
42365	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6606)	Nessus	SuSE Local Security Checks	2009/11/4	2021/1/14	critical
42366	SuSE 10 Security Update : Mozilla XULRunner (ZYPP Patch Number 6616)	Nessus	SuSE Local Security Checks	2009/11/4	2021/1/14	critical
42383	Fedora 10 : Miro-2.0.5-5.fc10 / blam-1.8.5-15.fc10 / epiphany-2.24.3-11.fc10 / etc (2009-10981)	Nessus	Fedora Local Security Checks	2009/11/5	2021/1/11	critical
42474	Ubuntu 9.10 : firefox-3.5, xulrunner-1.9.1 regression (USN-853-2)	Nessus	Ubuntu Local Security Checks	2009/11/12	2021/1/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical