This update brings Mozilla Firefox to version 3.6.12, fixing various bugs and security issues.

The following security issues were fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. References. (MFSA 2010-64)

    Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor     Bukanov and Josh Soref reported memory safety problems     that affected Firefox 3.6 and Firefox 3.5.

  - Memory safety bugs - Firefox 3.6, Firefox 3.5

  - Gary Kwong, Martijn Wargers and Siddharth Agarwal     reported memory safety problems that affected Firefox     3.6 only. (CVE-2010-3176)

  - Memory safety bugs - Firefox 3.6

  - CVE-2010-3175

  - Security researcher Alexander Miller reported that     passing an excessively long string to document.write     could cause text rendering routines to end up in an     inconsistent state with sections of stack memory being     overwritten with the string data. An attacker could use     this flaw to crash a victim's browser and potentially     run arbitrary code on their computer. (MFSA 2010-65 /     CVE-2010-3179)

  - Security researcher Sergey Glazunov reported that it was     possible to access the locationbar property of a window     object after it had been closed. Since the closed     window's memory could have been subsequently reused by     the system it was possible that an attempt to access the     locationbar property could result in the execution of     attacker-controlled memory. (MFSA 2010-66 /     CVE-2010-3180)

  - Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that when     window.lookupGetter is called with no arguments the code     assumes the top JavaScript stack value is a property     name. Since there were no arguments passed into the     function, the top value could represent uninitialized     memory or a pointer to a previously freed JavaScript     object. Under such circumstances the value is passed to     another subroutine which calls through the dangling     pointer, potentially executing attacker-controlled     memory. (MFSA 2010-67 / CVE-2010-3183)

  - Google security researcher Robert Swiecki reported that     functions used by the Gopher parser to convert text to     HTML tags could be exploited to turn text into     executable JavaScript. If an attacker could create a     file or directory on a Gopher server with the encoded     script as part of its name the script would then run in     a victim's browser within the context of the site. (MFSA     2010-68 / CVE-2010-3177)

  - Security researcher Eduardo Vela Nava reported that if a     web page opened a new window and used a javascript: URL     to make a modal call, such as alert(), then subsequently     navigated the page to a different domain, once the modal     call returned the opener of the window could get access     to objects in the navigated window. This is a violation     of the same-origin policy and could be used by an     attacker to steal information from another web site.
    (MFSA 2010-69 / CVE-2010-3178)

  - Security researcher Richard Moore reported that when an     SSL certificate was created with a common name     containing a wildcard followed by a partial IP address a     valid SSL connection could be established with a server     whose IP address matched the wildcard range by browsing     directly to the IP address. It is extremely unlikely     that such a certificate would be issued by a Certificate     Authority. (MFSA 2010-70 / CVE-2010-3170)

  - Dmitri Gribenko reported that the script used to launch     Mozilla applications on Linux was effectively including     the current working directory in the LDLIBRARYPATH     environment variable. If an attacker was able to place     into the current working directory a malicious shared     library with the same name as a library that the     bootstrapping script depends on the attacker could have     their library loaded instead of the legitimate library.
    (MFSA 2010-71 / CVE-2010-3182)

  - Morten Krokvik of Telenor SOC reported an exploit     targeting particular versions of Firefox 3.6 on Windows     XP that Telenor found while investigating an intrusion     attempt on a customer network. The underlying     vulnerability, however, was present on both the Firefox     3.5 and Firefox 3.6 development branches and affected     all supported platforms. (MFSA 2010-73 / CVE-2010-3765)

A race condition flaw was found in the way Firefox handled Document Object Model (DOM) element properties. Malicious HTML content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3765)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3175, CVE-2010-3176, CVE-2010-3179, CVE-2010-3183, CVE-2010-3180)

A flaw was found in the way the Gopher parser in Firefox converted text into HTML. A malformed file name on a Gopher server could, when accessed by a victim running Firefox, allow arbitrary JavaScript to be executed in the context of the Gopher domain. (CVE-2010-3177)

A same-origin policy bypass flaw was found in Firefox. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim had loaded with Firefox. (CVE-2010-3178)

A flaw was found in the script that launches Firefox. The LD_LIBRARY_PATH variable was appending a '.' character, which could allow a local attacker to execute arbitrary code with the privileges of a different user running Firefox, if that user ran Firefox from within an attacker-controlled directory. (CVE-2010-3182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.11 and 3.6.12.

After installing the update, Firefox must be restarted for the changes to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
50876	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 3455 / 3456)	Nessus	SuSE Local Security Checks	2010/12/2	2025/10/6	critical
60889	Scientific Linux Security Update : firefox on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2025/10/6	critical

检测

插件搜索

critical

critical