Updated firefox packages that fix multiple security issues and three bugs are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Two flaws were found in the way Firefox parsed certain Scalable Vector Graphics (SVG) image files. A web page containing a malicious SVG image file could cause an information leak, or cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0456, CVE-2012-0457)

A flaw could allow a malicious site to bypass intended restrictions, possibly leading to a cross-site scripting (XSS) attack if a user were tricked into dropping a 'javascript:' link onto a frame.
(CVE-2012-0455)

It was found that the home page could be set to a 'javascript:' link.
If a user were tricked into setting such a home page by dragging a link to the home button, it could cause Firefox to repeatedly crash, eventually leading to arbitrary code execution with the privileges of the user running Firefox. (CVE-2012-0458)

A flaw was found in the way Firefox parsed certain web content containing 'cssText'. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0459)

It was found that by using the DOM fullscreen API, untrusted content could bypass the mozRequestFullscreen security protections. A web page containing malicious web content could exploit this API flaw to cause user interface spoofing. (CVE-2012-0460)

A flaw was found in the way Firefox handled pages with multiple Content Security Policy (CSP) headers. This could lead to a cross-site scripting attack if used in conjunction with a website that has a header injection flaw. (CVE-2012-0451)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.3 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

This update also fixes the following bugs :

* When using the Traditional Chinese locale (zh-TW), a segmentation fault sometimes occurred when closing Firefox. (BZ#729632)

* Inputting any text in the Web Console (Tools -> Web Developer -> Web Console) caused Firefox to crash. (BZ#784048)

* The java-1.6.0-ibm-plugin and java-1.6.0-sun-plugin packages require the '/usr/lib/mozilla/plugins/' directory on 32-bit systems, and the '/usr/lib64/mozilla/plugins/' directory on 64-bit systems. These directories are created by the xulrunner package; however, they were missing from the xulrunner package provided by the RHEA-2012:0327 update. Therefore, upgrading to RHEA-2012:0327 removed those directories, causing dependency errors when attempting to install the java-1.6.0-ibm-plugin or java-1.6.0-sun-plugin package. With this update, xulrunner once again creates the plugins directory. This issue did not affect users of Red Hat Enterprise Linux 6. (BZ#799042)

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.3 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

USN-1400-3 fixed vulnerabilities in Thunderbird. The new Thunderbird version caused a regression in IMAP connections and mail filtering.
This update fixes the problem.

Soroush Dalili discovered that Firefox did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents or steal confidential data. (CVE-2012-0455)

Atte Kettunen discovered a use-after-free vulnerability in Firefox's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in Firefox's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. (CVE-2012-0456)

Mike Brooks discovered that using carriage return line feed (CRLF) injection, one could introduce a new Content Security Policy (CSP) rule which allows for cross-site scripting (XSS) on sites with a separate header injection vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-0451)

Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458)

Daniel Glazman discovered that the Cascading Style Sheets (CSS) implementation is vulnerable to crashing due to modification of a keyframe followed by access to the cssText of the keyframe. If the user were tricked into opening a specially crafted web page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0459)

Matt Brubeck discovered that Firefox did not properly restrict access to the window.fullScreen object. If the user were tricked into opening a specially crafted web page, an attacker could potentially use this vulnerability to spoof the user interface. (CVE-2012-0460)

Bob Clary, Christian Holler, Jesse Ruderman, Michael Bebenita, David Anderson, Jeff Walden, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Changes in MozillaThunderbird :

  - update to Thunderbird 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in mozilla-xulrunner192 :

  - security update to 1.9.2.28 (bnc#750044)

  - MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue     out-of-bounds access

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in MozillaFirefox :

  - update to Firefox 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in seamonkey :

  - update to SeaMonkey 2.8 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in chmsee :

  - Update to version 1.99.08

Changes in mozilla-nss :

  - update to 3.13.3 RTM

  - distrust Trustwave's MITM certificates (bmo#724929)

  - fix generic blacklisting mechanism (bmo#727204)

Changes in mozilla-nspr :

  - update to version 4.9 RTM

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The installed version of Thunderbird 10.0.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability exists that     can be leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:0388 advisory.

  - Mozilla: XSS with multiple Content Security Policy headers (MFSA 2012-15) (CVE-2012-0451)

  - Mozilla: XSS with Drag and Drop and Javascript: URL (MFSA 2012-13) (CVE-2012-0455)

  - Mozilla: SVG issues found with Address Sanitizer (MFSA 2012-14) (CVE-2012-0456, CVE-2012-0457)

  - Mozilla: Escalation of privilege with Javascript: URL as home page (MFSA 2012-16) (CVE-2012-0458)

  - Mozilla: Crash when accessing keyframe cssText after dynamic modification (MFSA 2012-17) (CVE-2012-0459)

  - Mozilla: window.fullScreen writeable by untrusted content (MFSA 2012-18) (CVE-2012-0460)

  - Mozilla: Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28) (MFSA 2012-19)     (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox was updated to 10.0.3 ESR to fix various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-19)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

    References :

    Bob Clary reported two bugs that causes crashes that     affected Firefox 3.6, Firefox ESR, and Firefox 10.
    (CVE-2012-0461)

    Christian Holler, Jesse Ruderman, Nils, Michael     Bebenita, Dindog, and David Anderson reported memory     safety problems and crashes that affect Firefox ESR and     Firefox 10. (CVE-2012-0462)

    Jeff Walden reported a memory safety problem in the     array.join function. This bug was independently reported     by Vincenzo Iozzo via TippingPoint's Zero Day Initiative     Pwn2Own contest. (CVE-2012-0464)

    Masayuki Nakano reported a memory safety problem that     affected Mobile Firefox

  - CVE-2012-0463

  - Mozilla developer Matt Brubeck reported that     window.fullScreen is writeable by untrusted content now     that the DOM fullscreen API is enabled. Because     window.fullScreen does not include     mozRequestFullscreen's security protections, it could be     used for UI spoofing. This code change makes     window.fullScreen read only by untrusted content,     forcing the use of the DOM fullscreen API in normal     usage. (MFSA 2012-18 / CVE-2012-0460)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Mozilla community member Daniel Glazman of Disruptive     Innovations reported a crash when accessing a keyframe's     cssText after dynamic modification. This crash may be     potentially exploitable. (MFSA 2012-17 / CVE-2012-0459)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Mariusz Mlynski reported that an     attacker able to convince a potential victim to set a     new home page by dragging a link to the 'home' button     can set that user's home page to a javascript: URL. Once     this is done the attacker's page can cause repeated     crashes of the browser, eventually getting the script     URL loaded in the privileged about:sessionrestore     context. (MFSA 2012-16 / CVE-2012-0458)

  - Security Researcher Mike Brooks of Sitewatch reported     that if multiple Content Security Policy (CSP) headers     are present on a page, they have an additive effect page     policy. Using carriage return line feed (CRLF)     injection, a new CSP rule can be introduced which allows     for cross-site scripting (XSS) on sites with a separate     header injection vulnerability. (MFSA 2012-15 /     CVE-2012-0451)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Atte Kettunen from OUSPG found two     issues with Firefox's handling of SVG using the Address     Sanitizer tool. The first issue, critically rated, is a     use-after-free in SVG animation that could potentially     lead to arbitrary code execution. The second issue is     rated moderate and is an out of bounds read in SVG     Filters. This could potentially incorporate data from     the user's memory, making it accessible to the page     content. (MFSA 2012-14 / CVE-2012-0457 / CVE-2012-0456)

  - Firefox prevents the dropping of javascript: links onto     a frame to prevent malicious sites from tricking users     into performing a cross-site scripting (XSS) attacks on     themselves. Security researcher Soroush Dalili reported     a way to bypass this protection. (MFSA 2012-13 /     CVE-2012-0455)

  - Security researchers Blair Strang and Scott Bell of     Security Assessment found that when a parent window     spawns and closes a child window that uses the file open     dialog, a crash can be induced in shlwapi.dll on 32-bit     Windows 7 systems. This crash may be potentially     exploitable. (MFSA 2012-12 / CVE-2012-0454)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Reworked the KDE4 integration. (bnc#745017)

Changes in xulrunner :

  - update to 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

Changes in MozillaFirefox :

  - update to Firefox 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

  - recommend libcanberra0 for proper sound notifications

Changes in MozillaThunderbird :

  - update to Thunderbird 12.0 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update Enigmail to 1.4.1

  - added mozilla-revert_621446.patch

  - added mozilla-libnotify.patch (bmo#737646)

  - added mailnew-showalert.patch (bmo#739146)

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

  - disabled crashreporter temporarily for Factory (gcc 4.7     issue)

Changes in seamonkey :

  - update to SeaMonkey 2.9 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update to 2.9b4

  - added mozilla-sle11.patch and add exceptions to be able     to build for SLE11/11.1

  - exclude broken gl locale from build

  - fixed build on 11.2-x86_64 by adding     mozilla-revert_621446.patch

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

The installed version of SeaMonkey is earlier than 2.8.0.  Such versions are potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability that can be     leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability that can be exploited by     an attacker if the victim can be tricked into setting a     new home page by dragging a specially crafted link to     the 'home' button URL, which will set the user's home     page to a 'javascript:' URL. (CVE-2012-0458) 

  - An information disclosure vulnerability due to an out of     bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The Mozilla Project reports :

MFSA 2012-13 XSS with Drag and Drop and Javascript: URL

MFSA 2012-14 SVG issues found with Address Sanitizer

MFSA 2012-15 XSS with multiple Content Security Policy headers

MFSA 2012-16 Escalation of privilege with Javascript: URL as home page

MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification

MFSA 2012-18 window.fullScreen writeable by untrusted content

MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)

Security issues were identified and fixed in mozilla firefox and thunderbird :

Security researchers Blair Strang and Scott Bell of Security Assessment found that when a parent window spawns and closes a child window that uses the file open dialog, a crash can be induced in shlwapi.dll on 32-bit Windows 7 systems. This crash may be potentially exploitable (CVE-2012-0454).

Firefox prevents the dropping of javascript: links onto a frame to prevent malicious sites from tricking users into performing a cross-site scripting (XSS) attacks on themselves. Security researcher Soroush Dalili reported a way to bypass this protection (CVE-2012-0455).

Security researcher Atte Kettunen from OUSPG found two issues with Firefox's handling of SVG using the Address Sanitizer tool. The first issue, critically rated, is a use-after-free in SVG animation that could potentially lead to arbitrary code execution. The second issue is rated moderate and is an out of bounds read in SVG Filters. This could potentially incorporate data from the user's memory, making it accessible to the page content (CVE-2012-0457, CVE-2012-0456).

Security Researcher Mike Brooks of Sitewatch reported that if multiple Content Security Policy (CSP) headers are present on a page, they have an additive effect page policy. Using carriage return line feed (CRLF) injection, a new CSP rule can be introduced which allows for cross-site scripting (XSS) on sites with a separate header injection vulnerability (CVE-2012-0451).

Security researcher Mariusz Mlynski reported that an attacker able to convince a potential victim to set a new home page by dragging a link to the home button can set that user's home page to a javascript: URL.
Once this is done the attacker's page can cause repeated crashes of the browser, eventually getting the script URL loaded in the privileged about:sessionrestore context (CVE-2012-0458).

Mozilla community member Daniel Glazman of Disruptive Innovations reported a crash when accessing a keyframe's cssText after dynamic modification. This crash may be potentially exploitable (CVE-2012-0459).

Mozilla developer Matt Brubeck reported that window.fullScreen is writeable by untrusted content now that the DOM fullscreen API is enabled. Because window.fullScreen does not include mozRequestFullscreen's security protections, it could be used for UI spoofing. This code change makes window.fullScreen read only by untrusted content, forcing the use of the DOM fullscreen API in normal usage (CVE-2012-0460).

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464).

The mozilla firefox and thunderbird packages has been upgraded to the latest respective versions which is unaffected by these security flaws.

Additionally the NSS and NSPR packages has been upgraded to the latest versions. The OpenJDK java plugin (icedtea-web) has been upgraded to the 1.1.5 version whish bas better support for firefox 10.x+.

Update :

Updated packages for 2010.2 is being provided, despite the Mandriva products lifetime policy dictates otherwise.

USN-1400-1 fixed vulnerabilities in Firefox. Firefox 11 started using GSettings to access the system proxy settings. If there is a GSettings proxy settings schema, Firefox will consume it. The GSettings proxy settings schema that was shipped by default was unused by other applications and broke Firefox's ability to use system proxy settings.
This update removes the unused schema. We apologize for the inconvenience.

Soroush Dalili discovered that Firefox did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents or steal confidential data. (CVE-2012-0455)

Atte Kettunen discovered a use-after-free vulnerability in Firefox's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in Firefox's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. (CVE-2012-0456)

Mike Brooks discovered that using carriage return line feed (CRLF) injection, one could introduce a new Content Security Policy (CSP) rule which allows for cross-site scripting (XSS) on sites with a separate header injection vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
(CVE-2012-0451)

Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458)

Daniel Glazman discovered that the Cascading Style Sheets (CSS) implementation is vulnerable to crashing due to modification of a keyframe followed by access to the cssText of the keyframe. If the user were tricked into opening a specially crafted web page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0459)

Matt Brubeck discovered that Firefox did not properly restrict access to the window.fullScreen object. If the user were tricked into opening a specially crafted web page, an attacker could potentially use this vulnerability to spoof the user interface. (CVE-2012-0460)

Bob Clary, Christian Holler, Jesse Ruderman, Michael Bebenita, David Anderson, Jeff Walden, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Two flaws were found in the way Firefox parsed certain Scalable Vector Graphics (SVG) image files. A web page containing a malicious SVG image file could cause an information leak, or cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0456, CVE-2012-0457)

A flaw could allow a malicious site to bypass intended restrictions, possibly leading to a cross-site scripting (XSS) attack if a user were tricked into dropping a 'javascript:' link onto a frame.
(CVE-2012-0455)

It was found that the home page could be set to a 'javascript:' link.
If a user were tricked into setting such a home page by dragging a link to the home button, it could cause Firefox to repeatedly crash, eventually leading to arbitrary code execution with the privileges of the user running Firefox. (CVE-2012-0458)

A flaw was found in the way Firefox parsed certain web content containing 'cssText'. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0459)

It was found that by using the DOM fullscreen API, untrusted content could bypass the mozRequestFullscreen security protections. A web page containing malicious web content could exploit this API flaw to cause user interface spoofing. (CVE-2012-0460)

A flaw was found in the way Firefox handled pages with multiple Content Security Policy (CSP) headers. This could lead to a cross-site scripting attack if used in conjunction with a website that has a header injection flaw. (CVE-2012-0451)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.3 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

This update also fixes the following bugs :

  - When using the Traditional Chinese locale (zh-TW), a     segmentation fault sometimes occurred when closing     Firefox.

  - Inputting any text in the Web Console (Tools -> Web     Developer -> Web Console) caused Firefox to crash.

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.3 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content.
Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Two flaws were found in the way Thunderbird parsed certain Scalable Vector Graphics (SVG) image files. An HTML mail message containing a malicious SVG image file could cause an information leak, or cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0456, CVE-2012-0457)

A flaw could allow malicious content to bypass intended restrictions, possibly leading to a cross-site scripting (XSS) attack if a user were tricked into dropping a 'javascript:' link onto a frame.
(CVE-2012-0455)

It was found that the home page could be set to a 'javascript:' link.
If a user were tricked into setting such a home page by dragging a link to the home button, it could cause Firefox to repeatedly crash, eventually leading to arbitrary code execution with the privileges of the user running Firefox. A similar flaw was found and fixed in Thunderbird. (CVE-2012-0458)

A flaw was found in the way Thunderbird parsed certain, remote content containing 'cssText'. Malicious, remote content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0459)

It was found that by using the DOM fullscreen API, untrusted content could bypass the mozRequestFullscreen security protections. Malicious content could exploit this API flaw to cause user interface spoofing.
(CVE-2012-0460)

A flaw was found in the way Thunderbird handled content with multiple Content Security Policy (CSP) headers. This could lead to a cross-site scripting attack if used in conjunction with a website that has a header injection flaw. (CVE-2012-0451)

Note: All issues except CVE-2012-0456 and CVE-2012-0457 cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. It could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 10.0.3 ESR, which corrects these issues.
After installing the update, Thunderbird must be restarted for the changes to take effect.

The remote Solaris system is missing necessary patches to address security updates :

  - CRLF injection vulnerability in Mozilla Firefox 4.x     through 10.0, Firefox ESR 10.x before 10.0.3,     Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x     before 10.0.3, and SeaMonkey before 2.8 allows remote     web servers to bypass intended Content Security Policy     (CSP) restrictions and possibly conduct cross-site     scripting (XSS) attacks via crafted HTTP headers.
    (CVE-2012-0451)

  - Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 do not properly     restrict drag-and-drop operations on javascript: URLs,     which allows user-assisted remote attackers to conduct     cross-site scripting (XSS) attacks via a crafted web     page, related to a 'DragAndDropJacking' issue.
    (CVE-2012-0455)

  - The SVG Filters implementation in Mozilla Firefox before     3.6.28 and 4.x through 10.0, Firefox ESR 10.x before     10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 might allow remote attackers to obtain sensitive     information from process memory via vectors that trigger     an out-of-bounds read. (CVE-2012-0456)

  - Use-after-free vulnerability in the     nsSMILTimeValueSpec::ConvertBetweenTimeContainer     function in Mozilla Firefox before 3.6.28 and 4.x     through 10.0, Firefox ESR 10.x before 10.0.3,     Thunderbird before 3.1.20 and 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 might allow remote attackers to execute arbitrary     code via an SVG animation. (CVE-2012-0457)

  - Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 do not properly     restrict setting the home page through the dragging of a     URL to the home button, which allows user-assisted     remote attackers to execute arbitrary JavaScript code     with chrome privileges via a javascript: URL that is     later interpreted in the about:sessionrestore context.
    (CVE-2012-0458)

  - The Cascading Style Sheets (CSS) implementation in     Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x     before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird     ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via dynamic modification of a keyframe followed by     access to the cssText of the keyframe. (CVE-2012-0459)

  - Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x     before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird     ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not     properly restrict write access to the window.fullScreen     object, which allows remote attackers to spoof the user     interface via a crafted web page. (CVE-2012-0460)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 3.6.28 and 4.x through     10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 allow remote attackers     to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors. (CVE-2012-0461)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 4.x through 10.0, Firefox ESR     10.x before 10.0.3, Thunderbird 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 allow remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
    (CVE-2012-0462)

  - Use-after-free vulnerability in the browser engine in     Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 allows remote attackers     to execute arbitrary code via vectors involving an empty     argument to the array.join function in conjunction with     the triggering of garbage collection. (CVE-2012-0464)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
58344	CentOS 5 / 6 : firefox (CESA-2012:0387)	Nessus	CentOS Local Security Checks	2012/3/15	2021/1/4	high
58589	Ubuntu 11.10 : thunderbird regressions (USN-1400-4)	Nessus	Ubuntu Local Security Checks	2012/4/4	2019/9/19	high
74574	openSUSE Security Update : MozillaFirefox / MozillaThunderbird (openSUSE-SU-2012:0417-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
58350	Mozilla Thunderbird 10.0.x < 10.0.3 Multiple Vulnerabilities	Nessus	Windows	2012/3/15	2018/7/16	high
58339	RHEL 5 / 6 : thunderbird (RHSA-2012:0388)	Nessus	Red Hat Local Security Checks	2012/3/14	2024/4/27	medium
58524	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6007)	Nessus	SuSE Local Security Checks	2012/3/29	2021/1/19	high
74612	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
58352	SeaMonkey < 2.8.0 Multiple Vulnerabilities	Nessus	Windows	2012/3/15	2018/7/27	high
58347	FreeBSD : mozilla -- multiple vulnerabilities (a1050b8b-6db3-11e1-8b37-0011856a6e37)	Nessus	FreeBSD Local Security Checks	2012/3/15	2021/1/6	high
58771	Mandriva Linux Security Advisory : mozilla (MDVSA-2012:032-1)	Nessus	Mandriva Local Security Checks	2012/4/18	2021/1/6	high
58807	Ubuntu 11.04 : gsettings-desktop-schemas regression (USN-1400-5)	Nessus	Ubuntu Local Security Checks	2012/4/20	2019/9/19	high
61282	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120314)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
61283	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120314)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
80606	Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_in_firefox_web)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high

检测

插件搜索

high

high

high

critical

high

medium

high

critical

high

high

high

high

high

high

high