Updated firefox packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A flaw was found in the way Firefox sanitized HTML content in extensions. If an extension loaded or rendered malicious content using the ParanoidFragmentSink class, it could fail to safely display the content, causing Firefox to execute arbitrary JavaScript with the privileges of the user running Firefox. (CVE-2010-1585)

A flaw was found in the way Firefox handled dialog boxes. An attacker could use this flaw to create a malicious web page that would present a blank dialog box that has non-functioning buttons. If a user closes the dialog box window, it could unexpectedly grant the malicious web page elevated privileges. (CVE-2011-0051)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0053, CVE-2011-0055, CVE-2011-0058, CVE-2011-0062)

Several flaws were found in the way Firefox handled malformed JavaScript. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox. (CVE-2011-0054, CVE-2011-0056, CVE-2011-0057)

A flaw was found in the way Firefox handled malformed JPEG images. A website containing a malicious JPEG image could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0061)

A flaw was found in the way Firefox handled plug-ins that perform HTTP requests. If a plug-in performed an HTTP request, and the server sent a 307 redirect response, the plug-in was not notified, and the HTTP request was forwarded. The forwarded request could contain custom headers, which could result in a Cross Site Request Forgery attack.
(CVE-2011-0059)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.14. You can find a link to the Mozilla advisories in the References section of this erratum.

This update also fixes the following bug :

* On Red Hat Enterprise Linux 4 and 5, running the 'firefox
-setDefaultBrowser' command caused warnings such as the following :

libgnomevfs-WARNING **: Deprecated function. User modifications to the MIME database are no longer supported.

This update disables the 'setDefaultBrowser' option. Red Hat Enterprise Linux 4 users wishing to set a default web browser can use Applications -> Preferences -> More Preferences -> Preferred Applications. Red Hat Enterprise Linux 5 users can use System -> Preferences -> Preferred Applications. (BZ#463131, BZ#665031)

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.14, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0053, CVE-2011-0062)

Zach Hoffman discovered that a recursive call to eval() wrapped in a try/catch statement places the browser into a inconsistent state. An attacker could exploit this to force a user to accept any dialog.
(CVE-2011-0051)

It was discovered that memory was used after being freed in a method used by JSON.stringify. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0055)

Christian Holler discovered multiple buffer overflows in the JavaScript engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0054, CVE-2011-0056)

Daniel Kozlowski discovered that a JavaScript Worker kept a reference to memory after it was freed. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0057)

Alex Miller discovered a buffer overflow in the browser rendering engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program.
(CVE-2011-0058)

Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript execution in chrome documents. A malicious extension could exploit this to execute arbitrary code with chrome privlieges.
(CVE-2010-1585)

Jordi Chancel discovered a buffer overlow in the JPEG decoding engine.
An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0061)

Peleus Uhley discovered a CSRF vulnerability in the plugin code related to 307 redirects. This could allow custom headers to be forwarded across origins. (CVE-2011-0059).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1049-1 fixed vulnerabilities in Firefox and Xulrunner. That update introduced a regression where some Java applets would fail to load.
This update fixes the problem.

We apologize for the inconvenience.

Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0053, CVE-2011-0062)

Zach Hoffman discovered that a recursive call to eval() wrapped in a try/catch statement places the browser into a inconsistent state. An attacker could exploit this to force a user to accept any dialog. (CVE-2011-0051)

It was discovered that memory was used after being freed in a method used by JSON.stringify. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0055)

Christian Holler discovered multiple buffer overflows in the JavaScript engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0054, CVE-2011-0056)

Daniel Kozlowski discovered that a JavaScript Worker kept a reference to memory after it was freed. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0057)

Alex Miller discovered a buffer overflow in the browser rendering engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0058)

Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript execution in chrome documents. A malicious extension could exploit this to execute arbitrary code with chrome privlieges. (CVE-2010-1585)

Jordi Chancel discovered a buffer overlow in the JPEG decoding engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. (CVE-2011-0061)

Peleus Uhley discovered a CSRF vulnerability in the plugin code related to 307 redirects. This could allow custom headers to be forwarded across origins. (CVE-2011-0059).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla XULRunner 1.9.1 has been updated to version 1.9.1.17, fixing the following security issues :

  - Several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products have been     identified and fixed. Some of these bugs showed evidence     of memory corruption under certain circumstances, and it     is assumed that with enough effort at least some of     these could be exploited to run arbitrary code. (MFSA     2010-74 / CVE-2010-3777)

  - Several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products have been     identified and fixed. Some of these bugs showed evidence     of memory corruption under certain circumstances, and it     is assumed that with enough effort at least some of     these could be exploited to run arbitrary code. (MFSA     2011-01 / CVE-2011-0053 / CVE-2011-0062)

  - A recursive call to eval() wrapped in a try/catch     statement places the browser into a inconsistent state.
    Any dialog box opened in this state is displayed without     text and with non-functioning buttons. Closing the     window causes the dialog to evaluate to true. An     attacker could use this issue to force a user into     accepting any dialog, such as one granting elevated     privileges to the page presenting the dialog. (MFSA     2011-02 / CVE-2011-0051)

  - A method used by JSON.stringify contains a     use-after-free error in which a currently in-use pointer     was freed and subsequently dereferenced. This could lead     to arbitrary code execution if an attacker is able to     store malicious code in the freed section of memory.
    (MFSA 2011-03 / CVE-2011-0055)

  - The JavaScript engine's internal memory mapping of     non-local JS variables contains a buffer overflow which     could potentially be used by an attacker to run     arbitrary code on a victim's computer. (MFSA 2011-04 /     CVE-2011-0054)

  - The JavaScript engine's internal mapping of string     values contains an error in cases where the number of     values being stored is above 64K. In such cases an     offset pointer is manually moved forwards and backwards     to access the larger address space. If an exception is     thrown between the time that the offset pointer was     moved forward and the time it gets reset, the exception     object would be read from an invalid memory address,     potentially executing attacker-controlled memory. (MFSA     2011-05 / CVE-2011-0056)

  - A JavaScript Worker could be used to keep a reference to     an object that could be freed during garbage collection.
    Subsequent calls through this deleted reference could     cause attacker-controlled memory to be executed on a     victim's computer. (MFSA 2011-06 / CVE-2011-0057)

  - When very long strings are constructed and inserted into     an HTML document, the browser incorrectly constructs the     layout objects used to display the text. Under such     conditions an incorrect length would be calculated for a     text run resulting in too small of a memory buffer being     allocated to store the text. This issue could be used by     an attacker to write data past the end of the buffer and     execute malicious code on a victim's computer. It     affects only Mozilla browsers on Windows. (MFSA 2011-07     / CVE-2011-0058)

  - ParanoidFragmentSink, a class used to sanitize     potentially unsafe HTML for display, allows javascript:
    URLs and other inline JavaScript when the embedding     document is a chrome document. While there are no unsafe     uses of this class in any released products, extension     code could potentially use it in an unsafe manner. (MFSA     2011-08 / CVE-2010-1585)

  - When plugin-initiated requests receive a 307 redirect     response, the plugin is not notified and the request is     forwarded to the new location. This is true even for     cross-site redirects, so any custom headers that were     added as part of the initial request would be forwarded     intact across origins. This poses a CSRF risk for web     applications that rely on custom headers only being     present in requests from their own origin. (MFSA 2011-10     / CVE-2011-0059)

A flaw was found in the way SeaMonkey handled dialog boxes. An attacker could use this flaw to create a malicious web page that would present a blank dialog box that has non-functioning buttons. If a user closes the dialog box window, it could unexpectedly grant the malicious web page elevated privileges. (CVE-2011-0051)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2011-0053)

A flaw was found in the way SeaMonkey handled plug-ins that perform HTTP requests. If a plug-in performed an HTTP request, and the server sent a 307 redirect response, the plug-in was not notified, and the HTTP request was forwarded. The forwarded request could contain custom headers, which could result in a Cross Site Request Forgery attack.
(CVE-2011-0059)

After installing the update, SeaMonkey must be restarted for the changes to take effect.

Several flaws were found in the processing of malformed HTML content.
Malicious HTML content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-1585, CVE-2011-0053, CVE-2011-0062)

A flaw was found in the way Thunderbird handled malformed JPEG images.
An HTML mail message containing a malicious JPEG image could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2011-0061)

All running instances of Thunderbird must be restarted for the update to take effect.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2011-0311 advisory.

    [3.1.8-4.0.2.el6_0]
    - Replace clean.gif in tarball

    [3.1.8-4.0.1.el6_0]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [3.1.8-4]
    - Update to build3

    [3.1.8-3]
    - Update to build2

    [3.1.8-2]
    - Update to 3.1.8

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MozillaFirefox was updated to version 3.6.15, fixing various security issues.

Following security issues were fixed: MFSA 2011-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. References

Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous reported memory safety problems that affected Firefox 3.6 and Firefox 3.5.
(CVE-2011-0053)

Igor Bukanov and Gary Kwong reported memory safety problems that affected Firefox 3.6 only. (CVE-2011-0062)

MFSA 2011-02 / CVE-2011-0051: Security researcher Zach Hoffman reported that a recursive call to eval() wrapped in a try/catch statement places the browser into a inconsistent state. Any dialog box opened in this state is displayed without text and with non-functioning buttons. Closing the window causes the dialog to evaluate to true. An attacker could use this issue to force a user into accepting any dialog, such as one granting elevated privileges to the page presenting the dialog.

MFSA 2011-03 / CVE-2011-0055: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a method used by JSON.stringify contained a use-after-free error in which a currently in-use pointer was freed and subsequently dereferenced. This could lead to arbitrary code execution if an attacker was able to store malicious code in the freed section of memory.

Mozilla developer Igor Bukanov also independently discovered and reported this issue two weeks after the initial report was received.

MFSA 2011-04 / CVE-2011-0054: Security researcher Christian Holler reported that the JavaScript engine's internal memory mapping of non-local JS variables contained a buffer overflow which could potentially be used by an attacker to run arbitrary code on a victim's computer.

MFSA 2011-05 / CVE-2011-0056: Security researcher Christian Holler reported that the JavaScript engine's internal mapping of string values contained an error in cases where the number of values being stored was above 64K. In such cases an offset pointer was manually moved forwards and backwards to access the larger address space. If an exception was thrown between the time that the offset pointer was moved forward and the time it was reset, then the exception object would be read from an invalid memory address, potentially executing attacker-controlled memory.

MFSA 2011-06 / CVE-2011-0057: Daniel Kozlowski reported that a JavaScript Worker could be used to keep a reference to an object that could be freed during garbage collection. Subsequent calls through this deleted reference could cause attacker-controlled memory to be executed on a victim's computer.

MFSA 2011-07 / CVE-2011-0058: Alex Miller reported that when very long strings were constructed and inserted into an HTML document, the browser would incorrectly construct the layout objects used to display the text. Under such conditions an incorrect length would be calculated for a text run resulting in too small of a memory buffer being allocated to store the text. This issue could be used by an attacker to write data past the end of the buffer and execute malicious code on a victim's computer. This issue affects only Mozilla browsers on Windows.

MFSA 2011-08 / CVE-2010-1585: Mozilla security developer Roberto Suggi Liverani reported that ParanoidFragmentSink, a class used to sanitize potentially unsafe HTML for display, allows javascript: URLs and other inline JavaScript when the embedding document is a chrome document.
While there are no unsafe uses of this class in any released products, extension code could have potentially used it in an unsafe manner.

MFSA 2011-09 / CVE-2011-0061: Security researcher Jordi Chancel reported that a JPEG image could be constructed that would be decoded incorrectly, causing data to be written past the end of a buffer created to store the image. An attacker could potentially craft such an image that would cause malicious code to be stored in memory and then later executed on a victim's computer.

MFSA 2011-10 / CVE-2011-0059: Adobe security researcher Peleus Uhley reported that when plugin-initiated requests receive a 307 redirect response, the plugin is not notified and the request is forwarded to the new location. This is true even for cross-site redirects, so any custom headers that were added as part of the initial request would be forwarded intact across origins. This poses a CSRF risk for web applications that rely on custom headers only being present in requests from their own origin.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
52507	CentOS 4 : firefox (CESA-2011:0310)	Nessus	CentOS Local Security Checks	2011/3/3	2021/1/4	critical
52526	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : firefox, firefox-{3.0,3.5}, xulrunner-1.9.2 vulnerabilities (USN-1049-1)	Nessus	Ubuntu Local Security Checks	2011/3/3	2019/9/19	critical
52579	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : firefox, firefox-{3.0,3.5}, xulrunner-1.9.2 regression (USN-1049-2)	Nessus	Ubuntu Local Security Checks	2011/3/8	2019/9/19	critical
52652	SuSE 10 Security Update : mozilla-xulrunner191 (ZYPP Patch Number 7363)	Nessus	SuSE Local Security Checks	2011/3/14	2021/1/19	critical
60974	Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
60976	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
68214	Oracle Linux 6 : thunderbird (ELSA-2011-0311)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	critical
75650	openSUSE Security Update : MozillaFirefox (MozillaFirefox-4111)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical