Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[RHSA-2009:1095-01] Critical: firefox security update

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Critical: firefox security update

Advisory ID: RHSA-2009:1095-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-1095.html

Issue date: 2009-06-11

CVE Names: CVE-2009-1392 CVE-2009-1832 CVE-2009-1833

CVE-2009-1834 CVE-2009-1835 CVE-2009-1836

CVE-2009-1837 CVE-2009-1838 CVE-2009-1839

CVE-2009-1840 CVE-2009-1841

=====================================================================

 

1. Summary:

 

Updated firefox packages that fix several security issues are now available

for Red Hat Enterprise Linux 4 and 5.

 

This update has been rated as having critical security impact by the Red

Hat Security Response Team.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

 

3. Description:

 

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL

Runtime environment for Mozilla Firefox.

 

Several flaws were found in the processing of malformed web content. A web

page containing malicious content could cause Firefox to crash or,

potentially, execute arbitrary code as the user running Firefox.

(CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1837, CVE-2009-1838,

CVE-2009-1841)

 

Multiple flaws were found in the processing of malformed, local file

content. If a user loaded malicious, local content via the file:// URL, it

was possible for that content to access other local data. (CVE-2009-1835,

CVE-2009-1839)

 

A script, privilege elevation flaw was found in the way Firefox loaded XML

User Interface Language (XUL) scripts. Firefox and certain add-ons could

load malicious content when certain policy checks did not happen.

(CVE-2009-1840)

 

A flaw was found in the way Firefox displayed certain Unicode characters in

International Domain Names (IDN). If an IDN contained invalid characters,

they may have been displayed as spaces, making it appear to the user that

they were visiting a trusted site. (CVE-2009-1834)

 

A flaw was found in the way Firefox handled error responses returned from

proxy servers. If an attacker is able to conduct a man-in-the-middle attack

against a Firefox instance that is using a proxy server, they may be able

to steal sensitive information from the site the user is visiting.

(CVE-2009-1836)

 

For technical details regarding these flaws, refer to the Mozilla security

advisories for Firefox 3.0.11. You can find a link to the Mozilla

advisories in the References section of this errata.

 

All Firefox users should upgrade to these updated packages, which contain

Firefox version 3.0.11, which corrects these issues. After installing the

update, Firefox must be restarted for the changes to take effect.

 

4. Solution:

 

Before applying this update, make sure that all previously-released

errata relevant to your system have been applied.

 

This update is available via Red Hat Network. Details on how to use

the Red Hat Network to apply this update are available at

http://kbase.redhat.com/faq/docs/DOC-11259

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

488570 - frequent firefox crashes against clearspace

503568 - CVE-2009-1392 Firefox browser engine crashes

503569 - CVE-2009-1832 Firefox double frame construction flaw

503570 - CVE-2009-1833 Firefox JavaScript engine crashes

503573 - CVE-2009-1834 Firefox URL spoofing with invalid unicode characters

503576 - CVE-2009-1835 Firefox Arbitrary domain cookie access by local file: resources

503578 - CVE-2009-1836 Firefox SSL tampering via non-200 responses to proxy CONNECT requests

503579 - CVE-2009-1837 Firefox Race condition while accessing the private data of a NPObject JS wrapper class object

503580 - CVE-2009-1838 Firefox arbitrary code execution flaw

503581 - CVE-2009-1839 Firefox information disclosure flaw

503582 - CVE-2009-1840 Firefox XUL scripts skip some security checks

503583 - CVE-2009-1841 Firefox JavaScript arbitrary code execution

 

6. Package List:

 

Red Hat Enterprise Linux AS version 4:

 

Source:

ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-3.0.11-4.el4.src.rpm

 

i386:

firefox-3.0.11-4.el4.i386.rpm

firefox-debuginfo-3.0.11-4.el4.i386.rpm

 

ia64:

firefox-3.0.11-4.el4.ia64.rpm

firefox-debuginfo-3.0.11-4.el4.ia64.rpm

 

ppc:

firefox-3.0.11-4.el4.ppc.rpm

firefox-debuginfo-3.0.11-4.el4.ppc.rpm

 

s390:

firefox-3.0.11-4.el4.s390.rpm

firefox-debuginfo-3.0.11-4.el4.s390.rpm

 

s390x:

firefox-3.0.11-4.el4.s390x.rpm

firefox-debuginfo-3.0.11-4.el4.s390x.rpm

 

x86_64:

firefox-3.0.11-4.el4.x86_64.rpm

firefox-debuginfo-3.0.11-4.el4.x86_64.rpm

 

Red Hat Enterprise Linux Desktop version 4:

 

Source:

ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-3.0.11-4.el4.src.rpm

 

i386:

firefox-3.0.11-4.el4.i386.rpm

firefox-debuginfo-3.0.11-4.el4.i386.rpm

 

x86_64:

firefox-3.0.11-4.el4.x86_64.rpm

firefox-debuginfo-3.0.11-4.el4.x86_64.rpm

 

Red Hat Enterprise Linux ES version 4:

 

Source:

ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-3.0.11-4.el4.src.rpm

 

i386:

firefox-3.0.11-4.el4.i386.rpm

firefox-debuginfo-3.0.11-4.el4.i386.rpm

 

ia64:

firefox-3.0.11-4.el4.ia64.rpm

firefox-debuginfo-3.0.11-4.el4.ia64.rpm

 

x86_64:

firefox-3.0.11-4.el4.x86_64.rpm

firefox-debuginfo-3.0.11-4.el4.x86_64.rpm

 

Red Hat Enterprise Linux WS version 4:

 

Source:

ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-3.0.11-4.el4.src.rpm

 

i386:

firefox-3.0.11-4.el4.i386.rpm

firefox-debuginfo-3.0.11-4.el4.i386.rpm

 

ia64:

firefox-3.0.11-4.el4.ia64.rpm

firefox-debuginfo-3.0.11-4.el4.ia64.rpm

 

x86_64:

firefox-3.0.11-4.el4.x86_64.rpm

firefox-debuginfo-3.0.11-4.el4.x86_64.rpm

 

Red Hat Enterprise Linux Desktop (v. 5 client):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.0.11-2.el5_3.src.rpm

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.0.11-3.el5_3.src.rpm

 

i386:

firefox-3.0.11-2.el5_3.i386.rpm

firefox-debuginfo-3.0.11-2.el5_3.i386.rpm

xulrunner-1.9.0.11-3.el5_3.i386.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

 

x86_64:

firefox-3.0.11-2.el5_3.i386.rpm

firefox-3.0.11-2.el5_3.x86_64.rpm

firefox-debuginfo-3.0.11-2.el5_3.i386.rpm

firefox-debuginfo-3.0.11-2.el5_3.x86_64.rpm

xulrunner-1.9.0.11-3.el5_3.i386.rpm

xulrunner-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.x86_64.rpm

 

RHEL Desktop Workstation (v. 5 client):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.0.11-3.el5_3.src.rpm

 

i386:

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.i386.rpm

 

x86_64:

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-devel-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.x86_64.rpm

 

Red Hat Enterprise Linux (v. 5 server):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.0.11-2.el5_3.src.rpm

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.0.11-3.el5_3.src.rpm

 

i386:

firefox-3.0.11-2.el5_3.i386.rpm

firefox-debuginfo-3.0.11-2.el5_3.i386.rpm

xulrunner-1.9.0.11-3.el5_3.i386.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.i386.rpm

 

ia64:

firefox-3.0.11-2.el5_3.ia64.rpm

firefox-debuginfo-3.0.11-2.el5_3.ia64.rpm

xulrunner-1.9.0.11-3.el5_3.ia64.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.ia64.rpm

xulrunner-devel-1.9.0.11-3.el5_3.ia64.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.ia64.rpm

 

ppc:

firefox-3.0.11-2.el5_3.ppc.rpm

firefox-debuginfo-3.0.11-2.el5_3.ppc.rpm

xulrunner-1.9.0.11-3.el5_3.ppc.rpm

xulrunner-1.9.0.11-3.el5_3.ppc64.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.ppc.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.ppc64.rpm

xulrunner-devel-1.9.0.11-3.el5_3.ppc.rpm

xulrunner-devel-1.9.0.11-3.el5_3.ppc64.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.ppc.rpm

 

s390x:

firefox-3.0.11-2.el5_3.s390.rpm

firefox-3.0.11-2.el5_3.s390x.rpm

firefox-debuginfo-3.0.11-2.el5_3.s390.rpm

firefox-debuginfo-3.0.11-2.el5_3.s390x.rpm

xulrunner-1.9.0.11-3.el5_3.s390.rpm

xulrunner-1.9.0.11-3.el5_3.s390x.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.s390.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.s390x.rpm

xulrunner-devel-1.9.0.11-3.el5_3.s390.rpm

xulrunner-devel-1.9.0.11-3.el5_3.s390x.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.s390x.rpm

 

x86_64:

firefox-3.0.11-2.el5_3.i386.rpm

firefox-3.0.11-2.el5_3.x86_64.rpm

firefox-debuginfo-3.0.11-2.el5_3.i386.rpm

firefox-debuginfo-3.0.11-2.el5_3.x86_64.rpm

xulrunner-1.9.0.11-3.el5_3.i386.rpm

xulrunner-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.i386.rpm

xulrunner-debuginfo-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-devel-1.9.0.11-3.el5_3.i386.rpm

xulrunner-devel-1.9.0.11-3.el5_3.x86_64.rpm

xulrunner-devel-unstable-1.9.0.11-3.el5_3.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://www.redhat.com/security/team/key/#package

 

7. References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1392

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1832

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1833

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1834

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1835

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1836

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1837

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1838

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1839

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1840

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1841

http://www.redhat.com/security/updates/classification/#critical

http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.11

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://www.redhat.com/security/team/contact/

 

Copyright 2009 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFKMZF3XlSAg2UNWIIRAtZPAKC5iTzwG8fYp2bKjsRkysD79+Vn8ACglygg

TSke2ogwC/K+NaWbbb28uHA=

=o7q4

-----END PGP SIGNATURE-----

 

 

--

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×