- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200701-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Mozilla Firefox: Multiple vulnerabilities
Date: January 04, 2007
Bugs: #156023
ID: 200701-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been reported in Mozilla Firefox, some of
which may allow the remote execution of arbitrary code.

Background
==========

Mozilla Firefox is a popular open-source web browser from the Mozilla
Project.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/mozilla-firefox < 1.5.0.9 >= 1.5.0.9
2 www-client/mozilla-firefox-bin < 1.5.0.9 >= 1.5.0.9
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------

Description
===========

An anonymous researcher found evidence of memory corruption in the way
Mozilla Firefox handles certain types of SVG comment DOM nodes.
Additionally, Frederik Reiss discovered a heap-based buffer overflow in
the conversion of a CSS cursor. Other issues with memory corruption
were also fixed. Mozilla Firefox also contains less severe
vulnerabilities involving JavaScript and Java.

Impact
======

An attacker could entice a user to view a specially crafted web page
that will trigger one of the vulnerabilities, possibly leading to the
execution of arbitrary code. It is also possible for an attacker to
perform cross-site scripting attacks, leading to the exposure of
sensitive information, like user credentials.

Workaround
==========

There are no known workarounds for all the issues at this time.

Resolution
==========

All Mozilla Firefox users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-1.5.0.9"

All Mozilla Firefox binary release users should upgrade to the latest
version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-bin-1.5.0.9"

References
==========

[ 1 ] CVE-2006-6497
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497
[ 2 ] CVE-2006-6498
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6498
[ 3 ] CVE-2006-6499
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6499
[ 4 ] CVE-2006-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500
[ 5 ] CVE-2006-6501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501
[ 6 ] CVE-2006-6502
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502
[ 7 ] CVE-2006-6503
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503
[ 8 ] CVE-2006-6504
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6504
[ 9 ] CVE-2006-6506
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6506
[ 10 ] CVE-2006-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6507

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200701-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBRZ1jLDvRww8BFPxFAQLxhwf9FfkhVIQepZ4pamxXgjdCppT4dpG9MPdc
qLBVXwDqO/WybgEX5XSu9Cz5XnxzgMGj/d6M5fxzVGwIGL5822x+qM7/4E/ibl1Z
im8hc/8EiDFPxBcVCZaWoolp6UO/X5hKS86Jaku1cJL0878COTVgOynIlKSNciuh
zjWvp1ExdKvqSuabY7qQJT5UjIcMz/GC2r5yvWpI/ZM/JNYGbKPDVjg03VmJEqaC
Xd0JOdxEow7NpC2QYrZSoAYdcLhR3znSE3R6N4xZIb8t4jYi5t7PxQa8agvZwZYJ
LhMLDD8owphfG+g4Xm7xNFjHhWL8EFnrUiDGGDCC2bjXnAKskPJzVg==
=SFBW
-----END PGP SIGNATURE-----

[ reply ]