To: [email protected]Subject: [ MDKSA-2006:037 ] - Updated mozilla-firefox packages to address DoS vulnerability
Date: Tue, 7 Feb 2006 19:14:00 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1F6eqG-0001VJ-Mv@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:037
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mozilla-firefox
Date : February 7, 2006
Affected: 2006.0
_______________________________________________________________________
Problem Description:
Mozilla and Mozilla Firefox allow remote attackers to cause a denial of
service (CPU consumption and delayed application startup) via a web
site with a large title, which is recorded in history.dat but not
processed efficiently during startup. (CVE-2005-4134)
The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before
1.5.1 does not properly dereference objects, which allows remote
attackers to cause a denial of service (crash) or execute arbitrary
code via unknown attack vectors related to garbage collection.
(CVE-2006-0292)
The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1,
and SeaMonkey before 1.0 does not validate the attribute name, which
allows remote attackers to execute arbitrary Javascript by injecting
RDF data into the user's localstore.rdf file. (CVE-2006-0296)
Updated packages are patched to address these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4134http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0292http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0296
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
da643268d4704d938689f5fe2cca120f 2006.0/RPMS/libnspr4-1.0.6-16.4.20060mdk.i586.rpm
b6911002ac57b7d9aa2b250362eb800a 2006.0/RPMS/libnspr4-devel-1.0.6-16.4.20060mdk.i586.rpm
f0b33d31942402c9375e28b67b5af7a1 2006.0/RPMS/libnss3-1.0.6-16.4.20060mdk.i586.rpm
44be800d89df092daf5fb2cccbbd38cc 2006.0/RPMS/libnss3-devel-1.0.6-16.4.20060mdk.i586.rpm
23f78dfcad4ffac1232ac34021312140 2006.0/RPMS/mozilla-firefox-1.0.6-16.4.20060mdk.i586.rpm
f15d9c997aea3efc48cfb04534e0710a 2006.0/RPMS/mozilla-firefox-devel-1.0.6-16.4.20060mdk.i586.rpm
f1309fb4699a35abfb9d0ed618eae738 2006.0/SRPMS/mozilla-firefox-1.0.6-16.4.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
6f7649defa3b0f2ecb7fad32a22e780b x86_64/2006.0/RPMS/lib64nspr4-1.0.6-16.4.20060mdk.x86_64.rpm
bf965382a901febf026662823158aec0 x86_64/2006.0/RPMS/lib64nspr4-devel-1.0.6-16.4.20060mdk.x86_64.rpm
34e4b253f78196e93749150263447c94 x86_64/2006.0/RPMS/lib64nss3-1.0.6-16.4.20060mdk.x86_64.rpm
1d7cf344f788454a1b151fc886b88200 x86_64/2006.0/RPMS/lib64nss3-devel-1.0.6-16.4.20060mdk.x86_64.rpm
ef97a23ece3c504332437f395dad3f77 x86_64/2006.0/RPMS/mozilla-firefox-1.0.6-16.4.20060mdk.x86_64.rpm
a9f2be464482f4cf70120f12d5ff9e58 x86_64/2006.0/RPMS/mozilla-firefox-devel-1.0.6-16.4.20060mdk.x86_64.rpm
f1309fb4699a35abfb9d0ed618eae738 x86_64/2006.0/SRPMS/mozilla-firefox-1.0.6-16.4.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFD6SkBmqjQ0CJFipgRAmG6AKDLr8iRGL6o32c6ym3EhlEc9mwxMwCdG4v1
7iZEqez7JcYqPf7Be9eAEP8=
=OWST
-----END PGP SIGNATURE-----
