Date: Wed, 01 Aug 2007 15:03:24 -0400
From: Foresight Linux Essential Announcement Service <foresight-security-noreply@foresightlinux.org.>
To: [email protected]Subject: FLEA-2007-0039-1 firefox
Message-ID: <46b0d8fc.OdM/62pL5GZjkd5f%[email protected]>
User-Agent: Heirloom mailx 12.2 01/07/07
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Foresight Linux Essential Advisory: 2007-0039-1
Published: 2007-08-01
Rating: Moderate
Updated Versions:
firefox=/foresight.rpath.org@fl:1-devel//1/2.0.0.6-1-1
group-dist=/foresight.rpath.org@fl:1-devel//1/1.3.2-0.7-2
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845
https://issues.rpath.com/browse/RPL-1600
Description:
Previous versions of the firefox package are vulnerable to a flaw in
handling of "about:blank" windows. A malicious web server could exploit
this to steal sensitive information or modify contents of other open web
pages.
In addition, a malicious web server could execute helpers with arbitrary
arguments due to firefox's mishandling of certain types of characters when
launching external programs.
- ---
Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License.
A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)
iQIVAwUBRrDY+NfwEn07iAtZAQJvFQ/+MnWWYwJMIfW9l2jOzLBIdOXtJJfVI+sw
hRlf9Dj6bamB0vj1ntL4YPw6V2SQFKXkw92QFJwiyFcbC9l7np73eTNwJskR4VKb
5g8hKTdOjTEaU+VoJkUDSi/JA6RwRGJKn08+/ih7CuLkE8loYmFYbMiR+MxpbHoP
u82IAbYKTD4WqMbXuy34MImedvVWby3GxHI01RgqGtDhN9BwvRzmYrip04QUFJwJ
QP8xSlfNBkaL0e/7nTDmdWbAqhOYXPdxjQPG0cM9mp6omMnM0SIJ7Fm5UDGe69rb
zQm9DFUiCJnyQC8ra40dvdloxmk2en/ZXFgh4rE+Ghw+U7U1/IciWMdboUhdc+QV
NI3L/oyXkqSODIOBPehpUfpmg7aVuTXtrjlYugyR4NG5mx5XyQ6CaiZnhZy4c13V
QznFZQ8ZJuA960z+jfEsO4y2K8hsQ0z3iFesHW/CiUM1qWKIEKwGV0Uw0m2mWBUF
0ik23yeCzfwm+gJGt4GVqFMK4CjbuVZrT0IsCn3daefiyxFAabNLQJ6XeQB9KwJI
Jm6Nj5gPls1Vvip8VOu8QWoUkk9GkGQD1yX3YeyYRCrYAELhCZmbgrJz/NHnnDEF
sk9ofgcFvqliOIrgzdFDmEJTP01O/d/TFOSiu+LX82dllRowIfcJLvW2ZvH2AvVN
BBO5x3kCehA=
=2vlo
-----END PGP SIGNATURE-----
