sdkp3-MozillaFirefoxSecurity update for Mozilla Firefox
This update brings Mozilla Firefox to the 3.5.11 security release.
It fixes following security issues:
*
Several memory safety bugs in habe been identified in the browser
engine used in Firefox and other Mozilla-based products. Some of
these bugs show evidence of memory corruption under certain
circumstances, and it is presumed that with enough effort at least
some of these could be exploited to run arbitrary code.
((http://www.mozilla.org/security/announce/2010/mfsa2010-34.html)[MFSA
2010-34],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1211)[CVE-2010-1211])
*
An error in the DOM attribute cloning routine has been reported,
where under certain circumstances an event attribute node can be
deleted while another object still contains a reference to it. This
reference could subsequently be accessed, potentially causing the
execution of attacker controlled memory.
((http://www.mozilla.org/security/announce/2010/mfsa2010-35.html)[MFSA
2010-35],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1208)[CVE-2010-1208])
*
An error in Mozilla's implementation of NodeIterator has been
reported which can be used to create a malicious NodeFilter to detach
nodes from the DOM tree while it is being traversed. The use of a
detached and subsequently deleted node could result in the execution
of attacker controlled memory.
((http://www.mozilla.org/security/announce/2010/mfsa2010-36.html)[MFSA
2010-36],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1209)[CVE-2010-1209])
*
An error in the code used to store the names and values of plugin
parameter elements has been found. A malicious page could embed
plugin content containing a very large number of parameter elements
which would cause an overflow in the integer value counting them.
This integer is later used for allocation of a memory buffer to store
the plugin parameters. Under such conditions, a buffer that is too
small would be created and attacker controlled data could be written
past the end of the buffer, potentially resulting in code execution.
((http://www.mozilla.org/security/announce/2010/mfsa2010-37.html)[MFSA
2010-37],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1214)[CVE-2010-1214])
*
An array class used to store CSS values contains an integer overflow
vulnerability. A 16 bit integer used to allocate the memory for the
array could overflow, resulting in too small a buffer being created.
When the array is later populated with CSS values, data could be
written past the end of the buffer, potentially resulting in the
execution of attacker controlled memory.
((http://www.mozilla.org/security/announce/2010/mfsa2010-39.html)[MFSA
2010-39],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2752)[CVE-2010-2752])
*
An integer overflow vulnerability in the implementation of the XUL
<tree> element's selection attribute has been found. When the size of
a new selection is sufficiently large, the integer used in
calculating the length of the selection can overflow, resulting in a
bogus range being marked as selected. When adjustSelection is then
called on the bogus range, the range is deleted, leaving dangling
references to the ranges. These could be used by an attacker to call
into deleted memory and run arbitrary code on a victim's computer.
((http://www.mozilla.org/security/announce/2010/mfsa2010-40.html)[MFSA
2010-40],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2753)[CVE-2010-2753])
*
A buffer overflow in Mozilla graphics code which consumes image data
processed by libpng has been reported. A malformed PNG file could be
created causing libpng to report an incorrect size of the image. When
the dimensions of such images are underreported, the Mozilla code
displaying the graphic will allocate a memory buffer to small to
contain the image data and will wind up writing data past the end of
the buffer. This could result in the execution of attacker-controlled
memory.
((http://www.mozilla.org/security/announce/2010/mfsa2010-41.html)[MFSA
2010-41],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205)[CVE-2010-1205])
*
The Web Worker method importScripts can read and parse resources from
other domains even when the content is not valid JavaScript. This is
a violation of the same-origin policy and could be used by an
attacker to steal information from other sites.
((http://www.mozilla.org/security/announce/2010/mfsa2010-42.html)[MFSA
2010-42],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1213)[CVE-2010-1213])
*
Two methods for spoofing the content of the location bar have been
reported. The first method works by opening a new window containing a
resource that responds with an HTTP 204 (no content) and then using
the reference to the new window to insert HTML content into the blank
document. The second location bar spoofing method does not require
that the resource opened in a new window respond with 204, as long as
the opener calls window.stop() before the document is loaded. In
either case a user could be mislead about the correct location of the
document they are currently viewing.
((http://www.mozilla.org/security/announce/2010/mfsa2010-45.html)[MFSA
2010-45],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1206)[CVE-2010-1206])
*
The location bar can be spoofed to look like a secure page even
though the current document was served via plaintext. The
vulnerability is triggered by a server by first redirecting a request
for a plaintext resource to another resource behind a valid SSL/TLS
certificate. A second request made to the original plaintext resource
which is responded to not with a redirect, but with JavaScript
calling history.back() and history.forward() will result in the
plaintext resource being displayed with a valid SSL/TLS badge in the
location bar.
((http://www.mozilla.org/security/announce/2010/mfsa2010-45.html)[MFSA
2010-45],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2751)[CVE-2010-2751])
*
Data can be read across domains by injecting bogus CSS selectors into
a target site and then retrieving the data using JavaScript APIs. If
an attacker can inject opening and closing portions of a CSS selector
into points A and B of a target page, then the region between the two
injection points becomes readable to JavaScript through, for example,
the getComputedStyle() API.
((http://www.mozilla.org/security/announce/2010/mfsa2010-46.html)[MFSA
2010-46],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0654)[CVE-2010-0654])
*
Potentially sensitive URL parameters can be leaked across domains
upon script errors when the script filename and line number is
included in the error message.
((http://www.mozilla.org/security/announce/2010/mfsa2010-47.html)[MFSA
2010-47],
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2754)[CVE-2010-2754])
securityMozillaFirefox-branding-upstreami5864a0e49660381ea16cdfa9f1f9757199a48607374mozilla-xulrunner191-develx86_64461b61ad8936f78c3309e85346e9179b0bee230fpython-xpcom191x86_643eb15d558056fdbc3e22cca1b0cb253c9961751a