sdkp2-MozillaFirefoxSecurity update for Mozilla FirefoxSecurity update for Mozilla FirefoxMozillaFirefox was updated to the 3.0.13 release, fixing
some security issues and bugs:
MFSA 2009-44 / CVE-2009-2654: Security researcher Juan
Pablo Lopez Yacubian reported that an attacker could call
window.open() on an invalid URL which looks similar to a
legitimate URL and then use document.write() to place
content within the new document, appearing to have come
from the spoofed location. Additionally, if the spoofed
document was created by a document with a valid SSL
certificate, the SSL indicators would be carried over into
the spoofed document. An attacker could use these issues to
display misleading location and SSL information for a
malicious web page.
MFSA 2009-45 / CVE-2009-2662:The browser engine in Mozilla
Firefox before 3.0.13, and 3.5.x before 3.5.2, allows
remote attackers to cause a denial of service (memory
corruption and application crash) or possibly execute
arbitrary code via vectors related to the
TraceRecorder::snapshot function in js/src/jstracer.cpp,
and unspecified other vectors.
CVE-2009-2663 / MFSA 2009-45: libvorbis before r16182, as
used in Mozilla Firefox before 3.0.13 and 3.5.x before
3.5.2 and other products, allows context-dependent
attackers to cause a denial of service (memory corruption
and application crash) or possibly execute arbitrary code
via a crafted .ogg file.
CVE-2009-2664 / MFSA 2009-45: The js_watch_set function in
js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla
Firefox before 3.0.13, and 3.5.x before 3.5.2, allows
remote attackers to cause a denial of service (assertion
failure and application exit) or possibly execute arbitrary
code via a crafted .js file, related to a "memory safety
bug."
MozillaFirefox was updated to the 3.0.13 release, fixing
some security issues and bugs:
MFSA 2009-44 / CVE-2009-2654: Security researcher Juan
Pablo Lopez Yacubian reported that an attacker could call
window.open() on an invalid URL which looks similar to a
legitimate URL and then use document.write() to place
content within the new document, appearing to have come
from the spoofed location. Additionally, if the spoofed
document was created by a document with a valid SSL
certificate, the SSL indicators would be carried over into
the spoofed document. An attacker could use these issues to
display misleading location and SSL information for a
malicious web page.
MFSA 2009-45 / CVE-2009-2662:The browser engine in Mozilla
Firefox before 3.0.13, and 3.5.x before 3.5.2, allows
remote attackers to cause a denial of service (memory
corruption and application crash) or possibly execute
arbitrary code via vectors related to the
TraceRecorder::snapshot function in js/src/jstracer.cpp,
and unspecified other vectors.
CVE-2009-2663 / MFSA 2009-45: libvorbis before r16182, as
used in Mozilla Firefox before 3.0.13 and 3.5.x before
3.5.2 and other products, allows context-dependent
attackers to cause a denial of service (memory corruption
and application crash) or possibly execute arbitrary code
via a crafted .ogg file.
CVE-2009-2664 / MFSA 2009-45: The js_watch_set function in
js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla
Firefox before 3.0.13, and 3.5.x before 3.5.2, allows
remote attackers to cause a denial of service (assertion
failure and application exit) or possibly execute arbitrary
code via a crafted .js file, related to a "memory safety
bug."
securityMozillaFirefox-branding-upstreami586926c78b70abdc96d0d63277ad16b19f63d324f83firefox3-atk-develi58670ece96aa8486137eb71f5b1c65e79219bf665d6firefox3-atk-doci586f2e8c97f229092a20fec2aae65b4400c3a3c0ad4firefox3-cairo-develi5861a5531cfd9a3237d351e9f619234bcb9bdf803b0firefox3-cairo-doci586bf0e900ae5633d380f5b22e0e0bc59f29a60c175firefox3-glib2-develi5867516ef3fe48ee60c068ec3d4922ee60fad4b0bebfirefox3-glib2-doci5861342e239b852af5d3ac4edbf6bafb0cfa2e1ba92firefox3-gtk2-develi586883e8894da85c9c691cf8a40a64a08c7c9d60557firefox3-gtk2-doci5860ec91e089350dbfa0cbe4cf3d2b12eb17c3e3e8efirefox3-pango-develi58634c84d027470e92ca115c891b74ea81597263f06firefox3-pango-doci5867b7a9514703475e16740e531d20b8626d84978d5mozilla-xulrunner190-develi586f925a1e79001947c028b1012723c7a57349f3553python-xpcom190i58643191c254c1405be5ff8280a82ea1a1bfedb7ac2