GLSA 200612-07 Mozilla Firefox: Multiple vulnerabilities

Gentoo Linux Security Advisory GLSA 200612-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Mozilla Firefox: Multiple vulnerabilities
Date: December 10, 2006
Bugs: #154434
ID: 200612-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been reported in Mozilla Firefox.

Background
==========

Mozilla Firefox is a popular open-source web browser from the Mozilla
Project.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/mozilla-firefox lt; 1.5.0.8 gt;= 1.5.0.8
2 www-client/mozilla-firefox-bin lt; 1.5.0.8 gt;= 1.5.0.8
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------

Description
===========

Mozilla Firefox improperly handles Script objects while they are being
executed. Mozilla Firefox has also been found to be vulnerable to
various possible buffer overflows. Lastly, the binary release of
Mozilla Firefox is vulnerable to a low exponent RSA signature forgery
issue because it is bundled with a vulnerable version of NSS.

Impact
======

An attacker could entice a user to view specially crafted JavaScript
and execute arbitrary code with the rights of the user running Mozilla
Firefox. An attacker could also entice a user to view a specially
crafted web page that causes a buffer overflow and again executes
arbitrary code. It is also possible for an attacker to make up SSL/TLS
certificates that would not be detected as invalid by the binary
release of Mozilla Firefox, raising the possibility for
Man-in-the-Middle attacks.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mozilla Firefox users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose "gt;=www-client/mozilla-firefox-1.5.0.8"

All Mozilla Firefox binary release users should upgrade to the latest
version:

# emerge --sync
# emerge --ask --oneshot --verbose "gt;=www-client/mozilla-firefox-bin-1.5.0.8"

References
==========

[ 1 ] CVE-2006-5462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462
[ 2 ] CVE-2006-5463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5463
[ 3 ] CVE-2006-5464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5464
[ 4 ] CVE-2006-5747
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747
[ 5 ] CVE-2006-5748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5748

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200612-07.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5