SUSE Security Announcement: Mozilla Firefox (SUSE-SA:2010:030)

______________________________________________________________________________

SUSE Security Announcement

Package: MozillaFirefox,mozilla-xulrunner191
Announcement ID: SUSE-SA:2010:030
Date: Fri, 09 Jul 2010 13:00:00 +0000
Affected Products: openSUSE 11.0
openSUSE 11.1
openSUSE 11.2
SLE SDK 10 SP3
SUSE Linux Enterprise Desktop 10 SP3
SUSE Linux Enterprise Server 10 SP3
SUSE Linux Enterprise Software Development Kit 11
SUSE Linux Enterprise Desktop 11
SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Software Development Kit 11 SP1
SUSE Linux Enterprise Desktop 11 SP1
SUSE Linux Enterprise Server 11 SP1
Vulnerability Type: remote code execution
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
SUSE Default Package: yes
Cross-References: CVE-2008-5913, CVE-2010-0183, CVE-2010-1121
CVE-2010-1125, CVE-2010-1196, CVE-2010-1197
CVE-2010-1198, CVE-2010-1199, CVE-2010-1200
CVE-2010-1201, CVE-2010-1202, CVE-2010-1203
MFSA 2010-25, MFSA 2010-26, MFSA 2010-27
MFSA 2010-28, MFSA 2010-29, MFSA 2010-30
MFSA 2010-31, MFSA 2010-32, MFSA 2010-33

Content of This Advisory:
1) Security Vulnerability Resolved:
Mozilla Firefox security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

Mozilla Firefox was updated to version 3.5.10, fixing various bugs
and security issues.

MFSA 2010-33 / CVE-2008-5913:
Security researcher Amit Klein reported that it was possible to reverse
engineer the value used to seed Math.random(). Since the pseudo-random
number generator was only seeded once per browsing session, this seed
value could be used as a unique token to identify and track users
across different web sites.

MFSA 2010-32 / CVE-2010-1197:
Security researcher Ilja van Sprundel of IOActive reported that
the Content-Disposition: attachment HTTP header was ignored when
Content-Type: multipart was also present. This issue could potentially
lead to XSS problems in sites that allow users to upload arbitrary
files and specify a Content-Type but rely on Content-Disposition:
attachment to prevent the content from being displayed inline.

MFSA 2010-31 / CVE-2010-1125:
Google security researcher Michal Zalewski reported that focus()
could be used to change a user's cursor focus while they are
typing, potentially directing their keyboard input to an unintended
location. This behavior was also present across origins when content
from one domain was embedded within another via an IFRAME. A malicious
web page could use this behavior to steal keystrokes from a victim
while they were typing sensitive information such as a password.

MFSA 2010-30 / CVE-2010-1199:
Security researcher Martin Barbella reported via TippingPoint's Zero
Day Initiative that an XSLT node sorting routine contained an integer
overflow vulnerability. In cases where one of the nodes to be sorted
contained a very large text value, the integer used to allocate a
memory buffer to store its value would overflow, resulting in too small
a buffer being created. An attacker could use this vulnerability to
write data past the end of the buffer, causing the browser to crash
and potentially running arbitrary code on a victim's computer.

MFSA 2010-29 / CVE-2010-1196:
Security researcher Nils of MWR InfoSecurity reported that the routine
for setting the text value for certain types of DOM nodes contained an
integer overflow vulnerability. When a very long string was passed to
this routine, the integer value used in creating a new memory buffer
to hold the string would overflow, resulting in too small a buffer
being allocated. An attacker could use this vulnerability to write
data past the end of the buffer, causing a crash and potentially
running arbitrary code on a victim's computer.

MFSA 2010-28 / CVE-2010-1198:
Microsoft Vulnerability Research reported that two plugin instances
could interact in a way in which one plugin gets a reference to an
object owned by a second plugin and continues to hold that reference
after the second plugin is unloaded and its object is destroyed. In
these cases, the first plugin would contain a pointer to freed memory
which, if accessed, could be used by an attacker to execute arbitrary
code on a victim's computer.

MFSA 2010-27 / CVE-2010-0183:
Security researcher wushi of team509 reported that the frame
construction process for certain types of menus could result in a menu
containing a pointer to a previously freed menu item. During the cycle
collection process, this freed item could be accessed, resulting in the
execution of a section of code potentially controlled by an attacker.

MFSA 2010-26 / CVE-2010-1200 / CVE-2010-1201 / CVE-2010-1202 / CVE-2010-1203:
Mozilla developers identified and fixed several stability bugs in the
browser engine used in Firefox and other Mozilla-based products. Some
of these crashes showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some
of these could be exploited to run arbitrary code.

MFSA 2010-25 / CVE-2010-1121:
A memory corruption flaw leading to code execution was reported by
security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own
contest sponsored by TippingPoint's Zero Day Initiative. By moving
DOM nodes between documents Nils found a case where the moved node
incorrectly retained its old scope. If garbage collection could
be triggered at the right time then Firefox would later use this
freed object. The contest winning exploit only affects Firefox 3.6
and not earlier versions. Updated (June 22, 2010): Firefox 3.5,
SeaMonkey 2.0, and Thunderbird 3.0 based on earlier versions of the
browser engine were patched just in case there is an alternate way
of triggering the underlying flaw.

2) Solution or Work-Around

There is no known workaround, please install the update packages.

3) Special Instructions and Notes

Please close and restart all running instances of Mozilla Firefox after the update.

4) Package Location and Checksums

The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command

rpm -Fhv

to apply the update, replacing with the filename of the
downloaded RPM package.


x86 Platform:

openSUSE 11.2:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

openSUSE 11.1:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

openSUSE 11.0:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

Power PC Platform:

openSUSE 11.1:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

openSUSE 11.0:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

x86-64 Platform:

openSUSE 11.2:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

openSUSE 11.1:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

openSUSE 11.0:
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found
302 Found

Sources:

openSUSE 11.2:
302 Found
302 Found
302 Found

openSUSE 11.1:
302 Found
302 Found

openSUSE 11.0:
302 Found
302 Found

Our maintenance customers are notified individually. The packages are
offered for installation from the maintenance web:

SUSE Linux Enterprise Server 11 SP1
NOVELL: Patch Finder

SUSE Linux Enterprise Desktop 11 SP1
NOVELL: Patch Finder

SUSE Linux Enterprise Software Development Kit 11 SP1
NOVELL: Patch Finder

SLE SDK 10 SP3
NOVELL: Patch Finder

SUSE Linux Enterprise Server 10 SP3
NOVELL: Patch Finder

SUSE Linux Enterprise Desktop 10 SP3
NOVELL: Patch Finder

SUSE Linux Enterprise Server 11
NOVELL: Patch Finder

SUSE Linux Enterprise Desktop 11
NOVELL: Patch Finder

SUSE Linux Enterprise Software Development Kit 11
NOVELL: Patch Finder

______________________________________________________________________________

5) Pending Vulnerabilities, Solutions, and Work-Arounds:

See SUSE Security Summary Report.