[ GLSA 200507-24 ] Mozilla Suite: Multiple vulnerabilities

From: Sune Kloppenborg Jeppesen (jaervosz_at_gentoo.org)
Date: 07/26/05

  • Next message: devnull_at_Rodents.Montreal.QC.CA: "Re: Peter Gutmann data deletion theaory?" 
    To: gentoo-announce@gentoo.org
Date: Tue, 26 Jul 2005 21:23:27 +0200

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200507-24
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: Mozilla Suite: Multiple vulnerabilities
          Date: July 26, 2005
          Bugs: #98846
            ID: 200507-24

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Several vulnerabilities in the Mozilla Suite allow attacks ranging from
    the execution of javascript code with elevated privileges to
    information leakage.

    Background
    ==========

    The Mozilla Suite is an all-in-one Internet application suite including
    a web browser, an advanced e-mail and newsgroup client, IRC client and
    HTML editor.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 www-client/mozilla < 1.7.10 >= 1.7.10
      2 www-client/mozilla-bin < 1.7.10 >= 1.7.10
        -------------------------------------------------------------------
         2 affected packages on all of their supported architectures.
        -------------------------------------------------------------------

    Description
    ===========

    The following vulnerabilities were found and fixed in the Mozilla
    Suite:

    * "moz_bug_r_a4" and "shutdown" discovered that the Mozilla Suite was
      improperly cloning base objects (MFSA 2005-56).

    * "moz_bug_r_a4" reported that the suite failed to validate XHTML DOM
      nodes properly (MFSA 2005-55).

    * Secunia reported that alerts and prompts scripts are presented with
      the generic title [JavaScript Application] which could lead to
      tricking a user (MFSA 2005-54).

    * Andreas Sandblad of Secunia reported that top.focus() can be called
      in the context of a child frame even if the framing page comes from a
      different origin and has overridden the focus() routine (MFSA
      2005-52).

    * Secunia reported that a frame-injection spoofing bug which was
      fixed in earlier versions, was accidently bypassed in Mozilla Suite
      1.7.7 (MFSA 2005-51).

    * "shutdown" reported that InstallVersion.compareTo() might be
      exploitable. When it gets an object rather than a string, the browser
      would generally crash with an access violation (MFSA 2005-50).

    * Matthew Mastracci reported that by forcing a page navigation
      immediately after calling the install method can end up running in
      the context of the new page selected by the attacker (MFSA 2005-48).

    * "moz_bug_r_a4" reported that XBL scripts run even when Javascript
      is disabled (MFSA 2005-46).

    * Omar Khan, Jochen, "shutdown" and Matthew Mastracci reported that
      the Mozilla Suite incorrectly distinguished between true events like
      mouse clicks or keystrokes and synthetic events generated by a web
      content (MFSA 2005-45).

    Impact
    ======

    A remote attacker could craft malicious web pages that would leverage
    these issues to inject and execute arbitrary javascript code with
    elevated privileges, steal cookies or other information from web pages,
    or spoof content.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All Mozilla Suite users should upgrade to the latest version:

        # emerge --sync
        # emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.10"

    All Mozilla Suite binary users should upgrade to the latest version:

        # emerge --sync
        # emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.10"

    References
    ==========

      [ 1 ] Mozilla Foundation Security Advisories
            http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200507-24.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2005 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/2.0

  • Next message: devnull_at_Rodents.Montreal.QC.CA: "Re: Peter Gutmann data deletion theaory?"

    Relevant Pages