Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Mozilla Firefox Multiple Vulnerabilities

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Vulnerabilities

See the original Secunia advisory:
Mozilla Firefox Multiple Vulnerabilities

Secunia Mozilla Firefox Multiple Vulnerabilities
Secunia Official 29th Jun, 2010 07:32
Ranking: 0
Posts: 0
User Since: -
System Score: -
Location: Copenhagen, DK
Some vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to disclose sensitive information, bypass certain security restrictions, or to compromise a user's system.

1) Multiple errors in the browser engine can be exploited to corrupt memory and potentially execute arbitrary code.

2) An error in the handling of multipart/x-mixed-replace resources can be exploited to corrupt memory and potentially execute arbitrary code.

This vulnerability only affects version 3.5.x.

3) Multiple errors in the Javascript engine can be exploited to corrupt memory and potentially execute arbitrary code.

4) Multiple errors in the Javascript engine can be exploited to corrupt memory and potentially execute arbitrary code.

These errors only affect version 3.6.x.

5) A use-after-free error exists in "nsCycleCollector::MarkRoots()", which can result in the use of an invalid pointer and allows execution of arbitrary code.

6) A use-after-free error in the handling of object references among multiple plugin instances can be exploited to trigger the use of an invalid pointer and execute arbitrary code.

7) An integer overflow error exists in "nsGenericDOMDataNode::SetTextInternal" within the handling of text values for certain types of DOM nodes. This can be exploited to cause a heap-based buffer overflow via overly large strings.

8) An integer overflow error in a XSLT node sorting routine can be exploited to cause a buffer overflow and potentially execute arbitrary code via a node containing an overly large text value.

9) A weakness is caused due to "focus()" allowing to direct user input to unintended locations, e.g. an embedded iframe from another domain.

10) The HTTP "Content-Disposition: attachment" header is ignored when "Content-Type: multipart" is also present. This can result in security features being bypassed in sites that allow users to upload arbitrary files and specify a "Content-Type" but rely on "Content-Disposition: attachment" to prevent the content from being displayed inline.

11) A weakness exists due to the pseudo-random number generator being seeded only once per browsing session, which can be exploited to disclose the value used to seed "Math.random()" and potentially identify and track users across different web sites.

howiem9999 RE: Mozilla Firefox Multiple Vulnerabilities
Member 29th Jun, 2010 07:32
Score: 2
Posts: 31
User Since: 8th Dec 2008
System Score: 100%
Location: TH
Last edited on 29th Jun, 2010 07:32
Firefpx just had an update to 3.6.6 (non-security), so the advisory should probably indicate that users should update to version 3.5.10 or 3.6.4 or 3.6.6

--
howiem
Was this reply relevant?
+0
-0
taffy078 RE: Mozilla Firefox Multiple Vulnerabilities
Contributor 29th Jun, 2010 07:48
Score: 408
Posts: 1,335
User Since: 26th Feb 2009
System Score: 100%
Location: UK
Last edited on 29th Jun, 2010 07:49
I hope Secunia won't mind me posting here that the new Auto-Updates (Technology Preview) has already updated this:

************************************************

Update history

25 June 2010 19:03:54 --> Successfully updated Mozilla Firefox 3.6.x from version 3.6.3 to version 3.6.4


*************************************************

Well done, Secunia!

--
taffy078, West Yorkshire, UK

Desktop: Compaq Presario (OEM) 32 bit / AMD Athlon / 2 GB RAM
XP Home - SP3/ IE8/ Norton IS - Secunia PSI v2.0.0.3003

Laptop: Win 7 / IE11 / PSI v2.0.0.3003
Was this reply relevant?
+5
-0
GyroGearloose RE: Mozilla Firefox Multiple Vulnerabilities
Member 3rd Jul, 2010 15:51
Score: 0
Posts: 6
User Since: 20th Jun 2009
System Score: N/A
Location: N/A
Cool. How did you do this

PSI gave me only update to 3.6.4, via "Download solution"

I am using PSI. 1.5.0.2 on Win XP.
Was this reply relevant?
+0
-0
taffy078 RE: Mozilla Firefox Multiple Vulnerabilities
Contributor 3rd Jul, 2010 16:59
Score: 408
Posts: 1,335
User Since: 26th Feb 2009
System Score: 100%
Location: UK
Last edited on 3rd Jul, 2010 17:01
Hi Gyrogearloose.

I (and many others here) have Secunia PSI v1.9.0.0 which has an Auto-update facility.

Go to the PSI 2.0 TP forum (on the left) where you will find this thread:

SI Auto-Update Technology Preview (TP) .

There you will find you can download the Technology Preview of the Secunia PSI with Auto Updates here:

http://secunia.com/PSISetupAUTP.exe


This will create a new tab on the main Secunia page, between "Overview" and "Insecure". It will then give you a list of programs that will be auto up-dated when you "tick the box".

Hoping this helps.

--
taffy078, West Yorkshire, UK

Desktop: Compaq Presario (OEM) 32 bit / AMD Athlon / 2 GB RAM
XP Home - SP3/ IE8/ Norton IS - Secunia PSI v2.0.0.3003

Laptop: Win 7 / IE11 / PSI v2.0.0.3003
Was this reply relevant?
+2
-0
GyroGearloose RE: Mozilla Firefox Multiple Vulnerabilities
Member 4th Jul, 2010 18:18
Score: 0
Posts: 6
User Since: 20th Jun 2009
System Score: N/A
Location: N/A
Hi Taffy and others,

Thanks for your replies.
I have started latest PSI with AutoUpdate. Let's see.

Cheers
GyroGearloose
Was this reply relevant?
+0
-0
taffy078 RE: Mozilla Firefox Multiple Vulnerabilities
Contributor 4th Jul, 2010 18:51
Score: 408
Posts: 1,335
User Since: 26th Feb 2009
System Score: 100%
Location: UK
Last edited on 4th Jul, 2010 18:53
Fingers crossed for you, GyroGearloose!!!

A tip though: being fairly new, you probably won't be aware that this section - Vulnerabilities - is used by Secunia to provide information about vulnerabilities.

Members don't usually get involved in discussions here.

So if you still have problems, please start a new thread in 'Programs' when you come back - with a link to this.

Hopefully you won't need to, though! You will have resolved your problem!

Hoping this helps.

Regards





--
taffy078, West Yorkshire, UK

Desktop: Compaq Presario (OEM) 32 bit / AMD Athlon / 2 GB RAM
XP Home - SP3/ IE8/ Norton IS - Secunia PSI v2.0.0.3003

Laptop: Win 7 / IE11 / PSI v2.0.0.3003
Was this reply relevant?
+4
-0

jaw001

RE: Mozilla Firefox Multiple Vulnerabilities
[+]
This reply has been minimised due to a negative Relevancy Score.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability - Disclaimer