Secure testing team - Nov 2008 - Bug#505558: Mozilla Firefox 2 Multiple Vulnerabilities

Package: iceweasel
Version: 2.0.0.17-0etch1
Severity: critical
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

The following SA (Secunia Advisory) id was published for Firefox 2:

SA32693[1]

Description:
Some vulnerabilities have been reported in Mozilla Firefox, which can be
exploited by malicious people to disclose sensitive information, bypass
certain security restrictions, or compromise a user''s system.

1) An error in the processing of ".url" shortcuts can be exploited to
obtain sensitive information from the local cache.

For more information:
SA32192

2) An error in the handling of HTTP redirect requests can be exploited
to bypass the same-origin policy and access sensitive information from
another domain.

3) An error exists when testing if a Flash module is dynamically
unloaded. This can be exploited to dereference memory no longer mapped
to the Flash module via an SWF file that dynamically unloads itself from
an outside JavaScript function.

4) An error when locking a non-native object can be exploited to cause a
crash via a web page assigning a specially crafted value to the
"window.__proto__.__proto__" object.

5) An error in the browser engine can be exploited to cause a memory
corruption.

6) Two errors in the JavaScript engine can be exploited to cause memory
corruptions.

Successful exploitation of vulnerabilities #3-#6 may allow execution of
arbitrary code.

7) An error in the browser''s restore feature can be exploited to
violate
the same-origin policy and run arbitrary JavaScript code in the context
of another site.

NOTE: The vulnerability can also be exploited to execute arbitrary
JavaScript code with chrome privileges.

8) An error in the processing of the "http-index-format" MIME type can
be exploited to execute arbitrary code via a specially crafted 200
header line included in an HTTP index response.

9) An error in the DOM constructing code can be exploited to dereference
uninitialized memory and potentially execute arbitrary code by modifying
certain properties of a file input element before the element has
finished initializing.

10) An error in the implementation of the
"nsXMLHttpRequest::NotifyEventListeners()" method can be exploited to
execute arbitrary JavaScript code in the context of another site.

11) An error when handling the "-moz-binding" CSS property can be
exploited to manipulate signed JAR files and execute arbitrary
JavaScript code in the context of another site.

12) An error exists when parsing the default XML namespace of an E4X
document. This can be exploited to inject arbitrary XML code via a
specially crafted namespace containing quote characters.

The vulnerabilities are reported in versions prior to 2.0.0.18.

Solution:
Update to version 2.0.0.18.

CVE reference:
CVE-2008-0017
CVE-2008-4582
CVE-2008-5012
CVE-2008-5013
CVE-2008-5014
CVE-2008-5017
CVE-2008-5018
CVE-2008-5019
CVE-2008-5021
CVE-2008-5022
CVE-2008-5023
CVE-2008-5024


If you fix the vulnerability please also make sure to include the the
CVE id in the changelog entry.

[1] http://secunia.com/advisories/32693/



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkcOnkACgkQNxpp46476aq8uwCeOoUJekricOaj+E04X2PPg3bf
5wQAniz3ycwyj0KlvdGJvTFAum/tBrlV
=qeCk
-----END PGP SIGNATURE-----