MDVSA-2010:251-2

Package name
firefox
Date
2010-12-24
Advisory ID
MDVSA-2010:251-2
Affected versions
2010.0 x86_64 , 2010.0 i586

Problem description

Security issues were identified and fixed in firefox:

Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that
the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are
vulnerable to XSS attacks due to some characters being converted to
angle brackets when displayed by the rendering engine. Sites using
these character encodings would thus be potentially vulnerable to
script injection attacks if their script filtering code fails to
strip out these specific characters (CVE-2010-3770).

Google security researcher Michal Zalewski reported that when a
window was opened to a site resulting in a network or certificate
error page, the opening site could access the document inside the
opened window and inject arbitrary content. An attacker could use
this bug to spoof the location bar and trick a user into thinking
they were on a different site than they actually were (CVE-2010-3774).

Mozilla security researcher moz_bug_r_a4 reported that the fix for
CVE-2010-0179 could be circumvented permitting the execution of
arbitrary JavaScript with chrome privileges (CVE-2010-3773).

Security researcher regenrecht reported via TippingPoint's Zero
Day Initiative that JavaScript arrays were vulnerable to an integer
overflow vulnerability. The report demonstrated that an array could
be constructed containing a very large number of items such that when
memory was allocated to store the array items, the integer value used
to calculate the buffer size would overflow resulting in too small a
buffer being allocated. Subsequent use of the array object could then
result in data being written past the end of the buffer and causing
memory corruption (CVE-2010-3767).

Security researcher regenrecht reported via TippingPoint's Zero Day
Initiative that a nsDOMAttribute node can be modified without informing
the iterator object responsible for various DOM traversals. This
flaw could lead to a inconsistent state where the iterator points
to an object it believes is part of the DOM but actually points to
some other object. If such an object had been deleted and its memory
reclaimed by the system, then the iterator could be used to call into
attacker-controlled memory (CVE-2010-3766).

Security researcher Gregory Fleischer reported that when a Java
LiveConnect script was loaded via a data: URL which redirects via a
meta refresh, then the resulting plugin object was created with the
wrong security principal and thus received elevated privileges such
as the abilities to read local files, launch processes, and create
network connections (CVE-2010-3775).

Mozilla added the OTS font sanitizing library to prevent downloadable
fonts from exposing vulnerabilities in the underlying OS font
code. This library mitigates against several issues independently
reported by Red Hat Security Response Team member Marc Schoenefeld
and Mozilla security researcher Christoph Diehl (CVE-2010-3768).

Security researcher wushi of team509 reported that when a XUL
tree had an HTML \ element nested inside a \
element then code attempting to display content in the XUL tree would
incorrectly treat the \ element as a parent node to tree content
underneath it resulting in incorrect indexes being calculated for the
child content. These incorrect indexes were used in subsequent array
operations which resulted in writing data past the end of an allocated
buffer. An attacker could use this issue to crash a victim's browser
and run arbitrary code on their machine (CVE-2010-3772).

Security researcher echo reported that a web page could open a window
with an about:blank location and then inject an \ element
into that page which upon submission would redirect to a chrome:
document. The effect of this defect was that the original page would
wind up with a reference to a chrome-privileged object, the opened
window, which could be leveraged for privilege escalation attacks
(CVE-2010-3771).

Dirk Heinrich reported that on Windows platforms when document.write()
was called with a very long string a buffer overflow was caused in line
breaking routines attempting to process the string for display. Such
cases triggered an invalid read past the end of an array causing a
crash which an attacker could potentially use to run arbitrary code
on a victim's computer (CVE-2010-3769).

Mozilla developers identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption
under certain circumstances, and we presume that with enough effort
at least some of these could be exploited to run arbitrary code
(CVE-2010-3776, CVE-2010-3777).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

Additionally, some packages which require so, have been rebuilt and
are being provided as updates.

Update:

A mistake was done with the MDVSA-2010:251 and the MDVSA-2010:251-1
advisories where the localization files for firefox software was NOT
updated to the 3.6.13 version. The secteam wishes to apologise for
the unfortunate mistake and also wishes everyone a great christmas.

Regards // Santa Claus

Updated packages

2010.0 x86_64

 90ee7ef70f0ed9b8a023f487fcf4e413  2010.0/x86_64/firefox-af-3.6.13-0.1mdv2010.0.x86_64.rpm
 7a8db0170b92be6c166ec2b623b2707b  2010.0/x86_64/firefox-ar-3.6.13-0.1mdv2010.0.x86_64.rpm
 031f5e5d3f80ea9ed418b5bb5f2a3ba3  2010.0/x86_64/firefox-be-3.6.13-0.1mdv2010.0.x86_64.rpm
 bb10396543f4f8992b0b29490b754156  2010.0/x86_64/firefox-bg-3.6.13-0.1mdv2010.0.x86_64.rpm
 56d6dc548effe1dfb99375ebbab83110  2010.0/x86_64/firefox-bn-3.6.13-0.1mdv2010.0.x86_64.rpm
 2b26fea0598169f83119d4abf67f75b4  2010.0/x86_64/firefox-ca-3.6.13-0.1mdv2010.0.x86_64.rpm
 2a75e8187c485e66c07cbb494e205f67  2010.0/x86_64/firefox-cs-3.6.13-0.1mdv2010.0.x86_64.rpm
 9acf2056329ccf268459b9f8869aa665  2010.0/x86_64/firefox-cy-3.6.13-0.1mdv2010.0.x86_64.rpm
 7fd55a1c2ca4aab57960f5a154b03fc2  2010.0/x86_64/firefox-da-3.6.13-0.1mdv2010.0.x86_64.rpm
 f640b8090f081b80f9c792d62508f262  2010.0/x86_64/firefox-de-3.6.13-0.1mdv2010.0.x86_64.rpm
 84fbc6618105b07f1ffb092b93eb22c8  2010.0/x86_64/firefox-el-3.6.13-0.1mdv2010.0.x86_64.rpm
 cc82ac560dba27946b66421b6d865214  2010.0/x86_64/firefox-en_GB-3.6.13-0.1mdv2010.0.x86_64.rpm
 40c084c599553f1d7682e5f14b21be2c  2010.0/x86_64/firefox-eo-3.6.13-0.1mdv2010.0.x86_64.rpm
 257cf94282e66d758a17d49e65ddeabe  2010.0/x86_64/firefox-es_AR-3.6.13-0.1mdv2010.0.x86_64.rpm
 32ab2abdfa90f8e8df798e9d8dd27c6a  2010.0/x86_64/firefox-es_ES-3.6.13-0.1mdv2010.0.x86_64.rpm
 f5abe36055b8cb0f5eb9d8fb3cfa460d  2010.0/x86_64/firefox-et-3.6.13-0.1mdv2010.0.x86_64.rpm
 c2833038ded3a3d153745ab65622dc41  2010.0/x86_64/firefox-eu-3.6.13-0.1mdv2010.0.x86_64.rpm
 05606aa38fbd3372025c80f264efce82  2010.0/x86_64/firefox-fi-3.6.13-0.1mdv2010.0.x86_64.rpm
 4ba9d8d51abb53cc6140f3fb162249b2  2010.0/x86_64/firefox-fr-3.6.13-0.1mdv2010.0.x86_64.rpm
 08d93c6a600c8428394ab1ec4f43b6c6  2010.0/x86_64/firefox-fy-3.6.13-0.1mdv2010.0.x86_64.rpm
 27b466dc3d935e1b482d5c4626da1ecd  2010.0/x86_64/firefox-ga_IE-3.6.13-0.1mdv2010.0.x86_64.rpm
 26d8bccfce7a9d12e7d1d294a0ed27a6  2010.0/x86_64/firefox-gl-3.6.13-0.1mdv2010.0.x86_64.rpm
 a7373b752ad8b18b6651b2c97d3636ce  2010.0/x86_64/firefox-gu_IN-3.6.13-0.1mdv2010.0.x86_64.rpm
 30d6ccc3c98bd493310a506bd82eb0e0  2010.0/x86_64/firefox-he-3.6.13-0.1mdv2010.0.x86_64.rpm
 30b2215b836eed4c6668f1ff18b64acc  2010.0/x86_64/firefox-hi-3.6.13-0.1mdv2010.0.x86_64.rpm
 dc9da7ca00ac0afde0508e1de64ed35d  2010.0/x86_64/firefox-hu-3.6.13-0.1mdv2010.0.x86_64.rpm
 e755d45b5cc722c26318894987414a61  2010.0/x86_64/firefox-id-3.6.13-0.1mdv2010.0.x86_64.rpm
 88fc1659596995ae730352c8576d5dba  2010.0/x86_64/firefox-is-3.6.13-0.1mdv2010.0.x86_64.rpm
 774696079df943baf5a1508d98494d79  2010.0/x86_64/firefox-it-3.6.13-0.1mdv2010.0.x86_64.rpm
 8288b734d373dd3172c82a0bb99a0c88  2010.0/x86_64/firefox-ja-3.6.13-0.1mdv2010.0.x86_64.rpm
 601bee0d8eb753d5816c153af9e3ffb8  2010.0/x86_64/firefox-ka-3.6.13-0.1mdv2010.0.x86_64.rpm
 9f08d66dbe0ce250de6f2e919ea31c2a  2010.0/x86_64/firefox-kn-3.6.13-0.1mdv2010.0.x86_64.rpm
 64d4069b7361cfd19aea55d9b7f2b364  2010.0/x86_64/firefox-ko-3.6.13-0.1mdv2010.0.x86_64.rpm
 dddb266ef754ae3fc5a0f25aecf899c0  2010.0/x86_64/firefox-ku-3.6.13-0.1mdv2010.0.x86_64.rpm
 d2bb442f4525647cd695ebcd5185c32d  2010.0/x86_64/firefox-lt-3.6.13-0.1mdv2010.0.x86_64.rpm
 00ba3a2764636a0df7ca5170231ab1fc  2010.0/x86_64/firefox-lv-3.6.13-0.1mdv2010.0.x86_64.rpm
 5bbfe7e8d7629ebb02e3028528c9bc8d  2010.0/x86_64/firefox-mk-3.6.13-0.1mdv2010.0.x86_64.rpm
 1d93585ab0c80228c4b19275b9fc27a4  2010.0/x86_64/firefox-mr-3.6.13-0.1mdv2010.0.x86_64.rpm
 4e4c7f89393763408d09ef32054568c1  2010.0/x86_64/firefox-nb_NO-3.6.13-0.1mdv2010.0.x86_64.rpm
 fe5176722b82841e3832d05acfb53df8  2010.0/x86_64/firefox-nl-3.6.13-0.1mdv2010.0.x86_64.rpm
 1c1dfc15354b21fe579a5d731adefe92  2010.0/x86_64/firefox-nn_NO-3.6.13-0.1mdv2010.0.x86_64.rpm
 1a2819990e5a42148f01dfe55fdebe63  2010.0/x86_64/firefox-oc-3.6.13-0.1mdv2010.0.x86_64.rpm
 95a89dd1f3d7d491627f1d27ad6a5d80  2010.0/x86_64/firefox-pa_IN-3.6.13-0.1mdv2010.0.x86_64.rpm
 776395b56b4a28dfeba9823d52e75c22  2010.0/x86_64/firefox-pl-3.6.13-0.1mdv2010.0.x86_64.rpm
 a0fd0ec700b24fe5f61c6442e8030cae  2010.0/x86_64/firefox-pt_BR-3.6.13-0.1mdv2010.0.x86_64.rpm
 e41b62bc3dcce4485e580c5e3b934cd6  2010.0/x86_64/firefox-pt_PT-3.6.13-0.1mdv2010.0.x86_64.rpm
 5dc784f7435bf44708a8789748c14f4e  2010.0/x86_64/firefox-ro-3.6.13-0.1mdv2010.0.x86_64.rpm
 fbb84d11afe1cea3d55c4bedfef18c1e  2010.0/x86_64/firefox-ru-3.6.13-0.1mdv2010.0.x86_64.rpm
 196800b4aaf4051cbbee9a9606255518  2010.0/x86_64/firefox-si-3.6.13-0.1mdv2010.0.x86_64.rpm
 8432ff6cfe385a878886614fbfbc5b13  2010.0/x86_64/firefox-sk-3.6.13-0.1mdv2010.0.x86_64.rpm
 a2b61ea7b540bcae3b28a8b3c6a1ad4a  2010.0/x86_64/firefox-sl-3.6.13-0.1mdv2010.0.x86_64.rpm
 7411cd0dbfdfcf717e9e01d5ce969b06  2010.0/x86_64/firefox-sq-3.6.13-0.1mdv2010.0.x86_64.rpm
 2d292f332df10ba0c413d30f65bdae39  2010.0/x86_64/firefox-sr-3.6.13-0.1mdv2010.0.x86_64.rpm
 d6dfa9a1b9ccc859ed2f3dddb046da81  2010.0/x86_64/firefox-sv_SE-3.6.13-0.1mdv2010.0.x86_64.rpm
 17edf06f44329237517168c50de503a1  2010.0/x86_64/firefox-te-3.6.13-0.1mdv2010.0.x86_64.rpm
 de9bead6e237530eb96c28d7db2e2947  2010.0/x86_64/firefox-th-3.6.13-0.1mdv2010.0.x86_64.rpm
 cd3e7a5397bd061d5df9fa1123a246b6  2010.0/x86_64/firefox-tr-3.6.13-0.1mdv2010.0.x86_64.rpm
 24220935d8e42e68e5297c9f30504325  2010.0/x86_64/firefox-uk-3.6.13-0.1mdv2010.0.x86_64.rpm
 852f7c6f8f59ad677a56574ba38eed11  2010.0/x86_64/firefox-zh_CN-3.6.13-0.1mdv2010.0.x86_64.rpm
 5382a39644280c0d98543ed1c5b03670  2010.0/x86_64/firefox-zh_TW-3.6.13-0.1mdv2010.0.x86_64.rpm 
 57c1c60766bcd41ebce144f66266df80  2010.0/SRPMS/firefox-l10n-3.6.13-0.1mdv2010.0.src.rpm

2010.0 i586

 848b04022006d9e9b95d8758c75401f2  2010.0/i586/firefox-af-3.6.13-0.1mdv2010.0.i586.rpm
 dd0f6928b1804a36e3bdc0768dfb8a76  2010.0/i586/firefox-ar-3.6.13-0.1mdv2010.0.i586.rpm
 faba3e3810152fa5fcc3a2316f85a014  2010.0/i586/firefox-be-3.6.13-0.1mdv2010.0.i586.rpm
 84741b46341d1a3d05bc3b4ea301d015  2010.0/i586/firefox-bg-3.6.13-0.1mdv2010.0.i586.rpm
 db2a649712bb5557f55417e7464fd4c8  2010.0/i586/firefox-bn-3.6.13-0.1mdv2010.0.i586.rpm
 bd1ce8ed35bd0aa7fd446de88faec70a  2010.0/i586/firefox-ca-3.6.13-0.1mdv2010.0.i586.rpm
 f13abe9c7193390639cba38f0bf1894f  2010.0/i586/firefox-cs-3.6.13-0.1mdv2010.0.i586.rpm
 99aa8dfb480b360417a4c99763328d1c  2010.0/i586/firefox-cy-3.6.13-0.1mdv2010.0.i586.rpm
 fa1f353008c474de67a70f18fa336a94  2010.0/i586/firefox-da-3.6.13-0.1mdv2010.0.i586.rpm
 6c608835f4e91f2d17639b2412a53e56  2010.0/i586/firefox-de-3.6.13-0.1mdv2010.0.i586.rpm
 c77e33729b5259488704cdf5fcb8f966  2010.0/i586/firefox-el-3.6.13-0.1mdv2010.0.i586.rpm
 96150af5860433bb9aa6abbdb0b61dcf  2010.0/i586/firefox-en_GB-3.6.13-0.1mdv2010.0.i586.rpm
 1110dff2a1119d71b1d95e8cdae2ad95  2010.0/i586/firefox-eo-3.6.13-0.1mdv2010.0.i586.rpm
 d29bc4063773a8f6ec405e8d527c358b  2010.0/i586/firefox-es_AR-3.6.13-0.1mdv2010.0.i586.rpm
 abc577dca70cb22aaa67c1cd8b903999  2010.0/i586/firefox-es_ES-3.6.13-0.1mdv2010.0.i586.rpm
 eac2ca9419c8e9d277d86f3bfcbc0189  2010.0/i586/firefox-et-3.6.13-0.1mdv2010.0.i586.rpm
 2e96b736b315ad75b36ea0416c471415  2010.0/i586/firefox-eu-3.6.13-0.1mdv2010.0.i586.rpm
 fa746c21f916ce315ba384aa88a68e92  2010.0/i586/firefox-fi-3.6.13-0.1mdv2010.0.i586.rpm
 62a20ae08eb1b2fcfa223449c66f1462  2010.0/i586/firefox-fr-3.6.13-0.1mdv2010.0.i586.rpm
 fe5ba2f1789acdb9117f230f091012eb  2010.0/i586/firefox-fy-3.6.13-0.1mdv2010.0.i586.rpm
 535de859d9fcae87d45a9e2eaa508816  2010.0/i586/firefox-ga_IE-3.6.13-0.1mdv2010.0.i586.rpm
 a4bd422a6e399f284e73e8cc9acb3f11  2010.0/i586/firefox-gl-3.6.13-0.1mdv2010.0.i586.rpm
 0a914d7fd19ce4cf2e75433514d11c24  2010.0/i586/firefox-gu_IN-3.6.13-0.1mdv2010.0.i586.rpm
 cdcd0aaab807b6042fb6604745349cea  2010.0/i586/firefox-he-3.6.13-0.1mdv2010.0.i586.rpm
 5014d470d774f005d3cc17506e415bb9  2010.0/i586/firefox-hi-3.6.13-0.1mdv2010.0.i586.rpm
 34bb54529d77edf9e1036b791267afe4  2010.0/i586/firefox-hu-3.6.13-0.1mdv2010.0.i586.rpm
 078c986bb42fbbbc21867b8942abc892  2010.0/i586/firefox-id-3.6.13-0.1mdv2010.0.i586.rpm
 c69ee6da2577d4c6ab1cd6d51e4aa906  2010.0/i586/firefox-is-3.6.13-0.1mdv2010.0.i586.rpm
 3f4b7fc98239523297c4ef945afeb9a0  2010.0/i586/firefox-it-3.6.13-0.1mdv2010.0.i586.rpm
 798c854c091e100c64f54c396eaf98ed  2010.0/i586/firefox-ja-3.6.13-0.1mdv2010.0.i586.rpm
 212c047b416a78881b01ca5e04b2d300  2010.0/i586/firefox-ka-3.6.13-0.1mdv2010.0.i586.rpm
 c9c6f6519fef1f594657e11b2f183343  2010.0/i586/firefox-kn-3.6.13-0.1mdv2010.0.i586.rpm
 149073d272f4da443dbb5ab72730ed4e  2010.0/i586/firefox-ko-3.6.13-0.1mdv2010.0.i586.rpm
 51db0d78794e615c431e5233bb65e960  2010.0/i586/firefox-ku-3.6.13-0.1mdv2010.0.i586.rpm
 3af082902e39bba673ed7a084c78bc6f  2010.0/i586/firefox-lt-3.6.13-0.1mdv2010.0.i586.rpm
 b85f25647986f169fb45b445b511749d  2010.0/i586/firefox-lv-3.6.13-0.1mdv2010.0.i586.rpm
 d5e36895dcc2ca44a25b79a958c9e988  2010.0/i586/firefox-mk-3.6.13-0.1mdv2010.0.i586.rpm
 49a8e0e2b400e2dcfa31fea384f25393  2010.0/i586/firefox-mr-3.6.13-0.1mdv2010.0.i586.rpm
 850185975ec13dd25a75b33bd6ec7e6c  2010.0/i586/firefox-nb_NO-3.6.13-0.1mdv2010.0.i586.rpm
 e9c894b6084b2f97c64f2f1d5c03b6ab  2010.0/i586/firefox-nl-3.6.13-0.1mdv2010.0.i586.rpm
 7d7e8521c96f3b81db1a2088a29b8c5e  2010.0/i586/firefox-nn_NO-3.6.13-0.1mdv2010.0.i586.rpm
 46934e2b8fcbf6cb532a41767738411d  2010.0/i586/firefox-oc-3.6.13-0.1mdv2010.0.i586.rpm
 93163c318901fe0de828a163ad715c1a  2010.0/i586/firefox-pa_IN-3.6.13-0.1mdv2010.0.i586.rpm
 629caa34925c76f6a4216e928a7784bf  2010.0/i586/firefox-pl-3.6.13-0.1mdv2010.0.i586.rpm
 cd00d2b70436fcce7febf12cd73d1e8b  2010.0/i586/firefox-pt_BR-3.6.13-0.1mdv2010.0.i586.rpm
 b05fddb1fb7b9e7dcd956a185ebe5e40  2010.0/i586/firefox-pt_PT-3.6.13-0.1mdv2010.0.i586.rpm
 9f78bc2aa0669587bf6c753c53b44405  2010.0/i586/firefox-ro-3.6.13-0.1mdv2010.0.i586.rpm
 4fed48535f5bb8f59d4b6c28346d21d7  2010.0/i586/firefox-ru-3.6.13-0.1mdv2010.0.i586.rpm
 6bfc33c7315903d101309df01c029d39  2010.0/i586/firefox-si-3.6.13-0.1mdv2010.0.i586.rpm
 3373c0961cc063025875745efd722b74  2010.0/i586/firefox-sk-3.6.13-0.1mdv2010.0.i586.rpm
 f310daa13cb9c9d1d4ba249bea6d24a3  2010.0/i586/firefox-sl-3.6.13-0.1mdv2010.0.i586.rpm
 424bec3a54b11808f3ca1d247077d6f0  2010.0/i586/firefox-sq-3.6.13-0.1mdv2010.0.i586.rpm
 d0aed5f7a28a815966545af53885720f  2010.0/i586/firefox-sr-3.6.13-0.1mdv2010.0.i586.rpm
 2042c1cea24d73fdad09176d740f5d4f  2010.0/i586/firefox-sv_SE-3.6.13-0.1mdv2010.0.i586.rpm
 44b03d2c1c185f8b1f24560c9f5d7560  2010.0/i586/firefox-te-3.6.13-0.1mdv2010.0.i586.rpm
 ca07ae084dccdc562009964fb243aa98  2010.0/i586/firefox-th-3.6.13-0.1mdv2010.0.i586.rpm
 ba0d5846a576faa2c53b22fc5e2b514d  2010.0/i586/firefox-tr-3.6.13-0.1mdv2010.0.i586.rpm
 faa4e571079e36920b70ce2dffaa988b  2010.0/i586/firefox-uk-3.6.13-0.1mdv2010.0.i586.rpm
 88510a4d7aa77df4cda9414818218e4a  2010.0/i586/firefox-zh_CN-3.6.13-0.1mdv2010.0.i586.rpm
 a176b22d187b54a3a8efdd8919727b1a  2010.0/i586/firefox-zh_TW-3.6.13-0.1mdv2010.0.i586.rpm 
 57c1c60766bcd41ebce144f66266df80  2010.0/SRPMS/firefox-l10n-3.6.13-0.1mdv2010.0.src.rpm

References