Gentoo Archives: gentoo-announce

From: Sune Kloppenborg Jeppesen <jaervosz@g.o>
To: gentoo-announce@l.g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××××.uk, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 200507-24 ] Mozilla Suite: Multiple vulnerabilities
Date: Tue, 26 Jul 2005 19:45:48
Message-Id: 200507262123.33328.jaervosz@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 200507-24
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Mozilla Suite: Multiple vulnerabilities
9 Date: July 26, 2005
10 Bugs: #98846
11 ID: 200507-24
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Several vulnerabilities in the Mozilla Suite allow attacks ranging from
19 the execution of javascript code with elevated privileges to
20 information leakage.
21
22 Background
23 ==========
24
25 The Mozilla Suite is an all-in-one Internet application suite including
26 a web browser, an advanced e-mail and newsgroup client, IRC client and
27 HTML editor.
28
29 Affected packages
30 =================
31
32 -------------------------------------------------------------------
33 Package / Vulnerable / Unaffected
34 -------------------------------------------------------------------
35 1 www-client/mozilla < 1.7.10 >= 1.7.10
36 2 www-client/mozilla-bin < 1.7.10 >= 1.7.10
37 -------------------------------------------------------------------
38 2 affected packages on all of their supported architectures.
39 -------------------------------------------------------------------
40
41 Description
42 ===========
43
44 The following vulnerabilities were found and fixed in the Mozilla
45 Suite:
46
47 * "moz_bug_r_a4" and "shutdown" discovered that the Mozilla Suite was
48 improperly cloning base objects (MFSA 2005-56).
49
50 * "moz_bug_r_a4" reported that the suite failed to validate XHTML DOM
51 nodes properly (MFSA 2005-55).
52
53 * Secunia reported that alerts and prompts scripts are presented with
54 the generic title [JavaScript Application] which could lead to
55 tricking a user (MFSA 2005-54).
56
57 * Andreas Sandblad of Secunia reported that top.focus() can be called
58 in the context of a child frame even if the framing page comes from a
59 different origin and has overridden the focus() routine (MFSA
60 2005-52).
61
62 * Secunia reported that a frame-injection spoofing bug which was
63 fixed in earlier versions, was accidently bypassed in Mozilla Suite
64 1.7.7 (MFSA 2005-51).
65
66 * "shutdown" reported that InstallVersion.compareTo() might be
67 exploitable. When it gets an object rather than a string, the browser
68 would generally crash with an access violation (MFSA 2005-50).
69
70 * Matthew Mastracci reported that by forcing a page navigation
71 immediately after calling the install method can end up running in
72 the context of the new page selected by the attacker (MFSA 2005-48).
73
74 * "moz_bug_r_a4" reported that XBL scripts run even when Javascript
75 is disabled (MFSA 2005-46).
76
77 * Omar Khan, Jochen, "shutdown" and Matthew Mastracci reported that
78 the Mozilla Suite incorrectly distinguished between true events like
79 mouse clicks or keystrokes and synthetic events generated by a web
80 content (MFSA 2005-45).
81
82 Impact
83 ======
84
85 A remote attacker could craft malicious web pages that would leverage
86 these issues to inject and execute arbitrary javascript code with
87 elevated privileges, steal cookies or other information from web pages,
88 or spoof content.
89
90 Workaround
91 ==========
92
93 There is no known workaround at this time.
94
95 Resolution
96 ==========
97
98 All Mozilla Suite users should upgrade to the latest version:
99
100 # emerge --sync
101 # emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.10"
102
103 All Mozilla Suite binary users should upgrade to the latest version:
104
105 # emerge --sync
106 # emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.10"
107
108 References
109 ==========
110
111 [ 1 ] Mozilla Foundation Security Advisories
112 http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla
113
114 Availability
115 ============
116
117 This GLSA and any updates to it are available for viewing at
118 the Gentoo Security Website:
119
120 http://security.gentoo.org/glsa/glsa-200507-24.xml
121
122 Concerns?
123 =========
124
125 Security is a primary focus of Gentoo Linux and ensuring the
126 confidentiality and security of our users machines is of utmost
127 importance to us. Any security concerns should be addressed to
128 security@g.o or alternatively, you may file a bug at
129 http://bugs.gentoo.org.
130
131 License
132 =======
133
134 Copyright 2005 Gentoo Foundation, Inc; referenced text
135 belongs to its owner(s).
136
137 The contents of this document are licensed under the
138 Creative Commons - Attribution / Share Alike license.
139
140 http://creativecommons.org/licenses/by-sa/2.0