Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0597 advisory.

    devhelp:

    [0.12-18]
    - Rebuild against xulrunner

    firefox:

    [3.0.1-1.0.1.el5]

    - Replaced the RedHat prefs and bookmarks with Oracle prefs and bookmarks
    - Add patch oracle-firefox-branding.patch
    - Update firstrun URL

    [3.0.1-1]
    - Update to Firefox 3.0.1

    xulrunner:

    [1.9.0.1-1.0.1.el5]
    - Added xulrunner-oracle-default-prefs.js

    [1.9.0.1-1]
    - Update to 1.9.0.1

    yelp:

    [2.16.0-20]
    - rebuild against xulrunner

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated firefox packages that fix various security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 16th July 2008] The nspluginwrapper package has been added to this advisory to satisfy a missing package dependency issue.

Mozilla Firefox is an open source Web browser.

An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-2785)

A flaw was found in the way Firefox handled certain command line URLs.
If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges.
(CVE-2008-2933)

All firefox users should upgrade to these updated packages, which contain Firefox 3.0.1 that corrects these issues.

The installed version of Firefox is affected by various security issues :

  - By creating a very large number of references to a     common CSS object, an attacker can overflow the CSS     reference counter, causing a crash when the browser     attempts to free the CSS object while still in use     and allowing for arbitrary code execution     (MFSA 2008-34).

  - If Firefox is not already running, passing it a     command-line URI with pipe ('|') symbols will open     multiple tabs, which could be used to launch     'chrome:i' URIs from the command-line or to pass URIs     to Firefox that would normally be handled by a vector     application (MFSA 2008-35).

Versions of Firefox 3.x prior to 3.0.1 are affected by various security issues :

 - By creating a very large number of references to a common CSS object, an attacker can overflow the CSS reference counter, causing a crash when the browser attempts to free the CSS object while still in use and allowing for arbitrary code execution (MFSA 2008-34).
  - If Firefox is not already running, passing it a command-line URI with pipe ('|') symbols will open multiple tabs, which could be used to launch 'chrome:i' URIs from the command-line or to pass URIs to Firefox that would normally be handled by a vector application (MFSA 2008-35).

The installed version of Firefox is affected by various security issues :

  - By creating a very large number of references to a common CSS object, an attacker can overflow the CSS reference counter, causing a crash when the browser attempts to free the CSS object while still in use and allowing for arbitrary code execution (MFSA 2008-34).
  - If Firefox is not already running, passing it a command-line URI with pipe ('|') symbols will open multiple tabs, which could be used to launch 'chrome:i' URIs from the command-line or to pass URIs to Firefox that would normally be handled by a vector application (MFSA 2008-35).

ID	Name	Product	Family	Severity
67726	Oracle Linux 5 : firefox (ELSA-2008-0597)	Nessus	Oracle Linux Local Security Checks	critical
43699	CentOS 5 : firefox (CESA-2008:0597)	Nessus	CentOS Local Security Checks	high
33528	RHEL 5 : firefox (RHSA-2008:0597)	Nessus	Red Hat Local Security Checks	high
33522	Firefox 3.x < 3.0.1 Multiple Vulnerabilities	Nessus	Windows	high
4591	Mozilla Firefox 3.x < 3.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
800750	Firefox < 3.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-3198

high

Tenable Plugins

critical

high

high

high

medium

high