Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.

From Red Hat Security Advisory 2009:0398 :

Updated SeaMonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

A memory corruption flaw was discovered in the way SeaMonkey handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2009-1169)

A flaw was discovered in the way SeaMonkey handles certain XUL garbage collection events. A remote attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2009-1044)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0397 advisory.

    xulrunner:

    [1.9.0.7-3.0.1.el5]
    - Added xulrunner-oracle-default-prefs.js and removed the corresponding       RedHat one

    [1.9.0.7-3]
    - Updated per 1.9.0.8

    firefox:

    [3.0.7-3.0.1.el4]
    - Update firstrun and homepage URLS
    - Add oracle-firefox-branding.patch
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding RedHat ones

    [3.0.7-3.el4]
    - Updated per 1.9.0.8

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Updated firefox packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A memory corruption flaw was discovered in the way Firefox handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1169)

A flaw was discovered in the way Firefox handles certain XUL garbage collection events. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1044)

For technical details regarding these flaws, refer to the Mozilla security advisories. You can find a link to the Mozilla advisories in the References section of this errata.

Firefox users should upgrade to these updated packages, which resolve these issues. For Red Hat Enterprise Linux 4, they contain backported patches to the firefox package. For Red Hat Enterprise Linux 5, they contain backported patches to the xulrunner packages. After installing the update, Firefox must be restarted for the changes to take effect.

The Mozilla Firefox Browser was updated to the 3.0.8 release. It fixes several security issues :

  - Security researcher Nils reported via TippingPoint's     Zero Day Initiative that the XUL tree method
    _moveToEdgeShift was in some cases triggering garbage     collection routines on objects which were still in use.
    In such cases, the browser would crash when attempting     to access a previously destroyed object and this crash     could be used by an attacker to run arbitrary code on a     victim's computer. This vulnerability was used by the     reporter to win the 2009 CanSecWest Pwn2Own contest.
    This vulnerability does not affect Firefox 2,     Thunderbird 2, or released versions of SeaMonkey. (MFSA     2009-13 / CVE-2009-1044)

  - Security researcher Guido Landi discovered that a XSL     stylesheet could be used to crash the browser during a     XSL transformation. An attacker could potentially use     this crash to run arbitrary code on a victim's computer.
    This vulnerability was also previously reported as a     stability problem by Ubuntu community member, Andre.
    Ubuntu community member Michael Rooney reported Andre's     findings to Mozilla, and Mozilla community member Martin     helped reduce Andre's original testcase and contributed     a patch to fix the vulnerability. (MFSA 2009-12 /     CVE-2009-1169)

The Mozilla Firefox Browser was updated to the 3.0.8 release. It fixes several security issues :

MFSA 2009-13 / CVE-2009-1044: Security researcher Nils reported via TippingPoint's Zero Day Initiative that the XUL tree method
_moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed object and this crash could be used by an attacker to run arbitrary code on a victim's computer. This vulnerability was used by the reporter to win the 2009 CanSecWest Pwn2Own contest. This vulnerability does not affect Firefox 2, Thunderbird 2, or released versions of SeaMonkey.

MFSA 2009-12 / CVE-2009-1169:Security researcher Guido Landi discovered that a XSL stylesheet could be used to crash the browser during a XSL transformation. An attacker could potentially use this crash to run arbitrary code on a victim's computer. This vulnerability was also previously reported as a stability problem by Ubuntu community member, Andre. Ubuntu community member Michael Rooney reported Andre's findings to Mozilla, and Mozilla community member Martin helped reduce Andre's original testcase and contributed a patch to fix the vulnerability.

It was discovered that Firefox did not properly perform XUL garbage collection. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and 8.10. (CVE-2009-1044)

A flaw was discovered in the way Firefox performed XSLT transformations. If a user were tricked into opening a crafted XSL stylesheet, an attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-1169).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A memory corruption flaw was discovered in the way Firefox handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1169) A flaw was discovered in the way Firefox handles certain XUL garbage collection events. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1044)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities have been discovered in previous versions, and corrected in the latest Mozilla Firefox 3.x, version 3.0.8 (CVE-2009-1044, CVE-2009-1169).

This update provides the latest Mozilla Firefox 3.x to correct these issues.

Additionally, some packages requiring it have also been rebuilt and are being provided as updates.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1169     Security researcher Guido Landi discovered that a XSL     stylesheet could be used to crash the browser during a     XSL transformation. An attacker could potentially use     this crash to run arbitrary code on a victim's computer.

  - CVE-2009-1044     Security researcher Nils reported via TippingPoint's     Zero Day Initiative that the XUL tree method
    _moveToEdgeShift was in some cases triggering garbage     collection routines on objects which were still in use.
    In such cases, the browser would crash when attempting     to access a previously destroyed object and this crash     could be used by an attacker to run arbitrary code on a     victim's computer.

Note that after installing these updates, you will need to restart any packages using xulrunner, typically iceweasel or epiphany.

As indicated in the Etch release notes, security support for the Mozilla products in the oldstable distribution needed to be stopped before the end of the regular Etch security maintenance life cycle.
You are strongly encouraged to upgrade to stable or switch to a still supported browser.

Versions of Firefox prior to 3.0.8 are affected by the following security issues : 

 - An XSL transformation vulnerability can be leveraged with a specially crafted stylesheet to crash the browser or to execute arbitrary code. (MFSA 2009-12)
 - An error in the XUL tree method '_moveToEdgeShift()' can be leveraged to trigger garbage collection routines on objects that are still in use, leading to a browser crash and possibly execution of arbitrary code. (MFSA 2009-13) 

The installed version of Firefox is earlier than 3.0.8.  Such versions are potentially affected by the following security issues :

  - An XSL transformation vulnerability can be leveraged     with a specially crafted stylesheet to crash the browser     or to execute arbitrary code. (MFSA 2009-12)

  - An error in the XUL tree method '_moveToEdgeShift()' can     be leveraged to trigger garbage collection routines on     objects that are still in use, leading to a browser     crash and possibly execution of arbitrary code.     (MFSA 2009-13)

Updated SeaMonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

A memory corruption flaw was discovered in the way SeaMonkey handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2009-1169)

A flaw was discovered in the way SeaMonkey handles certain XUL garbage collection events. A remote attacker could use this flaw to crash SeaMonkey or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2009-1044)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A memory corruption flaw was discovered in the way Firefox handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-1169) A flaw was discovered in the way Firefox handles certain XUL garbage collection events. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1044) This update also provides depending packages rebuilt against new Firefox version. Miro updates to upstream 2.0.3. Provides new features and fixes various bugs in 1.2.x series

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 3.0.8.  Such versions are potentially affected by the following security issues : 

  - An XSL transformation vulnerability can be leveraged with a specially crafted stylesheet to crash the browser or to execute arbitrary code. (MFSA 2009-12)

  - An error in the XUL tree method '_moveToEdgeShift()' can be leveraged to trigger garbage collection routines on objects that are still in use, leading to a browser crash and possibly execution of arbitrary code. (MFSA 2009-13)

ID	Name	Product	Family	Severity
67834	Oracle Linux 3 / 4 : seamonkey (ELSA-2009-0398)	Nessus	Oracle Linux Local Security Checks	high
67833	Oracle Linux 5 : firefox (ELSA-2009-0397)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
43737	CentOS 4 / 5 : firefox (CESA-2009:0397)	Nessus	CentOS Local Security Checks	high
41353	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 747)	Nessus	SuSE Local Security Checks	high
40171	openSUSE Security Update : MozillaFirefox (MozillaFirefox-745)	Nessus	SuSE Local Security Checks	high
39888	openSUSE Security Update : MozillaFirefox (MozillaFirefox-745)	Nessus	SuSE Local Security Checks	high
38148	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-745-1)	Nessus	Ubuntu Local Security Checks	high
37911	Fedora 10 : seamonkey-1.1.15-3.fc10 (2009-3161)	Nessus	Fedora Local Security Checks	critical
37824	Fedora 10 : Miro-2.0.3-2.fc10 / blam-1.8.5-8.fc10 / devhelp-0.22-6.fc10 / epiphany-2.24.3-4.fc10 / etc (2009-3100)	Nessus	Fedora Local Security Checks	high
37253	Mandriva Linux Security Advisory : firefox (MDVSA-2009:084)	Nessus	Mandriva Local Security Checks	high
36066	Debian DSA-1756-1 : xulrunner - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
36054	Fedora 9 : seamonkey-1.1.15-3.fc9 (2009-3101)	Nessus	Fedora Local Security Checks	critical
4980	Mozilla Firefox < 3.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
36045	Firefox < 3.0.8 Multiple Vulnerabilities	Nessus	Windows	high
36044	RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2009:0398)	Nessus	Red Hat Local Security Checks	high
36043	RHEL 4 / 5 : firefox (RHSA-2009:0397)	Nessus	Red Hat Local Security Checks	high
36041	Fedora 9 : Miro-2.0.3-2.fc9 / blam-1.8.5-7.fc9.1 / chmsee-1.0.1-10.fc9 / devhelp-0.19.1-10.fc9 / etc (2009-3099)	Nessus	Fedora Local Security Checks	high
36039	CentOS 3 : seamonkey (CESA-2009:0398)	Nessus	CentOS Local Security Checks	high
800774	Firefox < 3.0.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2009-1044

critical

Tenable Plugins

high

critical

critical

high

high

high

high

high

critical

high

high

high

critical

medium

high

high

high

high

high

high