Use-after-free vulnerability in the nsCycleCollector::MarkRoots function in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a crafted HTML document, related to an improper frame construction process for menus.

From Red Hat Security Advisory 2010:0500 :

An updated firefox package that addresses security issues, fixes bugs, adds numerous enhancements, and upgrades Firefox to version 3.6.4, is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4, and as such, contains multiple bug fixes and numerous enhancements.
Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to this updated package, which contains Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

From Red Hat Security Advisory 2010:0499 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Mozilla Firefox has been updated to version 3.5.10, fixing various bugs and security issues.

  - Security researcher Amit Klein reported that it was     possible to reverse engineer the value used to seed     Math.random(). Since the pseudo-random number generator     was only seeded once per browsing session, this seed     value could be used as a unique token to identify and     track users across different web sites. (MFSA 2010-33/     CVE-2008-5913)

  - Security researcher Ilja van Sprundel of IOActive     reported that the Content-Disposition: attachment HTTP     header was ignored when `Content-Type: multipart` was     also present. This issue could potentially lead to XSS     problems in sites that allow users to upload arbitrary     files and specify a content type but rely on     Content-Disposition: attachment to prevent the content     from being displayed inline. (MFSA 2010-32/     CVE-2010-1197)

  - Google security researcher Michal Zalewski reported that     focus() could be used to change a user's cursor focus     while they are typing, potentially directing their     keyboard input to an unintended location. This behaviour     was also present across origins when content from one     domain was embedded within another via an iframe. A     malicious web page could use this behaviour to steal     keystrokes from a victim while they were typing     sensitive information such as a password. (MFSA 2010-31/     CVE-2010-1125)

  - Security researcher Martin Barbella reported via     TippingPoint's Zero Day Initiative that an XSLT node     sorting routine contained an integer overflow     vulnerability. In cases where one of the nodes to be     sorted contained a very large text value, the integer     used to allocate a memory buffer to store its value     would overflow, resulting in too small a buffer being     created. An attacker could use this vulnerability to     write data past the end of the buffer, causing the     browser to crash and potentially running arbitrary code     on a victim's computer. (MFSA 2010-30/ CVE-2010-1199)

  - Security researcher Nils of MWR InfoSecurity reported     that the routine for setting the text value for certain     types of DOM nodes contained an integer overflow     vulnerability. When a very long string was passed to     this routine, the integer value used in creating a new     memory buffer to hold the string would overflow,     resulting in too small a buffer being allocated. An     attacker could use this vulnerability to write data past     the end of the buffer, causing a crash and potentially     running arbitrary code on a victim's computer. (MFSA     2010-29/ CVE-2010-1196)

  - Microsoft Vulnerability Research reported that two     plugin instances could interact in a way in which one     plugin gets a reference to an object owned by a second     plugin and continues to hold that reference after the     second plugin is unloaded and its object is destroyed.
    In these cases, the first plugin would contain a pointer     to freed memory which, if accessed, could be used by an     attacker to execute arbitrary code on a victim's     computer. (MFSA 2010-28/ CVE-2010-1198)

  - Security researcher Wushi of Team509 reported that the     frame construction process for certain types of menus     could result in a menu containing a pointer to a     previously freed menu item. During the cycle collection     process, this freed item could be accessed, resulting in     the execution of a section of code potentially     controlled by an attacker. (MFSA 2010-27/ CVE-2010-0183)

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-26/ CVE-2010-1200 / CVE-2010-1201 /     CVE-2010-1202 / CVE-2010-1203)

  - A memory corruption flaw leading to code execution was     reported by security researcher Nils of MWR InfoSecurity     during the 2010 Pwn2Own contest sponsored by     TippingPoint's Zero Day Initiative. By moving DOM nodes     between documents, Nils found a case where the moved     node incorrectly retained its old scope. If garbage     collection could be triggered at the right time then     Firefox would later use this freed object. The exploit     only affects Firefox 3.6 and not earlier versions.
    Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and     Thunderbird 3.0 based on earlier versions of the browser     engine were patched just in case there is an alternate     way of triggering the underlying flaw. (MFSA 2010-25/     CVE-2010-1121)

Mozilla Firefox has been updated to version 3.5.10, fixing various bugs and security issues.

  - Security researcher Amit Klein reported that it was     possible to reverse engineer the value used to seed     Math.random(). Since the pseudo-random number generator     was only seeded once per browsing session, this seed     value could be used as a unique token to identify and     track users across different websites. (MFSA 2010-33/     CVE-2008-5913)

  - Security researcher Ilja van Sprundel of IOActive     reported that the Content-Disposition: attachment HTTP     header was ignored when `Content-Type: multipart` was     also present. This issue could potentially lead to XSS     problems in sites that allow users to upload arbitrary     files and specify a content type but rely on     Content-Disposition: attachment to prevent the content     from being displayed inline. (MFSA 2010-32/     CVE-2010-1197)

  - Google security researcher Michal Zalewski reported that     focus() could be used to change a user's cursor focus     while they are typing, potentially directing their     keyboard input to an unintended location. This behaviour     was also present across origins when content from one     domain was embedded within another via an iframe. A     malicious web page could use this behaviour to steal     keystrokes from a victim while they were typing     sensitive information such as a password. (MFSA 2010-31/     CVE-2010-1125)

  - Security researcher Martin Barbella reported via     TippingPoint's Zero Day Initiative that an XSLT node     sorting routine contained an integer overflow     vulnerability. In cases where one of the nodes to be     sorted contained a very large text value, the integer     used to allocate a memory buffer to store its value     would overflow, resulting in too small a buffer being     created. An attacker could use this vulnerability to     write data past the end of the buffer, causing the     browser to crash and potentially running arbitrary code     on a victim's computer. (MFSA 2010-30/ CVE-2010-1199)

  - Security researcher Nils of MWR InfoSecurity reported     that the routine for setting the text value for certain     types of DOM nodes contained an integer overflow     vulnerability. When a very long string was passed to     this routine, the integer value used in creating a new     memory buffer to hold the string would overflow,     resulting in too small a buffer being allocated. An     attacker could use this vulnerability to write data past     the end of the buffer, causing a crash and potentially     running arbitrary code on a victim's computer. . (MFSA     2010-29/ CVE-2010-1196)

  - Microsoft Vulnerability Research reported that two     plugin instances could interact in a way in which one     plugin gets a reference to an object owned by a second     plugin and continues to hold that reference after the     second plugin is unloaded and its object is destroyed.
    In these cases, the first plugin would contain a pointer     to freed memory which, if accessed, could be used by an     attacker to execute arbitrary code on a victim's     computer. (MFSA 2010-28/ CVE-2010-1198)

  - Security researcher Wushi of Team509 reported that the     frame construction process for certain types of menus     could result in a menu containing a pointer to a     previously freed menu item. During the cycle collection     process, this freed item could be accessed, resulting in     the execution of a section of code potentially     controlled by an attacker. (MFSA 2010-27/ CVE-2010-0183)

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-26/ CVE-2010-1200 / CVE-2010-1201 /     CVE-2010-1202 / CVE-2010-1203)

  - A memory corruption flaw leading to code execution was     reported by security researcher Nils of MWR InfoSecurity     during the 2010 Pwn2Own contest sponsored by     TippingPoint's Zero Day Initiative. By moving DOM nodes     between documents, Nils found a case where the moved     node incorrectly retained its old scope. If garbage     collection could be triggered at the right time then     Firefox would later use this freed object. The exploit     only affects Firefox 3.6 and not earlier versions.
    Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and     Thunderbird 3.0 based on earlier versions of the browser     engine were patched just in case there is an alternate     way of triggering the underlying flaw. (MFSA 2010-25/     CVE-2010-1121)

An updated firefox package that addresses security issues, fixes bugs, adds numerous enhancements, and upgrades Firefox to version 3.6.4, is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4, and as such, contains multiple bug fixes and numerous enhancements.
Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to this updated package, which contains Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Mozilla Firefox was updated to version 3.5.10, fixing various bugs and security issues.

MFSA 2010-33 / CVE-2008-5913: Security researcher Amit Klein reported that it was possible to reverse engineer the value used to seed Math.random(). Since the pseudo-random number generator was only seeded once per browsing session, this seed value could be used as a unique token to identify and track users across different websites.

MFSA 2010-32 / CVE-2010-1197: Security researcher Ilja van Sprundel of IOActive reported that the Content-Disposition: attachment HTTP header was ignored when Content-Type: multipart was also present. This issue could potentially lead to XSS problems in sites that allow users to upload arbitrary files and specify a Content-Type but rely on Content-Disposition: attachment to prevent the content from being displayed inline.

MFSA 2010-31 / CVE-2010-1125: Google security researcher Michal Zalewski reported that focus() could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location. This behaviour was also present across origins when content from one domain was embedded within another via an iframe. A malicious web page could use this behaviour to steal keystrokes from a victim while they were typing sensitive information such as a password.

MFSA 2010-30 / CVE-2010-1199: Security researcher Martin Barbella reported via TippingPoint's Zero Day Initiative that an XSLT node sorting routine contained an integer overflow vulnerability. In cases where one of the nodes to be sorted contained a very large text value, the integer used to allocate a memory buffer to store its value would overflow, resulting in too small a buffer being created. An attacker could use this vulnerability to write data past the end of the buffer, causing the browser to crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-29 / CVE-2010-1196: Security researcher Nils of MWR InfoSecurity reported that the routine for setting the text value for certain types of DOM nodes contained an integer overflow vulnerability. When a very long string was passed to this routine, the integer value used in creating a new memory buffer to hold the string would overflow, resulting in too small a buffer being allocated. An attacker could use this vulnerability to write data past the end of the buffer, causing a crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-28 / CVE-2010-1198: Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first plugin would contain a pointer to freed memory which, if accessed, could be used by an attacker to execute arbitrary code on a victim's computer.

MFSA 2010-27 / CVE-2010-0183: Security researcher wushi of team509 reported that the frame construction process for certain types of menus could result in a menu containing a pointer to a previously freed menu item. During the cycle collection process, this freed item could be accessed, resulting in the execution of a section of code potentially controlled by an attacker.

MFSA 2010-26 / CVE-2010-1200 / CVE-2010-1201 / CVE-2010-1202 / CVE-2010-1203: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2010-25 / CVE-2010-1121: A memory corruption flaw leading to code execution was reported by security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own contest sponsored by TippingPoint's Zero Day Initiative. By moving DOM nodes between documents Nils found a case where the moved node incorrectly retained its old scope. If garbage collection could be triggered at the right time then Firefox would later use this freed object. The contest winning exploit only affects Firefox 3.6 and not earlier versions. Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and Thunderbird 3.0 based on earlier versions of the browser engine were patched just in case there is an alternate way of triggering the underlying flaw.

Update to new upstream SeaMonkey version 2.0.5, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.5 CVE-2010-1121 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-0183 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream Firefox version 3.6.4, fixing a security issue detailed in the upstream advisory:
http://www.mozilla.org/security/known- vulnerabilities/firefox36.html#firefox3.6.4 Update also includes packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2010-1200 CVE-2010-1202 CVE-2010-1203 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream Firefox version 3.5.10, fixing a security issue detailed in the upstream advisory:
http://www.mozilla.org/security/known- vulnerabilities/firefox36.html#firefox3.5.10 Update also includes packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2010-1121 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-0183 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0183     'wushi' discovered that incorrect pointer handling in     the frame processing code could lead to the execution of     arbitrary code.

  - CVE-2010-1196     'Nils' discovered that an integer overflow in DOM node     parsing could lead to the execution of arbitrary code.

  - CVE-2010-1197     Ilja von Sprundel discovered that incorrect parsing of     Content-Disposition headers could lead to cross-site     scripting.

  - CVE-2010-1198     Microsoft engineers discovered that incorrect memory     handling in the interaction of browser plugins could     lead to the execution of arbitrary code.

  - CVE-2010-1199     Martin Barbella discovered that an integer overflow in     XSLT node parsing could lead to the execution of     arbitrary code.

  - CVE-2010-1200     Olli Pettay, Martijn Wargers, Justin Lebar, Jesse     Ruderman, Ben Turner, Jonathan Kew and David Humphrey     discovered crashes in the layout engine, which might     allow the execution of arbitrary code.

  - CVE-2010-1201     'boardraider' and 'stedenon' discovered crashes in the     layout engine, which might allow the execution of     arbitrary code.

  - CVE-2010-1202     Bob Clary, Igor Bukanov, Gary Kwong and Andreas Gal     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code.

Mozilla Project reports :

MFSA 2010-33 User tracking across sites using Math.random()

MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type:
multipart also present

MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes

MFSA 2010-30 Integer Overflow in XSLT Node Sorting

MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal

MFSA 2010-28 Freed object reuse across plugin instances

MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()

MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

MFSA 2010-25 Re-use of freed object due to scope confusion

Updated firefox packages that address several security issues, fix bugs, add numerous enhancements, and upgrade Firefox to version 3.6.4, are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 June 2010] The original packages distributed with this erratum had a bug which could cause unintended dependencies to be installed when upgrading. We have updated the packages to correct this bug.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4.
Due to the requirements of Firefox 3.6.4, this erratum also provides a number of other updated packages, including esc, totem, and yelp.

This erratum also contains multiple bug fixes and numerous enhancements. Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

Versions of SeaMonkey earlier than 2.0.5 are potentially affected by multiple vulnerabilities :

  A re-use of a freed object due to scope confusion. (MFSA 2010-25)

  - Multiple crashes can result in code execution. (MFSA 2010-26)

  - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)

  - Freed object reuse across plugin instances. (MFSA 2010-28)

  - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)

  - An integer overflow in XSLT node sorting. (MFSA 2010-30)

  The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

Versions of Firefox earlier than 3.5.10 are potentially affected by multiple vulnerabilities :

  - A re-use of a freed object due to scope confusion. (MFSA 2010-25)

  - Multiple crashes can result in code execution. (MFSA 2010-26)

  - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)

  - Freed object reuse across plugin instances. (MFSA 2010-28)

  - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)

  - An integer overflow in XSLT node sorting. (MFSA 2010-30)

  The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

Versions of Firefox earlier than 3.5.10 are potentially affected by multiple vulnerabilities :

 - A re-use of a freed object due to scope confusion. (MFSA 2010-25)
 - Multiple crashes can result in code execution. (MFSA 2010-26)
 - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)
 - Freed object reuse across plugin instances. (MFSA 2010-28)
 - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)
 - An integer overflow in XSLT node sorting. (MFSA 2010-30)
 The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

The installed version of SeaMonkey is earlier than 2.0.5.  Such versions are potentially affected by the following security issues :

  - A memory corruption vulnerability can lead to arbitrary     code execution if garbage collection is carefully timed     after DOM nodes are moved between documents.
    (MFSA 2010-25)

  - Multiple crashes can result in arbitrary code     execution. (MFSA 2010-26)

  - An error in 'nsCycleCollector' may allow access to a     previously freed resource leading to arbitrary code     execution. (MFSA 2010-27)

  - A plugin is allowed to hold a reference to an object     owned by a second plugin even after the second plugin     is unloaded and the referenced object no longer exists.
    This could allow arbitrary code execution. (MFSA 2010-28)

  - An error in 'nsGenericDOMDataNode' allows a buffer     overflow in certain DOM nodes leading to arbitrary code     execution. (MFSA 2010-29)

  - An error in a XSLT node sorting function contains an     integer overflow leading to application crashes and     possible arbitrary code execution. (MFSA 2010-30)

  - A cross-site scripting vulnerability exists when     content from one domain is embedded in pages from other     domains and the 'focus()' function is used, leading to     information disclosure. (MFSA 2010-31)

  - The HTTP header, 'Content-Disposition: attachment', is     ignored when the HTTP header 'Content-Type: multipart'     is present. This could allow cross-site scripting to     occur. (MFSA 2010-32)

  - The pseudo-random number generator is only seeded once     per browsing session and 'Math.random()' may be used to     recover the seed value allowing the browser instance     to be tracked across different websites. (MFSA 2010-33)

The installed version of Firefox is earlier than 3.5.10.  Such versions are potentially affected by the following security issues :

  - A memory corruption vulnerability can lead to arbitrary     code execution if garbage collection is carefully timed     after DOM nodes are moved between documents.
    (MFSA 2010-25)

  - Multiple crashes can result in arbitrary code     execution. (MFSA 2010-26)  
  - An error in 'nsCycleCollector' may allow access to a     previously freed resource leading to arbitrary code     execution. (MFSA 2010-27)

  - A plugin is allowed to hold a reference to an object     owned by a second plugin even after the second plugin     is unloaded and the referenced object no longer exists.
    This could allow arbitrary code execution. (MFSA 2010-28)

  - An error in 'nsGenericDOMDataNode' allows a buffer     overflow in certain DOM nodes leading to arbitrary code     execution. (MFSA 2010-29)

  - An error in a XSLT node sorting function contains an     integer overflow leading to application crashes and     possible arbitrary code execution. (MFSA 2010-30)

  - A cross-site scripting vulnerability exists when     content from one domain is embedded in pages from other     domains and the 'focus()' function is used, leading to     information disclosure. (MFSA 2010-31)

  - The HTTP header, 'Content-Disposition: attachment', is     ignored when the HTTP header 'Content-Type: multipart'     is present. This could allow cross-site scripting to     occur. (MFSA 2010-32)

  - The pseudo-random number generator is only seeded once     per browsing session and 'Math.random()' may be used to     recover the seed value allowing the browser instance     to be tracked across different websites. (MFSA 2010-33)

ID	Name	Product	Family	Severity
68054	Oracle Linux 4 : firefox (ELSA-2010-0500)	Nessus	Oracle Linux Local Security Checks	critical
68053	Oracle Linux 3 / 4 : seamonkey (ELSA-2010-0499)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
50873	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 2608 / 2609)	Nessus	SuSE Local Security Checks	critical
49893	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7083)	Nessus	SuSE Local Security Checks	critical
48265	CentOS 4 : firefox (CESA-2010:0500)	Nessus	CentOS Local Security Checks	critical
47788	CentOS 3 / 4 : seamonkey (CESA-2010:0499)	Nessus	CentOS Local Security Checks	critical
47693	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	critical
47691	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	critical
47689	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	critical
47226	Fedora 13 : seamonkey-2.0.5-1.fc13 (2010-10363)	Nessus	Fedora Local Security Checks	critical
47225	Fedora 13 : firefox-3.6.4-1.fc13 / galeon-2.0.7-29.fc13 / gnome-python2-extras-2.25.3-19.fc13 / etc (2010-10361)	Nessus	Fedora Local Security Checks	critical
47223	Fedora 12 : firefox-3.5.10-1.fc12 / galeon-2.0.7-23.fc12 / gnome-python2-extras-2.25.3-18.fc12 / etc (2010-10344)	Nessus	Fedora Local Security Checks	critical
47222	Fedora 12 : seamonkey-2.0.5-1.fc12 (2010-10329)	Nessus	Fedora Local Security Checks	critical
47153	Debian DSA-2064-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	high
47130	FreeBSD : mozilla -- multiple vulnerabilities (99858b7c-7ece-11df-a007-000f20797ede)	Nessus	FreeBSD Local Security Checks	critical
47129	CentOS 5 : firefox (CESA-2010:0501)	Nessus	CentOS Local Security Checks	critical
800874	SeaMonkey < 2.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800758	Firefox < 3.5.10 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5581	SeaMonkey < 2.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
5579	Mozilla Firefox < 3.5.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
47126	SeaMonkey < 2.0.5 Multiple Vulnerabilities	Nessus	Windows	high
47123	Firefox < 3.5.10 Multiple Vulnerabilities	Nessus	Windows	high
47119	RHEL 5 : firefox (RHSA-2010:0501)	Nessus	Red Hat Local Security Checks	critical
47118	RHEL 4 : firefox (RHSA-2010:0500)	Nessus	Red Hat Local Security Checks	critical
47117	RHEL 3 / 4 : seamonkey (RHSA-2010:0499)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2010-0183

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

high

high

medium

medium

high

high

critical

critical

critical