The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack." NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-5913.

From Red Hat Security Advisory 2010:0500 :

An updated firefox package that addresses security issues, fixes bugs, adds numerous enhancements, and upgrades Firefox to version 3.6.4, is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4, and as such, contains multiple bug fixes and numerous enhancements.
Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to this updated package, which contains Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

From Red Hat Security Advisory 2010:0499 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Versions of Firefox earlier than 3.6.9 are potentially affected by multiple vulnerabilities :

  - Multiple memory safety issues that could lead to arbitrary code execution. (MFSA 2010-49)

  - The implementation of the HTML frameset element contains an integer overflow vulnerability. (MFSA 2010-50)

  - A dangling pointer vulnerability exists in the implementation of 'navigator.plugins' in which the 'navigator' object could retain a pointer to the plugins array even after it has been destroyed. (MFSA 2010-51)

  - Firefox can be used to load a malicious code library that has been planted on a victim's computer. (MFSA 2010-52)

  - 'Math.random() PRNG' values and states could be disclosed across domains making it possible to reconstruct the values and states. (CVE-2010-3171)

  - A heap buffer overflow exists in code routines responsible for transforming text runs. (MFSA 2010-53)

  - A dangling pointer issue remains leftover from the fix for CVE-2010-2753. (MFSA 2010-54)

  - XUL '&lt;tree&gt;' objects can be manipulated such that the setting of certain properties on the object would trigger the removal of the tree from the DOM and cause certain sections of deleted memory to be accessed. (MFSA 2010-55)

  - The implementation of the XUL '&lt;tree&gt;' content view contains a dangling pointer vulnerability. (MFSA 2010-56)

  - The code used to normalize a document contains a logical flaw that could be leveraged to run arbitrary code. (MFSA 2010-57)

  - A specially crafted font can be applied to a document and cause a crash on Mac systems. (MFSA 2010-58)

  - The wrapper class 'XPCSafeJSObjectWrapper' (SJOW) creates scope chains ending in outer objects. (MFSA 2010-59)

  - The 'type' attribute of an &lt;object&gt; tag can override the charset of a framed HTML document even when the document is included across origins. (MFSA 2010-61)

  - When an HTML selection containing JavaScript is copy-and-pasted or dropped onto a document with designMode enabled, the JavaScript will be executed within the context of the site where the code was dropped. (MFSA 2010-62)

  - The 'statusText' property of an 'XMLHttpRequest' object is readable by the requestor even when the request is made across origins. (MFSA 2010-63)

Versions of Firefox earlier than 3.6.9 are potentially affected by multiple vulnerabilities :

 - Multiple memory safety issues that could lead to arbitrary code execution. (MFSA 2010-49)
 - The implementation of the HTML frameset element contains an integer overflow vulnerability. (MFSA 2010-50)
 - A dangling pointer vulnerability exists in the implementation of 'navigator.plugins' in which the 'navigator' object could retain a pointer to the plugins array even after it has been destroyed. (MFSA 2010-51)
 - Firefox can be used to load a malicious code library that has been planted on a victim's computer. (MFSA 2010-52)
 - 'Math.random() PRNG' values and states could be disclosed across domains making it possible to reconstruct the values and states. (CVE-2010-3171)
 - A heap buffer overflow exists in code routines responsible for transforming text runs. (MFSA 2010-53)
 - A dangling pointer issue remains leftover from the fix for CVE-2010-2753. (MFSA 2010-54)
 - XUL '<tree>' objects can be manipulated such that the setting of certain properties on the object would trigger the removal of the tree from the DOM and cause certain sections of deleted memory to be accessed. (MFSA 2010-55)
 - The implementation of the XUL '<tree>' content view contains a dangling pointer vulnerability. (MFSA 2010-56)
 - The code used to normalize a document contains a logical flaw that could be leveraged to run arbitrary code. (MFSA 2010-57)
 - A specially crafted font can be applied to a document and cause a crash on Mac systems. (MFSA 2010-58)
 - The wrapper class 'XPCSafeJSObjectWrapper' (SJOW) creates scope chains ending in outer objects. (MFSA 2010-59)
 - The 'type' attribute of an <object> tag can override the charset of a framed HTML document even when the document is included across origins. (MFSA 2010-61)
 - When an HTML selection containing JavaScript is copy-and-pasted or dropped onto a document with designMode enabled, the JavaScript will be executed within the context of the site where the code was dropped. (MFSA 2010-62)
 - The 'statusText' property of an 'XMLHttpRequest' object is readable by the requestor even when the request is made across origins. (MFSA 2010-63)

The installed version of Firefox 3.6 is earlier than 3.6.9.  Such versions are potentially affected by the following security issues :

  - The pseudo-random number generator is only seeded once     per browsing session and 'Math.random()' may be used to     recover the seed value allowing the browser instance     to be tracked across different websites.  This was     originally covered by MFSA 2010-33, but was reportedly     fixed incorrectly until version 3.6.9. (CVE-2010-3171)

  - Multiple memory safety bugs could lead to memory     corruption, potentially resulting in arbitrary     code execution. (MFSA 2010-49)

  - An integer overflow vulnerability in HTML frameset element     implementation could lead to arbitrary code execution.
    (MFSA 2010-50)

  - A dangling pointer vulnerability in 'navigator.plugins'     could lead to arbitrary code execution. (MFSA 2010-51)

  - It is possible to perform DLL hijacking attacks via     dwmapi.dll. (MFSA 2010-52)

  - A heap overflow vulnerability in function     'nsTextFrameUtils::TransformText' could result in     arbitrary code execution on the remote system.
    (MFSA 2010-53)

  - A dangling pointer vulnerability reported in     MFSA 2010-40 was incorrectly fixed. (MFSA 2010-54)

  - By manipulating XUL <tree> objects it may be possible     to crash the browser or run arbitrary code on the     remote system. (MFSA 2010-55)

  - A dangling pointer vulnerability affects XUL <tree>'s     content view implementation, which could allow arbitrary     code execution on the remote system. (MFSA 2010-56)

  - Code used to normalize a document could lead to a crash     or arbitrary code execution on the remote system.
    (MFSA 2010-57)

  - A specially crafted font could trigger memory corruption     on Mac systems, potentially resulting in arbitrary code     execution on the remote system. (MFSA 2010-58)

  - It may be possible to run arbitrary JavaScript with     chrome privileges via wrapper class XPCSafeJSObjectWrapper     (SJOW). (MFSA 2010-59)

  - The 'type' attribute of an <object> tag could override     charset of a framed HTML document, which could allow     an attacker to inject and execute UTF-7 encoded     JavaScript code into a website. (MFSA 2010-61)

  - Copy-and-paste or drag-and-drop of an HTML selection     containing JavaScript into a designMode document     could trigger a cross-site scripting vulnerability.     (MFSA 2010-62)

  - It is possible to read sensitive information via     'statusText' property of an XMLHttpRequest object.
    (MFSA 2010-63)

The installed version of Firefox is earlier than 3.5.12.  Such versions are potentially affected by the following security issues :
  - The pseudo-random number generator is only seeded once     per browsing session and 'Math.random()' may be used to     recover the seed value allowing the browser instance     to be tracked across different websites.  This was     originally covered by MFSA 2010-33, but was reportedly     fixed incorrectly until version 3.5.12. (CVE-2010-3171)

  - Multiple memory safety bugs could lead to memory     corruption, potentially resulting in arbitrary     code execution. (MFSA 2010-49)

  - An integer overflow vulnerability in HTML frameset element     implementation could lead to arbitrary code execution.
    (MFSA 2010-50)

  - A dangling pointer vulnerability in 'navigator.plugins'     could lead to arbitrary code execution. (MFSA 2010-51)

  - It is possible to perform DLL hijacking attacks via     dwmapi.dll. (MFSA 2010-52)

  - A heap overflow vulnerability in function     'nsTextFrameUtils::TransformText' could result in     arbitrary code execution on the remote system.
    (MFSA 2010-53)

  - A dangling pointer vulnerability reported in     MFSA 2010-40 was incorrectly fixed. (MFSA 2010-54)

  - By manipulating XUL <tree> objects it may be possible     to crash the browser or run arbitrary code on the     remote system. (MFSA 2010-55)

  - A dangling pointer vulnerability affects XUL <tree>'s     content view implementation, which could allow arbitrary     code execution on the remote system. (MFSA 2010-56)

  - Code used to normalize a document could lead to a crash     or arbitrary code execution on the remote system.
    (MFSA 2010-57)

  - A specially crafted font could trigger memory corruption     on Mac systems, potentially resulting in arbitrary code     execution on the remote system. (MFSA 2010-58)

  - It is possible to trigger a cross-site scripting     vulnerability using SJOW scripted function.
    (MFSA 2010-60)

  - The 'type' attribute of an <object> tag could override     charset of a framed HTML document, which could allow     an attacker to inject and execute UTF-7 encoded     JavaScript code into a website. (MFSA 2010-61)

  - Copy-and-paste or drag-and-drop of an HTML selection     containing JavaScript into a designMode document     could trigger a cross-site scripting vulnerability.
    (MFSA 2010-62)

  - It is possible to read sensitive information via     'statusText' property of an XMLHttpRequest object.
    (MFSA 2010-63)

An updated firefox package that addresses security issues, fixes bugs, adds numerous enhancements, and upgrades Firefox to version 3.6.4, is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4, and as such, contains multiple bug fixes and numerous enhancements.
Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to this updated package, which contains Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Updated firefox packages that address several security issues, fix bugs, add numerous enhancements, and upgrade Firefox to version 3.6.4, are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 June 2010] The original packages distributed with this erratum had a bug which could cause unintended dependencies to be installed when upgrading. We have updated the packages to correct this bug.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4.
Due to the requirements of Firefox 3.6.4, this erratum also provides a number of other updated packages, including esc, totem, and yelp.

This erratum also contains multiple bug fixes and numerous enhancements. Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
68054	Oracle Linux 4 : firefox (ELSA-2010-0500)	Nessus	Oracle Linux Local Security Checks	critical
68053	Oracle Linux 3 / 4 : seamonkey (ELSA-2010-0499)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
800747	Firefox 3.6.x < 3.6.9 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5657	Mozilla Firefox 3.6.x < 3.6.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
49146	Firefox 3.6 < 3.6.9 Multiple Vulnerabilities	Nessus	Windows	high
49145	Firefox < 3.5.12 Multiple Vulnerabilities	Nessus	Windows	high
48265	CentOS 4 : firefox (CESA-2010:0500)	Nessus	CentOS Local Security Checks	critical
47788	CentOS 3 / 4 : seamonkey (CESA-2010:0499)	Nessus	CentOS Local Security Checks	critical
47129	CentOS 5 : firefox (CESA-2010:0501)	Nessus	CentOS Local Security Checks	critical
47119	RHEL 5 : firefox (RHSA-2010:0501)	Nessus	Red Hat Local Security Checks	critical
47118	RHEL 4 : firefox (RHSA-2010:0500)	Nessus	Red Hat Local Security Checks	critical
47117	RHEL 3 / 4 : seamonkey (RHSA-2010:0499)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2010-3171

medium

Tenable Plugins

critical

critical

critical

high

medium

high

high

critical

critical

critical

critical

critical

critical