Detections
Analytics
SuSE 10 Security Update : Mozilla (ZYPP Patch Number 5654)
critical Nessus Plugin ID 34366
Synopsis
The remote SuSE 10 host is missing a security-related patch.Description
This update backports lots of security fixes to mozilla-xulrunner package of SLES 10.It contains among others the following security fixes :
- XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069)
- resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068)
- BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43)
- Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062:
Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42)
- Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41)
- Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837)
- Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836)
- nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835)
- UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016)
For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html
Solution
Apply ZYPP patch number 5654.See Also
http://support.novell.com/security/cve/CVE-2008-4067.html
http://support.novell.com/security/cve/CVE-2008-4068.html
http://support.novell.com/security/cve/CVE-2008-4069.html
https://www.mozilla.org/en-US/security/advisories/mfsa2008-37/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-38/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-39/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-40/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-41/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-42/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-43/
https://www.mozilla.org/en-US/security/advisories/mfsa2008-44/
http://support.novell.com/security/cve/CVE-2008-0016.html
http://support.novell.com/security/cve/CVE-2008-3835.html
http://support.novell.com/security/cve/CVE-2008-3836.html
http://support.novell.com/security/cve/CVE-2008-3837.html
http://support.novell.com/security/cve/CVE-2008-4058.html
http://support.novell.com/security/cve/CVE-2008-4059.html
http://support.novell.com/security/cve/CVE-2008-4060.html
http://support.novell.com/security/cve/CVE-2008-4061.html
http://support.novell.com/security/cve/CVE-2008-4062.html
http://support.novell.com/security/cve/CVE-2008-4063.html
http://support.novell.com/security/cve/CVE-2008-4064.html
Plugin Details
Severity: Critical
ID: 34366
File Name: suse_gecko-sdk-5654.nasl
Version: 1.23
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 10/8/2008
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/o:suse:suse_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/2/2008
Vulnerability Publication Date: 9/24/2008
Exploitable With
CANVAS (CANVAS)
Core Impact
Reference Information
CVE: CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069