Detections
Analytics
openSUSE Security Update : MozillaFirefox (MozillaFirefox-1202)
critical Nessus Plugin ID 40648
Synopsis
The remote openSUSE host is missing a security update.Description
MozillaFirefox was updated to the 3.0.13 release, fixing some security issues and bugs :MFSA 2009-44 / CVE-2009-2654: Security researcher Juan Pablo Lopez Yacubian reported that an attacker could call window.open() on an invalid URL which looks similar to a legitimate URL and then use document.write() to place content within the new document, appearing to have come from the spoofed location. Additionally, if the spoofed document was created by a document with a valid SSL certificate, the SSL indicators would be carried over into the spoofed document. An attacker could use these issues to display misleading location and SSL information for a malicious web page.
MFSA 2009-45 / CVE-2009-2662:The browser engine in Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the TraceRecorder::snapshot function in js/src/jstracer.cpp, and unspecified other vectors.
CVE-2009-2663 / MFSA 2009-45: libvorbis before r16182, as used in Mozilla Firefox before 3.0.13 and 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .ogg file.
CVE-2009-2664 / MFSA 2009-45: The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a 'memory safety bug.'
Solution
Update the affected MozillaFirefox packages.See Also
Plugin Details
Severity: Critical
ID: 40648
File Name: suse_11_1_MozillaFirefox-090812.nasl
Version: 1.12
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 8/20/2009
Updated: 1/14/2021
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:mozilla-xulrunner190, p-cpe:/a:novell:opensuse:libidl, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-gnomevfs, p-cpe:/a:novell:opensuse:mozillafirefox-branding-upstream, p-cpe:/a:novell:opensuse:mozillafirefox, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-translations-32bit, p-cpe:/a:novell:opensuse:orbit2-32bit, p-cpe:/a:novell:opensuse:libidl-32bit, p-cpe:/a:novell:opensuse:mozillafirefox-translations, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-32bit, p-cpe:/a:novell:opensuse:orbit2, p-cpe:/a:novell:opensuse:gconf2-32bit, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-gnomevfs-32bit, cpe:/o:novell:opensuse:11.1, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-devel, p-cpe:/a:novell:opensuse:python-xpcom190, p-cpe:/a:novell:opensuse:mozilla-xulrunner190-translations, p-cpe:/a:novell:opensuse:gconf2
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Patch Publication Date: 8/12/2009
Reference Information
CVE: CVE-2009-2654, CVE-2009-2662, CVE-2009-2663, CVE-2009-2664