USN-1353-1 : xulrunner-1.9.2 vulnerabilities


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

Jesse Ruderman and Bob Clary discovered memory safety issues
affecting the Gecko Browser engine. If the user were tricked into
opening a specially crafted page, an attacker could exploit these to
cause a denial of service via application crash, or potentially
execute code with the privileges of the user invoking Xulrunner.
(CVE-2012-0442)

It was discovered that the Gecko Browser engine did not properly
handle node removal in the DOM. If the user were tricked into opening
a specially crafted page, an attacker could exploit this to cause a
denial of service via application crash, or potentially execute code
with the privileges of the user invoking Xulrunner. (CVE-2011-3659)

It was discovered that memory corruption could occur during the
decoding of Ogg Vorbis files. If the user were tricked into opening a
specially crafted file, an attacker could exploit this to cause a
denial of service via application crash, or potentially execute code
with the privileges of the user invoking Xulrunner. (CVE-2012-0444)

Nicolas Gregoire and Aki Helin discovered that when processing a
malformed embedded XSLT stylesheet, Xulrunner can crash due to memory
corruption. If the user were tricked into opening a specially crafted
page, an attacker could exploit this to cause a denial of service via
application crash, or potentially execute code with the privileges of
the user invoking Xulrunner. (CVE-2012-0449)

Gregory Fleischer discovered that requests using IPv6 hostname syntax
through certain proxies might generate errors. An attacker might be
able to use this to read sensitive data from the error messages.
(CVE-2011-3670)

See also :


only registered users with at least 25 hack challenge points can see links:
click here in order to visit the hack challenges

Solution :

Update the affected package(s).

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)



original thread:
only registered users with at least 25 hack challenge points can see links:
click here in order to visit the hack challenges