| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060727214851.GC5170@piware.de>
Date: Thu, 27 Jul 2006 23:48:51 +0200
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-327-1] firefox vulnerabilities
===========================================================
Ubuntu Security Notice USN-327-1 July 27, 2006
firefox vulnerabilities
CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
CVE-2006-3812
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
firefox 1.5.dfsg+1.5.0.5-0ubuntu6.06
After a standard system upgrade you need to restart Firefox to effect
the necessary changes.
Please note that Firefox 1.0.8 in Ubuntu 5.10 and Ubuntu 5.04 are also
affected by these problems. Updates for these Ubuntu releases will be
delayed due to upstream dropping support for this Firefox version. We
strongly advise that you disable JavaScript to disable the attack
vectors for most vulnerabilities if you use one of these Ubuntu
versions.
Details follow:
Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious URL. (CVE-2006-3113, CVE-2006-3677, CVE-2006-3801,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3809, CVE-2006-3811, CVE-2006-3812)
cross-site scripting vulnerabilities were found in the
XPCNativeWrapper() function and native DOM method handlers. A
malicious web site could exploit these to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-3802, CVE-2006-3810)
A bug was found in the script handler for automatic proxy
configuration. A malicious proxy could send scripts which could
execute arbitrary code with the user's privileges. (CVE-2006-3808)
Please see
http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox
for technical details of these vulnerabilities.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.diff.gz
Size/MD5: 174602 7be6f5862219ac4cf44f05733f372f2b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.dsc
Size/MD5: 1109 252d6acf45b009008a6bc88166e2632f
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5.orig.tar.gz
Size/MD5: 44067762 749933c002e158576ec15782fc451e43
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
Size/MD5: 49190 850dd650e7f876dd539e605d9b3026c8
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
Size/MD5: 50078 c1fa4a40187d9c5b58bd049edb00ce54
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 47269292 167aadc3f03b4e1b7cb9ed826e672983
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 2796768 b54592d0bd736f6ee12a90987771bc59
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 216136 79fa6c69ffb0dd6037e56d1ba538ff64
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 82358 e2e026d582a7b5352cee4453cef0fe45
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 9400544 a9d0b804a4374dc636bb79968a2bce5c
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 218822 a09476caea7d8d73d6a2f534bd494493
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 161876 0e0e65348dba8167b4891b173baa8f0d
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 235746 064fc1434a315f857ee92f60fd49d772
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
Size/MD5: 757458 bd6a5e28e05a04a5deca731ab29f70e4
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 43837610 a7e4a535262f8a5d5cb0ace7ed785237
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 2796700 4509dbf62e3fd2cda7168c20aa65ba4f
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 209546 50e174c1c7290fca51f9e1ee71ebb56c
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 74732 25ba86caeeb1a88da4493875178a3636
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 7916536 40ebfe4330af25c2359f8b25b039ed5e
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 218822 6066f59acbce1b4de2dc284b5801efc5
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 146570 c1a5c5cc4371b228093d03d9ed7ad607
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 235754 0e9a1a89f63a9869b875ee6a50547c2b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
Size/MD5: 669556 d537a4771b80e5c06f18b2c5d7e5d384
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 48648192 479d29e08ff2b9cef89a6da3285c0aad
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 2796790 60b97738bfc3b8b32914487bb4aba239
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 212982 a396e119a32303afc024d513b997c84e
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 77894 ef7841bb2ab8de0e0c44e59c893b1622
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 9019132 ed3927484eea5fccf84a2840640febf3
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 218826 a2338c3c8064a304deb752bf32a291f8
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 159112 7d5d6100727ceb894695b219cec11e43
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 235754 69085beb145222fea07d2d6c19158a2d
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
Size/MD5: 768332 8dc6cc8c54185d57af14bab3bee39f9d
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 45235424 f5a07188af5802fffbd3cfdd64b109cf
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 2796756 cb13c7ea0e3b7af2f1e12db1f8dc38a2
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 210488 17f7723b697110c8f132422bc059d447
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 76340 c38ccb8b71b9c3783a1c9816ecd9cf5d
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 8411310 4b3865b2df3924d094e0b18f207bf33d
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 218814 a0e67d0d425cea2cd5835e2c2faa930f
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 149018 73108368f0ef745188ebd1c48ea10c88
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 235746 695a6122710fb30201daaa239ba6d48d
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
Size/MD5: 681612 896721beb3cdcea12bab98223c0796c2
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists