full-disclosure - [ MDVSA-2010:213 ] xulrunner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1PBSRZ-0007kN-Vr@titan.mandriva.com>
Date: Thu, 28 Oct 2010 15:23:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:213 ] xulrunner

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:213
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : xulrunner
 Date    : October 28, 2010
 Affected: 2009.0, 2010.0, 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in xulrunner:
 
 Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.14
 and 3.6.x through 3.6.11, when JavaScript is enabled, allows remote
 attackers to execute arbitrary code via unknown vectors, as exploited
 in the wild in October 2010 by the Belmoo malware (CVE-2010-3765).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3765
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 7101153acd66111da72df4d8582b68a0  2009.0/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2009.0.i586.rpm
 bb7724ae83aa51dcff03577e159fd463  2009.0/i586/libxulrunner-devel-1.9.2.11-0.2mdv2009.0.i586.rpm
 d42fccf9cc40ba8d18b140f0a02fabd0  2009.0/i586/xulrunner-1.9.2.11-0.2mdv2009.0.i586.rpm 
 466b75ef822c9bfd2cb3dc76eef6da53  2009.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 5d5d4987963b7acaaab20c8e9c24787b  2009.0/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2009.0.x86_64.rpm
 c570198c0797ad3b6059f6ed21b74016  2009.0/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2009.0.x86_64.rpm
 53ce3c82744822bdf7d1b1d7378d420a  2009.0/x86_64/xulrunner-1.9.2.11-0.2mdv2009.0.x86_64.rpm 
 466b75ef822c9bfd2cb3dc76eef6da53  2009.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 525e94891b81e7773f98c21fdbd32567  2010.0/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2010.0.i586.rpm
 dfa0583ea59506e1b6b5a751edf2bae2  2010.0/i586/libxulrunner-devel-1.9.2.11-0.2mdv2010.0.i586.rpm
 1c76b4131e88bf4f8bed182bd785915c  2010.0/i586/xulrunner-1.9.2.11-0.2mdv2010.0.i586.rpm 
 018afadac0f3edd3d42c3149d0523332  2010.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 ce448c21759284c754923f77313b16c1  2010.0/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2010.0.x86_64.rpm
 f4287d26a1f1fe5864b72b7691494d67  2010.0/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2010.0.x86_64.rpm
 61c8d46cab1c9f0567af9d3e1ad05002  2010.0/x86_64/xulrunner-1.9.2.11-0.2mdv2010.0.x86_64.rpm 
 018afadac0f3edd3d42c3149d0523332  2010.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 a026e31f79811179200cb96e258b1832  2010.1/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2010.1.i586.rpm
 403a9bc17217470b8780a93d582c0abc  2010.1/i586/libxulrunner-devel-1.9.2.11-0.2mdv2010.1.i586.rpm
 c85c056f1ce7c5520b60ffccbee41f7d  2010.1/i586/xulrunner-1.9.2.11-0.2mdv2010.1.i586.rpm 
 a6f746d7949da935ba5237d0f9f9f0aa  2010.1/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.1.src.rpm

 Mandriva Linux 2010.1/X86_64:
 0200b2510106c17d479858ed50de1889  2010.1/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2010.1.x86_64.rpm
 f9ae126654f6d8326b9d59bb2e6861a7  2010.1/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2010.1.x86_64.rpm
 9057a6d7bb740ffac5b56ac41ac75b18  2010.1/x86_64/xulrunner-1.9.2.11-0.2mdv2010.1.x86_64.rpm 
 a6f746d7949da935ba5237d0f9f9f0aa  2010.1/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.1.src.rpm

 Mandriva Enterprise Server 5:
 345cb1ed93d63d143dbb4d5e578f5ef5  mes5/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdvmes5.1.i586.rpm
 dbe75eb7ea67d131f166a8a015597810  mes5/i586/libxulrunner-devel-1.9.2.11-0.2mdvmes5.1.i586.rpm
 f9ffe89fdc1fda5e18300b64dd3292de  mes5/i586/xulrunner-1.9.2.11-0.2mdvmes5.1.i586.rpm 
 1f35554e93457f361788226226736561  mes5/SRPMS/xulrunner-1.9.2.11-0.2mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 200429fa806a1886648736ebfb8d4b5c  mes5/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdvmes5.1.x86_64.rpm
 a8561066847eefe19c030dfc5be1398e  mes5/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdvmes5.1.x86_64.rpm
 d038e33c018054a3d87fb05491542186  mes5/x86_64/xulrunner-1.9.2.11-0.2mdvmes5.1.x86_64.rpm 
 1f35554e93457f361788226226736561  mes5/SRPMS/xulrunner-1.9.2.11-0.2mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMyUnfmqjQ0CJFipgRAhriAJ9kIYyrHAuVgWvXk8na3nROWEaeNQCfZN+1
6V005lDu4wEvbruVt4OC/e8=
=Gwvm
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/