WINDOWS CENTER: ubuntu-security-announce Digest, Vol 61, Issue 9

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-853-1] Firefox and Xulrunner vulnerabilities
(Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Fri, 30 Oct 2009 22:23:04 -0500
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-853-1] Firefox and Xulrunner vulnerabilities
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091031032303.GA363@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-853-1 October 31, 2009
firefox-3.0, firefox-3.5, xulrunner-1.9, xulrunner-1.9.1 vulnerabilities
CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3371,
CVE-2009-3372, CVE-2009-3373, CVE-2009-3374, CVE-2009-3375,
CVE-2009-3376, CVE-2009-3377, CVE-2009-3380, CVE-2009-3381,
CVE-2009-3382, CVE-2009-3383
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
firefox-3.0 3.0.15+nobinonly-0ubuntu0.8.04.1
xulrunner-1.9 1.9.0.15+nobinonly-0ubuntu0.8.04.1

Ubuntu 8.10:
abrowser 3.0.15+nobinonly-0ubuntu0.8.10.1
firefox-3.0 3.0.15+nobinonly-0ubuntu0.8.10.1
xulrunner-1.9 1.9.0.15+nobinonly-0ubuntu0.8.10.1

Ubuntu 9.04:
abrowser 3.0.15+nobinonly-0ubuntu0.9.04.1
firefox-3.0 3.0.15+nobinonly-0ubuntu0.9.04.1
xulrunner-1.9 1.9.0.15+nobinonly-0ubuntu0.9.04.1

Ubuntu 9.10:
firefox-3.5 3.5.4+nobinonly-0ubuntu0.9.10.1
xulrunner-1.9.1 1.9.1.4+nobinonly-0ubuntu0.9.10.1

After a standard system upgrade you need to restart Firefox and any
applications that use xulrunner, such as Epiphany, to effect the necessary
changes.

Details follow:

Alin Rad Pop discovered a heap-based buffer overflow in Firefox when it
converted strings to floating point numbers. If a user were tricked into
viewing a malicious website, a remote attacker could cause a denial of service
or possibly execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-1563)

Jeremy Brown discovered that the Firefox Download Manager was vulnerable to
symlink attacks. A local attacker could exploit this to create or overwrite
files with the privileges of the user invoking the program. (CVE-2009-3274)

Paul Stone discovered a flaw in the Firefox form history. If a user were
tricked into viewing a malicious website, a remote attacker could access this
data to steal confidential information. (CVE-2009-3370)

Orlando Berrera discovered that Firefox did not properly free memory when using
web-workers. If a user were tricked into viewing a malicious website, a remote
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. This issue only
affected Ubuntu 9.10. (CVE-2009-3371)

A flaw was discovered in the way Firefox processed Proxy Auto-configuration
(PAC) files. If a user configured the browser to use PAC files with certain
regular expressions, an attacker could cause a denial of service or possibly
execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-3372)

A heap-based buffer overflow was discovered in Mozilla's GIF image parser. If a
user were tricked into viewing a malicious website, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-3373)

A flaw was discovered in the JavaScript engine of Firefox. An attacker could
exploit this to execute scripts from page content with chrome privileges.
(CVE-2009-3374)

Gregory Fleischer discovered that the same-origin check in Firefox could be
bypassed by utilizing the document.getSelection function. An attacker could
exploit this to read data from other domains. (CVE-2009-3375)

Jesse Ruderman and Sid Stamm discovered that Firefox did not properly display
filenames containing right-to-left (RTL) override characters. If a user were
tricked into downloading a malicious file with a crafted filename, an attacker
could exploit this to trick the user into opening a different file than the
user expected. (CVE-2009-3376)

Several flaws were discovered in third party media libraries. If a user were
tricked into opening a crafted media file, a remote attacker could cause a
denial of service or possibly execute arbitrary code with the privileges of the
user invoking the program. This issue only affected Ubuntu 9.10.
(CVE-2009-3377)

Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel Banchero, David
Keeler, Boris Zbarsky, Thomas Frederiksen, Marcia Knous, Carsten Book, Kevin
Brosnan, David Anderson and Jeff Walden discovered various flaws in the browser
and JavaScript engines of Firefox. If a user were tricked into viewing a
malicious website, a remote attacker could cause a denial of service or
possibly execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-3380, CVE-2009-3381, CVE-2009-3382, CVE-2009-3383)

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1.diff.gz
Size/MD5: 106314 5705de8eacb2271b4704b3a456227d85
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1.dsc
Size/MD5: 2732 87deeeecc44882f56d6f0b86b220d567
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly.orig.tar.gz
Size/MD5: 11627656 5d238a2e0ba1f6fbec5d40f1239840a6
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1.diff.gz
Size/MD5: 79445 5dc738d84a62365f5482e34e04453d8c
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1.dsc
Size/MD5: 2783 84818b8054ad47e12789f5e3776bc898
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly.orig.tar.gz
Size/MD5: 40751836 b9bfd76fae07b34be42fca0ef6db34ec

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0-dev_3.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 9024 dde277a329dda4d1904a9c620d0be8b2
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0-gnome-support_3.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 29584 ad6b85cfbf9f20ed903e053fe214519b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 1092334 7e90c3fe4691c9b729ff9d43939c4fb9
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9-dev_1.9.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 4647306 f647f5c2ff09c4f4872558fb31592ed3
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9-gnome-support_1.9.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 48650 95a4e0dde648c064177a19036e224c18
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 9085778 109f3e5aa682c47cf1a7b9c40c0e5cc1

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0-dev_3.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 9024 f6ae83aa42174a8f67f4a8e953a84d5a
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0-gnome-support_3.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 25728 a28f7e519284af5c7806a2ac6b195d53
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 1071412 13f096672744864409aab57b64fe7dee
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9-dev_1.9.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 4623658 35049aba5bf35c512859d0ec5ecdc33e
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9-gnome-support_1.9.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 38514 1dd97bb57d8b7152fb09e95f1b71670a
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 7813136 883aa64f8ca7c711fab5c1469f591d8a

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0-dev_3.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 9026 f479af46755aec9b3371d757783d7705
http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0-gnome-support_3.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 25342 843e800bb88ef030406d0a6fc492c63a
http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 1068070 6ce9348959f3bfac9ab935b598f69de2
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9-dev_1.9.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 4619186 f03958973abbb5b148ec3783e7f4da6e
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9-gnome-support_1.9.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 37604 3a4d044d8edaecf09b8ae381d3149fde
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 7700428 f55de61c6d5b7adb150e7b3ef95fb668

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0-dev_3.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 9032 e88492418a0413b3b9d74b0e653028fe
http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0-gnome-support_3.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 27508 f4b849c196275fe215aefed477dc369d
http://ports.ubuntu.com/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 1085406 93afbe04b45809bf75253d5801c41602
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9-dev_1.9.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 4615126 425cfb479093d4d7e491dbe756aa4e86
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9-gnome-support_1.9.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 43668 4830136ef1102433aaa362975df47ae7
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 8663760 4548373a1d72e4b65b78dfe9f2d79ca2

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.10.1.diff.gz
Size/MD5: 124142 b47fc547db8d74df2591604a21db64f3
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.8.10.1.dsc
Size/MD5: 2787 1f500be588ff719e9530a94929be8837
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly.orig.tar.gz
Size/MD5: 11627656 5d238a2e0ba1f6fbec5d40f1239840a6
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.10.1.diff.gz
Size/MD5: 251317 75993b68b70b48d424260e517bd4e034
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.8.10.1.dsc
Size/MD5: 2801 ff4eed794aef2d6198baf13d247d5838
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly.orig.tar.gz
Size/MD5: 40751836 b9bfd76fae07b34be42fca0ef6db34ec

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.9.04.1.diff.gz
Size/MD5: 124337 d7851e8ca75b8682d1e3eb93a1a0fafe
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly-0ubuntu0.9.04.1.dsc
Size/MD5: 2787 b915bfa3eb700d61af587dbabf7a7203
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.0.15+nobinonly.orig.tar.gz
Size/MD5: 11627656 5d238a2e0ba1f6fbec5d40f1239840a6
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.9.04.1.diff.gz
Size/MD5: 252043 1a10ae99d57c96670d13bf54497bddb1
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly-0ubuntu0.9.04.1.dsc
Size/MD5: 2801 9aabcba4400c8840b06ec1ba457036b3
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9/xulrunner-1.9_1.9.0.15+nobinonly.orig.tar.gz
Size/MD5: 40751836 b9bfd76fae07b34be42fca0ef6db34ec

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.4+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 128482 9dc82d562eb81d9b5d1ed06aef8adc60
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.4+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2940 e3c8303ef16c400dd03caa5b21a8f54c
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.4+nobinonly.orig.tar.gz
Size/MD5: 44918649 cbc9f1e8dc3701e24afbadcaf4cab6b6
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.4+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 64079 f3146f071bba9ec923ce5c3692ee56a0
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.4+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2910 a914c8c8d98b04dcc4d20577deb77dcc
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.4+nobinonly.orig.tar.gz
Size/MD5: 44052132 a15d6074d33b6afb6a6aad4df2ef746c

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091030/7cb7f4a2/attachment.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 61, Issue 9
*******************************************************

News

Friday, October 30, 2009

ubuntu-security-announce Digest, Vol 61, Issue 9

No comments:

WINDOWS CENTER

Blog Archive