Lucene search

DebianDEBIAN:DSA-1484-1:87969

HistoryFeb 10, 2008 - 8:23 p.m.

[SECURITY] [DSA 1484-1] New xulrunner packages fix several vulnerabilities

2008-02-1020:23:48

lists.debian.org

Debian Security Advisory DSA-1484-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
February 10, 2008 http://www.debian.org/security/faq

Package : xulrunner
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-0412 CVE-2008-0413 CVE-2008-0414 CVE-2008-0415 CVE-2008-0416 CVE-2008-0417 CVE-2008-0418 CVE-2008-0419 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 CVE-2008-0594

Several remote vulnerabilities have been discovered in Xulrunner, a
runtime environment for XUL applications. The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2008-0412

Jesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul
Nickerson discovered crashes in the layout engine, which might allow
the execution of arbitrary code.

CVE-2008-0413

Carsten Book, Wesley Garland, Igor Bukanov, &quot;moz_bug_r_a4&quot;, &quot;shutdown&quot;,
Philip Taylor and &quot;tgirmann&quot; discovered crashes in the Javascript
engine, which might allow the execution of arbitrary code.

CVE-2008-0414

&quot;hong&quot; and Gregory Fleisher discovered that file input focus
vulnerabilities in the file upload control could allow information
disclosure of local files.

CVE-2008-0415

&quot;moz_bug_r_a4&quot; and Boris Zbarsky discovered discovered several
vulnerabilities in Javascript handling, which could allow
privilege escalation.

CVE-2008-0417

Justin Dolske discovered that the password storage machanism could
be abused by malicious web sites to corrupt existing saved passwords.

CVE-2008-0418

Gerry Eisenhaur and &quot;moz_bug_r_a4&quot; discovered that a directory
traversal vulnerability in chrome: URI handling could lead to
information disclosure.

CVE-2008-0419

David Bloom discovered a race condition in the image handling of
designMode elements, which could lead to information disclosure or
potentially the execution of arbitrary code.

CVE-2008-0591

Michal Zalewski discovered that timers protecting security-sensitive
dialogs (which disable dialog elements until a timeout is reached)
could be bypassed by window focus changes through Javascript.

CVE-2008-0592

It was discovered that malformed content declarations of saved
attachments could prevent a user in the opening local files
with a &quot;.txt&quot; file name, resulting in minor denial of service.

CVE-2008-0593

Martin Straka discovered that insecure stylesheet handling during
redirects could lead to information disclosure.

CVE-2008-0594

Emil Ljungdahl and Lars-Olof Moilanen discovered that phishing
protections could be bypassed with &lt;div&gt; elements.

For the stable distribution (etch), these problems have been fixed in
version 1.8.0.15~pre080131b-0etch1.

The old stable distribution (sarge) doesn't contain xulrunner.

We recommend that you upgrade your xulrunner packages.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 4.0 (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131b.orig.tar.gz
Size/MD5 checksum: 42973580 d79eb23c39acecdd77b75e21f60f1ed7
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131b-0etch1.dsc
Size/MD5 checksum: 1984 3be3e9cea71684c38875204f26b4991f
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131a-0etch1.dsc
Size/MD5 checksum: 1984 51d5d15af381b1cb1c7a53b86403eaaa
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131b-0etch1.diff.gz
Size/MD5 checksum: 146050 71b08cb7e88e9979cc95f8b266f32314
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131a.orig.tar.gz
Size/MD5 checksum: 42937342 47a9192461a2810f3c723886f7eca283
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.8.0.15~pre080131a-0etch1.diff.gz
Size/MD5 checksum: 145864 b0e482844e8b0868b8897a6800e77975

Architecture independent packages:

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian4i386libnss3-tools< 1.8.0.15~pre080131b-0etch1libnss3-tools_1.8.0.15~pre080131b-0etch1_i386.deb
Debian4sparclibnspr4-0d< 1.8.0.15~pre080131b-0etch1libnspr4-0d_1.8.0.15~pre080131b-0etch1_sparc.deb
Debian4mipsellibnss3-0d< 1.8.0.15~pre080131b-0etch1libnss3-0d_1.8.0.15~pre080131b-0etch1_mipsel.deb
Debian4s390libmozjs0d-dbg< 1.8.0.15~pre080131b-0etch1libmozjs0d-dbg_1.8.0.15~pre080131b-0etch1_s390.deb
Debian4amd64libnspr4-0d< 1.8.0.15~pre080131b-0etch1libnspr4-0d_1.8.0.15~pre080131b-0etch1_amd64.deb
Debian4powerpcxulrunner-gnome-support< 1.8.0.15~pre080131b-0etch1xulrunner-gnome-support_1.8.0.15~pre080131b-0etch1_powerpc.deb
Debian4mipslibmozjs0d< 1.8.0.15~pre080131b-0etch1libmozjs0d_1.8.0.15~pre080131b-0etch1_mips.deb
Debian4ia64python-xpcom< 1.8.0.15~pre080131b-0etch1python-xpcom_1.8.0.15~pre080131b-0etch1_ia64.deb
Debian4mipsellibnspr4-0d-dbg< 1.8.0.15~pre080131b-0etch1libnspr4-0d-dbg_1.8.0.15~pre080131b-0etch1_mipsel.deb
Debian4ia64libnss3-0d-dbg< 1.8.0.15~pre080131b-0etch1libnss3-0d-dbg_1.8.0.15~pre080131b-0etch1_ia64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	4	i386	libnss3-tools	< 1.8.0.15~pre080131b-0etch1	libnss3-tools_1.8.0.15~pre080131b-0etch1_i386.deb
Debian	4	sparc	libnspr4-0d	< 1.8.0.15~pre080131b-0etch1	libnspr4-0d_1.8.0.15~pre080131b-0etch1_sparc.deb
Debian	4	mipsel	libnss3-0d	< 1.8.0.15~pre080131b-0etch1	libnss3-0d_1.8.0.15~pre080131b-0etch1_mipsel.deb
Debian	4	s390	libmozjs0d-dbg	< 1.8.0.15~pre080131b-0etch1	libmozjs0d-dbg_1.8.0.15~pre080131b-0etch1_s390.deb
Debian	4	amd64	libnspr4-0d	< 1.8.0.15~pre080131b-0etch1	libnspr4-0d_1.8.0.15~pre080131b-0etch1_amd64.deb
Debian	4	powerpc	xulrunner-gnome-support	< 1.8.0.15~pre080131b-0etch1	xulrunner-gnome-support_1.8.0.15~pre080131b-0etch1_powerpc.deb
Debian	4	mips	libmozjs0d	< 1.8.0.15~pre080131b-0etch1	libmozjs0d_1.8.0.15~pre080131b-0etch1_mips.deb
Debian	4	ia64	python-xpcom	< 1.8.0.15~pre080131b-0etch1	python-xpcom_1.8.0.15~pre080131b-0etch1_ia64.deb
Debian	4	mipsel	libnspr4-0d-dbg	< 1.8.0.15~pre080131b-0etch1	libnspr4-0d-dbg_1.8.0.15~pre080131b-0etch1_mipsel.deb
Debian	4	ia64	libnss3-0d-dbg	< 1.8.0.15~pre080131b-0etch1	libnss3-0d-dbg_1.8.0.15~pre080131b-0etch1_ia64.deb

Rows per page:

1-10 of 1521

JSON

Related for DEBIAN:DSA-1484-1:87969