Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

RHEL 4 / 5 : firefox (RHSA-2009:1530)

🗓️ 28 Oct 2009 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 21 Views

Updated Firefox packages for security issue

Related
Refs
Code
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2009:1530. The text 
# itself is copyright (C) Red Hat, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(42287);
  script_version("1.32");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/24");

  script_cve_id(
    "CVE-2009-0689",
    "CVE-2009-3274",
    "CVE-2009-3370",
    "CVE-2009-3372",
    "CVE-2009-3373",
    "CVE-2009-3374",
    "CVE-2009-3375",
    "CVE-2009-3376",
    "CVE-2009-3380",
    "CVE-2009-3382",
    "CVE-2009-3384"
  );
  script_xref(name:"RHSA", value:"2009:1530");

  script_name(english:"RHEL 4 / 5 : firefox (RHSA-2009:1530)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates for firefox.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2009:1530 advisory.

    Mozilla Firefox is an open source Web browser. XULRunner provides the XUL
    Runtime environment for Mozilla Firefox. nspr provides the Netscape
    Portable Runtime (NSPR).

    A flaw was found in the way Firefox handles form history. A malicious web
    page could steal saved form data by synthesizing input events, causing the
    browser to auto-fill form fields (which could then be read by an attacker).
    (CVE-2009-3370)

    A flaw was found in the way Firefox creates temporary file names for
    downloaded files. If a local attacker knows the name of a file Firefox is
    going to download, they can replace the contents of that file with
    arbitrary contents. (CVE-2009-3274)

    A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file
    processor. If Firefox loads a malicious PAC file, it could crash Firefox
    or, potentially, execute arbitrary code with the privileges of the user
    running Firefox. (CVE-2009-3372)

    A heap-based buffer overflow flaw was found in the Firefox GIF image
    processor. A malicious GIF image could crash Firefox or, potentially,
    execute arbitrary code with the privileges of the user running Firefox.
    (CVE-2009-3373)

    A heap-based buffer overflow flaw was found in the Firefox string to
    floating point conversion routines. A web page containing malicious
    JavaScript could crash Firefox or, potentially, execute arbitrary code with
    the privileges of the user running Firefox. (CVE-2009-1563)

    A flaw was found in the way Firefox handles text selection. A malicious
    website may be able to read highlighted text in a different domain (e.g.
    another website the user is viewing), bypassing the same-origin policy.
    (CVE-2009-3375)

    A flaw was found in the way Firefox displays a right-to-left override
    character when downloading a file. In these cases, the name displayed in
    the title bar differs from the name displayed in the dialog body. An
    attacker could use this flaw to trick a user into downloading a file that
    has a file name or extension that differs from what the user expected.
    (CVE-2009-3376)

    Several flaws were found in the processing of malformed web content. A web
    page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code with the privileges of the user running
    Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382)

    For technical details regarding these flaws, refer to the Mozilla security
    advisories for Firefox 3.0.15. You can find a link to the Mozilla
    advisories in the References section of this errata.

    All Firefox users should upgrade to these updated packages, which contain
    Firefox version 3.0.15, which corrects these issues. After installing the
    update, Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1530.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?66bc5ee9");
  # http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.15
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?86e96787");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2009:1530");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/updates/classification/#critical");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=524815");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530151");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530155");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530156");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530157");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530162");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530167");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530168");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530567");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=530569");
  script_set_attribute(attribute:"solution", value:
"Update the RHEL firefox package based on the guidance in RHSA-2009:1530.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2009-3382");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2009-3380");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(190, 122);
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/09/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/10/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:nspr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:nspr-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel-unstable");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2009-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("redhat_repos.nasl", "ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');
include('rhel.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Red Hat' >!< os_product) audit(AUDIT_OS_NOT, 'Red Hat');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
if (!rhel_check_release_list(operator: 'ge', os_version: os_version, rhel_versions: ['4','5'])) audit(AUDIT_OS_NOT, 'Red Hat 4.x / 5.x', 'Red Hat ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'release': '4',
    'repo_relative_urls': [
      'content/dist/rhel/as/4/4AS/i386/os',
      'content/dist/rhel/as/4/4AS/i386/source/SRPMS',
      'content/dist/rhel/as/4/4AS/x86_64/os',
      'content/dist/rhel/as/4/4AS/x86_64/source/SRPMS',
      'content/dist/rhel/desktop/4/4Desktop/i386/os',
      'content/dist/rhel/desktop/4/4Desktop/i386/source/SRPMS',
      'content/dist/rhel/desktop/4/4Desktop/x86_64/os',
      'content/dist/rhel/desktop/4/4Desktop/x86_64/source/SRPMS',
      'content/dist/rhel/es/4/4ES/i386/os',
      'content/dist/rhel/es/4/4ES/i386/source/SRPMS',
      'content/dist/rhel/es/4/4ES/x86_64/os',
      'content/dist/rhel/es/4/4ES/x86_64/source/SRPMS',
      'content/dist/rhel/power/4/4AS/ppc/os',
      'content/dist/rhel/power/4/4AS/ppc/source/SRPMS',
      'content/dist/rhel/system-z/4/4AS/s390/os',
      'content/dist/rhel/system-z/4/4AS/s390/source/SRPMS',
      'content/dist/rhel/system-z/4/4AS/s390x/os',
      'content/dist/rhel/system-z/4/4AS/s390x/source/SRPMS',
      'content/dist/rhel/ws/4/4WS/i386/os',
      'content/dist/rhel/ws/4/4WS/i386/source/SRPMS',
      'content/dist/rhel/ws/4/4WS/x86_64/os',
      'content/dist/rhel/ws/4/4WS/x86_64/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'firefox-3.0.15-3.el4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'ppc64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el4_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el4_8', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el4_8', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el4_8', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el4_8', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el4_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '5',
    'repo_relative_urls': [
      'content/dist/rhel/client/5/5Client/i386/debug',
      'content/dist/rhel/client/5/5Client/i386/os',
      'content/dist/rhel/client/5/5Client/i386/source/SRPMS',
      'content/dist/rhel/client/5/5Client/x86_64/debug',
      'content/dist/rhel/client/5/5Client/x86_64/os',
      'content/dist/rhel/client/5/5Client/x86_64/source/SRPMS',
      'content/dist/rhel/power/5/5Server/ppc/debug',
      'content/dist/rhel/power/5/5Server/ppc/os',
      'content/dist/rhel/power/5/5Server/ppc/source/SRPMS',
      'content/dist/rhel/server/5/5Server/i386/debug',
      'content/dist/rhel/server/5/5Server/i386/os',
      'content/dist/rhel/server/5/5Server/i386/source/SRPMS',
      'content/dist/rhel/server/5/5Server/x86_64/debug',
      'content/dist/rhel/server/5/5Server/x86_64/os',
      'content/dist/rhel/server/5/5Server/x86_64/source/SRPMS',
      'content/dist/rhel/system-z/5/5Server/s390x/debug',
      'content/dist/rhel/system-z/5/5Server/s390x/os',
      'content/dist/rhel/system-z/5/5Server/s390x/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/i386/debug',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/debug',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/os',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/i386/os',
      'content/dist/rhel/workstation/5/5Client/i386/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/x86_64/debug',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/debug',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/os',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/x86_64/os',
      'content/dist/rhel/workstation/5/5Client/x86_64/source/SRPMS',
      'content/fastrack/rhel/client/5/i386/debug',
      'content/fastrack/rhel/client/5/i386/os',
      'content/fastrack/rhel/client/5/i386/source/SRPMS',
      'content/fastrack/rhel/client/5/x86_64/debug',
      'content/fastrack/rhel/client/5/x86_64/os',
      'content/fastrack/rhel/client/5/x86_64/source/SRPMS',
      'content/fastrack/rhel/power/5/ppc/debug',
      'content/fastrack/rhel/power/5/ppc/os',
      'content/fastrack/rhel/power/5/ppc/source/SRPMS',
      'content/fastrack/rhel/server/5/i386/debug',
      'content/fastrack/rhel/server/5/i386/os',
      'content/fastrack/rhel/server/5/i386/source/SRPMS',
      'content/fastrack/rhel/server/5/x86_64/debug',
      'content/fastrack/rhel/server/5/x86_64/os',
      'content/fastrack/rhel/server/5/x86_64/source/SRPMS',
      'content/fastrack/rhel/system-z/5/s390x/debug',
      'content/fastrack/rhel/system-z/5/s390x/os',
      'content/fastrack/rhel/system-z/5/s390x/source/SRPMS',
      'content/fastrack/rhel/workstation/5/i386/debug',
      'content/fastrack/rhel/workstation/5/i386/desktop/debug',
      'content/fastrack/rhel/workstation/5/i386/desktop/os',
      'content/fastrack/rhel/workstation/5/i386/desktop/source/SRPMS',
      'content/fastrack/rhel/workstation/5/i386/os',
      'content/fastrack/rhel/workstation/5/i386/source/SRPMS',
      'content/fastrack/rhel/workstation/5/x86_64/debug',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/debug',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/os',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/source/SRPMS',
      'content/fastrack/rhel/workstation/5/x86_64/os',
      'content/fastrack/rhel/workstation/5/x86_64/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'ppc64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-4.7.6-1.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'ppc64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nspr-devel-4.7.6-1.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'ppc64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-1.9.0.15-3.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'ppc64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-1.9.0.15-3.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-unstable-1.9.0.15-3.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-unstable-1.9.0.15-3.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-unstable-1.9.0.15-3.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'xulrunner-devel-unstable-1.9.0.15-3.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '5',
    'repo_relative_urls': [
      'content/dist/rhel/client/5/5Client/i386/debug',
      'content/dist/rhel/client/5/5Client/i386/os',
      'content/dist/rhel/client/5/5Client/i386/source/SRPMS',
      'content/dist/rhel/client/5/5Client/x86_64/debug',
      'content/dist/rhel/client/5/5Client/x86_64/os',
      'content/dist/rhel/client/5/5Client/x86_64/source/SRPMS',
      'content/dist/rhel/power/5/5Server/ppc/debug',
      'content/dist/rhel/power/5/5Server/ppc/os',
      'content/dist/rhel/power/5/5Server/ppc/source/SRPMS',
      'content/dist/rhel/server/5/5Server/i386/debug',
      'content/dist/rhel/server/5/5Server/i386/os',
      'content/dist/rhel/server/5/5Server/i386/source/SRPMS',
      'content/dist/rhel/server/5/5Server/x86_64/debug',
      'content/dist/rhel/server/5/5Server/x86_64/os',
      'content/dist/rhel/server/5/5Server/x86_64/source/SRPMS',
      'content/dist/rhel/system-z/5/5Server/s390x/debug',
      'content/dist/rhel/system-z/5/5Server/s390x/os',
      'content/dist/rhel/system-z/5/5Server/s390x/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/debug',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/os',
      'content/dist/rhel/workstation/5/5Client/i386/desktop/source/SRPMS',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/debug',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/os',
      'content/dist/rhel/workstation/5/5Client/x86_64/desktop/source/SRPMS',
      'content/fastrack/rhel/client/5/i386/debug',
      'content/fastrack/rhel/client/5/i386/os',
      'content/fastrack/rhel/client/5/i386/source/SRPMS',
      'content/fastrack/rhel/client/5/x86_64/debug',
      'content/fastrack/rhel/client/5/x86_64/os',
      'content/fastrack/rhel/client/5/x86_64/source/SRPMS',
      'content/fastrack/rhel/power/5/ppc/debug',
      'content/fastrack/rhel/power/5/ppc/os',
      'content/fastrack/rhel/power/5/ppc/source/SRPMS',
      'content/fastrack/rhel/server/5/i386/debug',
      'content/fastrack/rhel/server/5/i386/os',
      'content/fastrack/rhel/server/5/i386/source/SRPMS',
      'content/fastrack/rhel/server/5/x86_64/debug',
      'content/fastrack/rhel/server/5/x86_64/os',
      'content/fastrack/rhel/server/5/x86_64/source/SRPMS',
      'content/fastrack/rhel/system-z/5/s390x/debug',
      'content/fastrack/rhel/system-z/5/s390x/os',
      'content/fastrack/rhel/system-z/5/s390x/source/SRPMS',
      'content/fastrack/rhel/workstation/5/i386/desktop/debug',
      'content/fastrack/rhel/workstation/5/i386/desktop/os',
      'content/fastrack/rhel/workstation/5/i386/desktop/source/SRPMS',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/debug',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/os',
      'content/fastrack/rhel/workstation/5/x86_64/desktop/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'firefox-3.0.15-3.el5_4', 'cpu':'i386', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el5_4', 'cpu':'ppc', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el5_4', 'cpu':'s390', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el5_4', 'cpu':'s390x', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
      {'reference':'firefox-3.0.15-3.el5_4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE}
    ]
  }
];

var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var repo_relative_urls;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }

  if (!empty_or_null(constraint['repo_relative_urls'])) repo_relative_urls = constraint['repo_relative_urls'];

  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
        (applicable_repo_urls || (!exists_check || rpm_exists(rpm:exists_check))) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  if (isnull(applicable_repo_urls) || !applicable_repo_urls) extra = rpm_report_get() + redhat_report_repo_caveat();
  else extra = rpm_report_get();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'firefox / nspr / nspr-devel / xulrunner / xulrunner-devel / etc');
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
24 Sep 2025 00:00Current
8High risk
Vulners AI Score8
CVSS 210
EPSS0.28167
rhel 4rhel 5firefoxcritical impactmozillaxulrunnernsprcve-2009-3370cve-2009-3274cve-2009-3372cve-2009-3373cve-2009-1563cve-2009-3375cve-2009-3376cve-2009-3374cve-2009-3380cve-2009-3382technical advisories.
21