drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Mozilla
Name: |
Mehrere Probleme in Mozilla
|
|
ID: |
200408-22 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Di, 24. August 2004, 13:00 |
|
Referenzen: |
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0597
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0598
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0599
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0758
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0763 |
|
Applikationen: |
|
|
Originalnachricht |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200408-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: Mozilla, Firefox, Thunderbird: New releases fix vulnerabilities Date: August 23, 2004 Bugs: #57380, #59419 ID: 200408-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
New releases of Mozilla, Mozilla Thunderbird, and Mozilla Firefox fix several vulnerabilities, including remote DoS and buffer overflows.
Background ==========
Mozilla is a popular web browser that includes a mail and newsreader. Mozilla Firefox is the next-generation browser from the Mozilla project that incorporates advanced features that are yet to be incorporated into Mozilla. Mozilla Thunderbird is the next-generation mail client from the Mozilla project.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mozilla < 1.7.2 >= 1.7.2 2 mozilla-firefox < 0.9.3 >= 0.9.3 3 mozilla-thunderbird < 0.7.3 >= 0.7.3 4 mozilla-bin < 1.7.2 >= 1.7.2 5 mozilla-firefox-bin < 0.9.3 >= 0.9.3 6 mozilla-thunderbird-bin < 0.7.3 >= 0.7.3 ------------------------------------------------------------------- 6 affected packages on all of their supported architectures. -------------------------------------------------------------------
Description ===========
Several vulnerabilities were found in Mozilla and Mozilla Firefox:
* Both browsers contain a bug in their caching which may allow the SSL icon to remain visible, even when the site in question is an insecure site.
* An attacker may force the browser to execute arbitrary code from a malicious website by utilizing Mozilla's predictable cache file locations, and its ability to execute local files within the local zone.
Mozilla, Mozilla Firefox and Mozilla Thunderbird contain the following vulnerabilities:
* All Mozilla tools use libpng for graphics. This library contains a buffer overflow which may lead to arbitrary code execution.
* If a user imports a forged Certificate Authority (CA) certificate, it may overwrite and corrupt the valid CA already installed on the machine.
Impact ======
Users of Mozilla and Mozilla Firefox are susceptible to SSL certificate spoofing, a Denial of Service against legitimate SSL sites, crashes, and arbitrary code execution. Users of Mozilla Thunderbird are susceptible to crashes and arbitrary code execution via malicious e-mails.
Workaround ==========
There is no known workaround for most of these vulnerabilities. All users are advised to upgrade to the latest available version.
Resolution ==========
All users should upgrade to the latest stable version:
# emerge sync
# emerge -pv your-version # emerge your-version
References ==========
[ 1 ] CAN-2004-0763 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0763 [ 2 ] CAN-2004-0758 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0758 [ 3 ] CAN-2004-0597 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597 [ 4 ] CAN-2004-0598 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598 [ 5 ] CAN-2004-0599 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200408-22.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
|
|
|
|