MDVSA-2008:228Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:228 | First vendor Publication | 2008-11-13 |
| Vendor | Mandriva | Last vendor Modification | 2008-11-13 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentification | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.18 (CVE-2008-0017, CVE-2008-5012, CVE-2008-5013, CVE-2008-5014, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021, CVE-2008-5022, CVE-2008-5023, CVE-2008-5024, CVE-2008-5052). This update provides the latest Mozilla Firefox 2.x to correct these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:228 |
CAPEC : Common Attack Pattern Enumeration & Classification
| id | Name |
|---|---|
| CAPEC-26 | Leveraging Race Conditions |
| CAPEC-29 | Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions |
| CAPEC-172 | Time and State Attacks |
CWE : Common Weakness Enumeration
| id | Name |
|---|---|
| CWE-362 | Race Condition |
| CWE-665 | Improper Initialization |
| CWE-399 | Resource Management Errors |
| CWE-20 | Improper Input Validation |
| CWE-287 | Improper Authentication |
| CWE-200 | Information Exposure |
| CWE-189 | Numeric Errors |
| CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10750 | |||
| Oval ID: | oval:org.mitre.oval:def:10750 | ||
| Title: | Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon. | ||
| Description: | Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5012 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:9660 | |||
| Oval ID: | oval:org.mitre.oval:def:9660 | ||
| Title: | Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address. | ||
| Description: | Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5013 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:9449 | |||
| Oval ID: | oval:org.mitre.oval:def:9449 | ||
| Title: | The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js. | ||
| Description: | The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5052 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 50285 | Mozilla Multiple Product JavaScript Engine AppendAttributeValue Function Remo... |
| 50182 | Mozilla Multiple Products Codebase Principals Protection Mechanism Bypass Sig... |
| 50181 | Mozilla Multiple Products nsXMLHttpRequest::NotifyEventListeners Method Same-... |
| 50179 | Mozilla Multiple Products nsFrameManager File Input Element Modification Blur... |
| 50178 | Mozilla Multiple Products Session Restore Feature Same-origin Policy Bypass C... |
| 50177 | Mozilla Multiple Products JavaScript Engine Date Class Unspecified Remote DoS |
| 50176 | Mozilla Multiple Products Browser Engine xpcom/io/nsEscape.cpp Unspecified Ov... |
| 50141 | Mozilla Multiple Products jslock.cpp OBJ_IS_NATIVE Function Non-Native Object... |
| 50140 | Mozilla Multiple Products Flash Module SWF File Dynamic Unloading Arbitrary R... |
| 50139 | Mozilla Multiple Products Canvas Element Handling Same-policy Origin Bypass |
| 49995 | Mozilla Multiple Products EX4 Document Handling Remote XML Injection |
| 49925 | Mozilla Multiple Products http-index-format MIME Type Parser Crafted Index Re... |
(Critical)
(High)
(Medium)
