ID de Prueba:	1.3.6.1.4.1.25623.1.0.841025
Categoría:	Ubuntu Local Security Checks
Título:	Ubuntu Update for firefox USN-1463-1
Resumen:	Ubuntu Update for Linux kernel vulnerabilities USN-1463-1
Descripción:	Summary: Ubuntu Update for Linux kernel vulnerabilities USN-1463-1 Vulnerability Insight: Jesse Ruderman, Igor Bukanov, Bill McCloskey, Christian Holler, Andrew McCreight, Olli Pettay, Boris Zbarsky, and Brian Bondy discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1937, CVE-2012-1938) It was discovered that Mozilla's WebGL implementation exposed a bug in certain NVIDIA graphics drivers. The impact of this issue has not been disclosed at this time. (CVE-2011-3101) Adam Barth discovered that certain inline event handlers were not being blocked properly by the Content Security Policy's (CSP) inline-script blocking feature. Web applications relying on this feature of CSP to protect against cross-site scripting (XSS) were not fully protected. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-1944) Paul Stone discovered that a viewed HTML page hosted on a Windows or Samba share could load Windows shortcut files (.lnk) in the same share. These shortcut files could then link to arbitrary locations on the local file system of the individual loading the HTML page. An attacker could potentially use this vulnerability to show the contents of these linked files or directories in an iframe, resulting in information disclosure. (CVE-2012-1945) Arthur Gerkis discovered a use-after-free vulnerability while replacing/inserting a node in a document. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1946) Kaspar Brand discovered a vulnerability in how the Network Security Services (NSS) ASN.1 decoder handles zero length items. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash. (CVE-2012-0441) Abhishek Arya discovered two buffer overflow and one use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1940, CVE-2012-1941, CVE-2012-1947) Affected Software/OS: firefox on Ubuntu 12.04 LTS, Ubuntu 11.10, Ubuntu 11.04, Ubuntu 10.04 LTS Solution: Please Install the Updated Packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1937 Debian Security Information: DSA-2488 (Google Search) http://www.debian.org/security/2012/dsa-2488 Debian Security Information: DSA-2489 (Google Search) http://www.debian.org/security/2012/dsa-2489 Debian Security Information: DSA-2499 (Google Search) http://www.debian.org/security/2012/dsa-2499 http://www.mandriva.com/security/advisories?name=MDVSA-2012:088 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17055 RedHat Security Advisories: RHSA-2012:0710 http://rhn.redhat.com/errata/RHSA-2012-0710.html RedHat Security Advisories: RHSA-2012:0715 http://rhn.redhat.com/errata/RHSA-2012-0715.html SuSE Security Announcement: SUSE-SU-2012:0746 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html SuSE Security Announcement: openSUSE-SU-2012:0760 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html Common Vulnerability Exposure (CVE) ID: CVE-2012-1938 BugTraq ID: 53796 http://www.securityfocus.com/bid/53796 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17058 Common Vulnerability Exposure (CVE) ID: CVE-2011-3101 BugTraq ID: 53540 http://www.securityfocus.com/bid/53540 http://security.gentoo.org/glsa/glsa-201205-03.xml http://www.securitytracker.com/id?1027067 SuSE Security Announcement: openSUSE-SU-2012:0656 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html XForce ISS Database: chrome-nvidia-code-exec(75606) https://exchange.xforce.ibmcloud.com/vulnerabilities/75606 Common Vulnerability Exposure (CVE) ID: CVE-2012-1944 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17005 http://secunia.com/advisories/49981 Common Vulnerability Exposure (CVE) ID: CVE-2012-1945 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16743 Common Vulnerability Exposure (CVE) ID: CVE-2012-1946 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17010 Common Vulnerability Exposure (CVE) ID: CVE-2012-0441 BugTraq ID: 53798 http://www.securityfocus.com/bid/53798 Debian Security Information: DSA-2490 (Google Search) http://www.debian.org/security/2012/dsa-2490 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16701 http://secunia.com/advisories/49976 http://secunia.com/advisories/50316 http://www.ubuntu.com/usn/USN-1540-1 http://www.ubuntu.com/usn/USN-1540-2 Common Vulnerability Exposure (CVE) ID: CVE-2012-1940 BugTraq ID: 53794 http://www.securityfocus.com/bid/53794 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17054 Common Vulnerability Exposure (CVE) ID: CVE-2012-1941 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16985 Common Vulnerability Exposure (CVE) ID: CVE-2012-1947 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16911
Copyright	Copyright (c) 2012 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.