| Beschreibung: | Description:
The remote host is missing an update to firefox
announced via advisory MDVSA-2009:134.
Security vulnerabilities have been discovered and corrected in Mozilla
Firefox 3.x:
CVE-2009-1392: Firefox browser engine crashes
CVE-2009-1832: Firefox double frame construction flaw
CVE-2009-1833: Firefox JavaScript engine crashes
CVE-2009-1834: Firefox URL spoofing with invalid unicode characters
CVE-2009-1835: Firefox Arbitrary domain cookie access by local file:
resources
CVE-2009-1836: Firefox SSL tampering via non-200 responses to proxy
CONNECT requests
CVE-2009-1837: Firefox Race condition while accessing the private
data of a NPObject JS wrapper class object
CVE-2009-1838: Firefox arbitrary code execution flaw
CVE-2009-1839: Firefox information disclosure flaw
CVE-2009-1840: Firefox XUL scripts skip some security checks
CVE-2009-1841: Firefox JavaScript arbitrary code execution
CVE-2009-2043: firefox - remote TinyMCE denial of service
CVE-2009-2044: firefox - remote GIF denial of service
CVE-2009-2061: firefox - man-in-the-middle exploit
CVE-2009-2065: firefox - man-in-the-middle exploit
This update provides the latest Mozilla Firefox 3.x to correct
these issues.
Additionally, some packages which require so, have been rebuilt and
are being provided as updates.
Affected: 2009.0, 2009.1
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2009:134
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.11
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
