Foresight alert FLEA-2007-0039-1 (firefox)

From:
    	     
 
Foresight Linux Essential Announcement Service <foresight-security-noreply@foresightlinux.org>
To:
    	     
 
foresight-security-announce@lists.rpath.org
Subject:
    	     
 
FLEA-2007-0039-1 firefox
Date:
    	     
 
Wed, 01 Aug 2007 15:03:24 -0400
Message-ID:
    	     
 
<46b0d8fc.OdM/62pL5GZjkd5f%foresight-security-noreply@foresightlinux.org>
Cc:
    	     
 
security-alerts@linuxsecurity.com, full-disclosure@lists.grok.org.uk,
 bugtraq@securityfocus.com, lwn@lwn.net
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Foresight Linux Essential Advisory: 2007-0039-1
Published: 2007-08-01

Rating: Moderate

Updated Versions:
    firefox=/foresight.rpath.org@fl:1-devel//1/2.0.0.6-1-1
    group-dist=/foresight.rpath.org@fl:1-devel//1/1.3.2-0.7-2

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845
    https://issues.rpath.com/browse/RPL-1600

Description:
    Previous versions of the firefox package are vulnerable to a flaw in
    handling of "about:blank" windows. A malicious web server could exploit
    this to steal sensitive information or modify contents of other open web
    pages. 

    In addition, a malicious web server could execute helpers with arbitrary
    arguments due to firefox's mishandling of certain types of characters when
    launching external programs.

- ---

Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License.
A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)

iQIVAwUBRrDY+NfwEn07iAtZAQJvFQ/+MnWWYwJMIfW9l2jOzLBIdOXtJJfVI+sw
hRlf9Dj6bamB0vj1ntL4YPw6V2SQFKXkw92QFJwiyFcbC9l7np73eTNwJskR4VKb
5g8hKTdOjTEaU+VoJkUDSi/JA6RwRGJKn08+/ih7CuLkE8loYmFYbMiR+MxpbHoP
u82IAbYKTD4WqMbXuy34MImedvVWby3GxHI01RgqGtDhN9BwvRzmYrip04QUFJwJ
QP8xSlfNBkaL0e/7nTDmdWbAqhOYXPdxjQPG0cM9mp6omMnM0SIJ7Fm5UDGe69rb
zQm9DFUiCJnyQC8ra40dvdloxmk2en/ZXFgh4rE+Ghw+U7U1/IciWMdboUhdc+QV
NI3L/oyXkqSODIOBPehpUfpmg7aVuTXtrjlYugyR4NG5mx5XyQ6CaiZnhZy4c13V
QznFZQ8ZJuA960z+jfEsO4y2K8hsQ0z3iFesHW/CiUM1qWKIEKwGV0Uw0m2mWBUF
0ik23yeCzfwm+gJGt4GVqFMK4CjbuVZrT0IsCn3daefiyxFAabNLQJ6XeQB9KwJI
Jm6Nj5gPls1Vvip8VOu8QWoUkk9GkGQD1yX3YeyYRCrYAELhCZmbgrJz/NHnnDEF
sk9ofgcFvqliOIrgzdFDmEJTP01O/d/TFOSiu+LX82dllRowIfcJLvW2ZvH2AvVN
BBO5x3kCehA=
=2vlo
-----END PGP SIGNATURE-----