Scientific Linux alert SL-fire-20121121 (firefox)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
"SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV"
	<SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV> 
Subject:
    	     
 
Security ERRATA Critical: firefox on SL5.x, SL6.x i386/x86_64 
Date:
    	     
 
Wed, 21 Nov 2012 10:40:08 -0600
Message-ID:
    	     
 
<50AD03E8.8070102@fnal.gov>
Archive-link:
    	     
 
Article, Thread
              
Synopsis:          Critical: firefox security update
Issue Date:        2012-11-20
CVE Numbers:       CVE-2012-5842
                    CVE-2012-4202
                    CVE-2012-4201
                    CVE-2012-5841
                    CVE-2012-4207
                    CVE-2012-4209
                    CVE-2012-4214
                    CVE-2012-4215
                    CVE-2012-4216
                    CVE-2012-5829
                    CVE-2012-5839
                    CVE-2012-5840
                    CVE-2012-5830
                    CVE-2012-5833
                    CVE-2012-5835
                    CVE-2012-4210
--

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829,
CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5839, CVE-2012-5840,
CVE-2012-5842)

A buffer overflow flaw was found in the way Firefox handled GIF (Graphics
Interchange Format) images. A web page containing a malicious GIF image
could cause Firefox to crash or, possibly, execute arbitrary code with the
privileges of the user running Firefox. (CVE-2012-4202)

A flaw was found in the way the Style Inspector tool in Firefox handled
certain Cascading Style Sheets (CSS). Running the tool (Tools -> Web
Developer -> Inspect) on malicious CSS could result in the execution of
HTML and CSS content with chrome privileges. (CVE-2012-4210)

A flaw was found in the way Firefox decoded the HZ-GB-2312 character
encoding. A web page containing malicious content could cause Firefox to
run JavaScript code with the permissions of a different website.
(CVE-2012-4207)

A flaw was found in the location object implementation in Firefox.
Malicious content could possibly use this flaw to allow restricted content
to be loaded by plug-ins. (CVE-2012-4209)

A flaw was found in the way cross-origin wrappers were implemented.
Malicious content could use this flaw to perform cross-site scripting
attacks. (CVE-2012-5841)

A flaw was found in the evalInSandbox implementation in Firefox. Malicious
content could use this flaw to perform cross-site scripting attacks.
(CVE-2012-4201)

After installing the update, Firefox must be restarted for the
changes to take effect.
--

SL5
   x86_64
     firefox-10.0.11-1.el5_8.i386.rpm
     firefox-10.0.11-1.el5_8.x86_64.rpm
     xulrunner-10.0.11-1.el5_8.i386.rpm
     xulrunner-10.0.11-1.el5_8.x86_64.rpm
     xulrunner-devel-10.0.11-1.el5_8.i386.rpm
     xulrunner-devel-10.0.11-1.el5_8.x86_64.rpm
   i386
     firefox-10.0.11-1.el5_8.i386.rpm
     xulrunner-10.0.11-1.el5_8.i386.rpm
     xulrunner-devel-10.0.11-1.el5_8.i386.rpm
SL6
   x86_64
     firefox-10.0.11-1.el6_3.i686.rpm
     firefox-10.0.11-1.el6_3.x86_64.rpm
     xulrunner-10.0.11-1.el6_3.i686.rpm
     xulrunner-10.0.11-1.el6_3.x86_64.rpm
     xulrunner-devel-10.0.11-1.el6_3.i686.rpm
     xulrunner-devel-10.0.11-1.el6_3.x86_64.rpm
   i386
     firefox-10.0.11-1.el6_3.i686.rpm
     xulrunner-10.0.11-1.el6_3.i686.rpm
     xulrunner-devel-10.0.11-1.el6_3.i686.rpm

- Scientific Linux Development Team