mozilla: multiple vulnerabilities [LWN.net]

Package(s):

mozilla

CVE #(s):

CVE-2005-4134 CVE-2006-0292 CVE-2006-0296

Created:

February 2, 2006

Updated:

May 4, 2006

Description:

Mozilla has three new vulnerabilities. The Javascript interpreter has a problem with dereferencing objects. A user can visit a specially crafted web page which can crash the browser or cause it to execute arbitrary code.

The XULDocument.persist() function has a bug that can be triggered by viewing specially crafted web sites, RDF data can be injected into the localstore.rdf file, allowing arbitrary javascript code to be executed.

The Mozilla history saving mechanism is vulnerable to a denial of service attack, visiting sites with extra-long titles can cause a crash or very slow startup the next time the browser is run.

Alerts:

Ubuntu	USN-275-1	2006-04-27
Debian	DSA-1046-1	2006-04-27
Fedora-Legacy	FLSA:180036	2006-02-23
Mandriva	MDKSA-2006:037	2006-02-07
Mandriva	MDKSA-2006:036	2006-02-07
Fedora	FEDORA-2006-076	2006-02-02
Fedora	FEDORA-2006-075	2006-02-02
Red Hat	RHSA-2006:0200-01	2006-02-02
Red Hat	RHSA-2006:0199-01	2006-02-02

(Log in to post comments)