Security

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775)

Several flaws were found in the way malformed content was processed. A website containing specially-crafted content could, potentially, trick a Firefox user into surrendering sensitive information. (CVE-2009-0776, CVE-2009-0777)

From the Gentoo advisory:

An unspecified component of the B3D loader is vulnerable to a buffer overflow due to missing boundary checks.

A remote attacker could entice a user to open a specially crafted .irr file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service (crash).

From the Gentoo advisory:

Multiple buffer overflows have been reported in the mpfr_snprintf() and mpfr_vsnprintf() functions.

A remote user could exploit the vulnerability to cause a Denial of Service in an application using MPFR via unknown vectors.

From the Gentoo advisory:

Dmitry E. Oboukhov reported that the IPSEC livetest tool does not handle the ipseclive.conn and ipsec.olts.remote.log temporary files securely.

A local attacker could perform symlink attacks to execute arbitrary code and overwrite arbitrary files with the privileges of the user running the application.

From the Gentoo advisory:

Multiple buffer overflows have been reported in OpenTTD, when storing long for client names (CVE-2008-3547), in the TruncateString function in src/gfx.cpp (CVE-2008-3576) and in src/openttd.cpp when processing a large filename supplied to the "-g" parameter in the ttd_main function (CVE-2008-3577).

An authenticated attacker could exploit these vulnerabilities to execute arbitrary code with the privileges of the OpenTTD server.

From the Gentoo advisory:

* Martin Vaeth reported multiple untrusted search path vulnerabilities (CVE-2008-5843).

* Marcus Meissner of the SUSE Security Team reported that temporary files are created with a predictable name (CVE-2008-5743).

A local attacker could place a specially crafted Python module in the current working directory or the /var/tmp directory, and entice a user to run the PDFjam scripts, leading to the execution of arbitrary code with the privileges of the user running the application. A local attacker could also leverage symlink attacks to overwrite arbitrary files.

From the Gentoo advisory:

James Bercegay of GulfTech Security reported a Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl() function in index.php (CVE-2008-5918) and a directory traversal vulnerability in rss.php when magic_quotes_gpc is disabled (CVE-2008-5919).

A remote attacker can exploit these vulnerabilities to overwrite arbitrary files, to read changelogs or diffs for restricted projects and to hijack a user's session.

From the Gentoo advisory:

Frank Rast reported that the XML parser in Xerces-C++ does not correctly handle an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during the validation of an XML file.

A remote attacker could entice a user or automated system to validate an XML file using a specially crafted XML schema file, leading to a Denial of Service (stack consumption and crash).

From the Gentoo advisory:

cnu discovered multiple CRLF injection vulnerabilities in ZNC's webadmin module.

A remote authenticated attacker could modify the znc.conf configuration file and gain privileges via newline characters in e.g. the QuitMessage field, and possibly execute arbitrary code.