| From the Mandriva advisory:
Mozilla developers identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption under
certain circumstances, and we presume that with enough effort at least
some of these could be exploited to run arbitrary code (CVE-2012-1971).
Security researcher Mariusz Mlynski reported that it is possible to
shadow the location object using Object.defineProperty. This could
be used to confuse the current location to plugins, allowing for
possible cross-site scripting (XSS) attacks (CVE-2012-1956).
Security researcher Mariusz Mlynski reported that when a page opens a
new tab, a subsequent window can then be opened that can be navigated
to about:newtab, a chrome privileged page. Once about:newtab is loaded,
the special context can potentially be used to escalate privilege,
allowing for arbitrary code execution on the local system in a
maliciously crafted attack (CVE-2012-3965).
Using the Address Sanitizer tool, Mozilla security researcher Christoph
Diehl discovered two memory corruption issues involving the Graphite
2 library used in Mozilla products. Both of these issues can cause
a potentially exploitable crash. These problems were fixed in the
Graphite 2 library, which has been updated for Mozilla products
(CVE-2012-3971).
Mozilla security researcher Mark Goodwin discovered an issue with the
Firefox developer tools' debugger. If remote debugging is disabled,
but the experimental HTTPMonitor extension has been installed and
enabled, a remote user can connect to and use the remote debugging
service through the port used by HTTPMonitor. A remote-enabled flag
has been added to resolve this problem and close the port unless
debugging is explicitly enabled (CVE-2012-3973).
Security researcher Masato Kinugawa reported that if a crafted
executable is placed in the root partition on a Windows file system,
the Firefox and Thunderbird installer will launch this program after
a standard installation instead of Firefox or Thunderbird, running
this program with the user's privileges (CVE-2012-3974).
Security researcher vsemozhetbyt reported that when the DOMParser is
used to parse text/html data in a Firefox extension, linked resources
within this HTML data will be loaded. If the data being parsed in
the extension is untrusted, it could lead to information leakage and
can potentially be combined with other attacks to become exploitable
(CVE-2012-3975). | 