|| ||Pat Riehecky <email@example.com> |
|| ||Security ERRATA Critical: firefox on SL5.x, SL6.x i386/x86_64 |
|| ||Wed, 21 Nov 2012 10:40:08 -0600|
|| ||Article, Thread
Synopsis: Critical: firefox security update
Issue Date: 2012-11-20
CVE Numbers: CVE-2012-5842
Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829,
CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5839, CVE-2012-5840,
A buffer overflow flaw was found in the way Firefox handled GIF (Graphics
Interchange Format) images. A web page containing a malicious GIF image
could cause Firefox to crash or, possibly, execute arbitrary code with the
privileges of the user running Firefox. (CVE-2012-4202)
A flaw was found in the way the Style Inspector tool in Firefox handled
certain Cascading Style Sheets (CSS). Running the tool (Tools -> Web
Developer -> Inspect) on malicious CSS could result in the execution of
HTML and CSS content with chrome privileges. (CVE-2012-4210)
A flaw was found in the way Firefox decoded the HZ-GB-2312 character
encoding. A web page containing malicious content could cause Firefox to
A flaw was found in the location object implementation in Firefox.
Malicious content could possibly use this flaw to allow restricted content
to be loaded by plug-ins. (CVE-2012-4209)
A flaw was found in the way cross-origin wrappers were implemented.
Malicious content could use this flaw to perform cross-site scripting
A flaw was found in the evalInSandbox implementation in Firefox. Malicious
content could use this flaw to perform cross-site scripting attacks.
After installing the update, Firefox must be restarted for the
changes to take effect.
- Scientific Linux Development Team
to post comments)