Linux Security
    Linux Security
    Linux Security

    Debian: DSA-1922-1: New xulrunner packages fix several vulnerabilities

    Date 28 Oct 2009
    Posted By LinuxSecurity Advisories
    Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems:
    Hash: SHA1
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1922-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.                       Moritz Muehlenhoff
    October 28, 2009            
    - ------------------------------------------------------------------------
    Package        : xulrunner
    Vulnerability  : several
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2009-3274 CVE-2009-3370 CVE-2009-3372 CVE-2009-3373 CVE-2009-3374 CVE-2009-3375 CVE-2009-3376 CVE-2009-3380 CVE-2009-3382
    Several remote vulnerabilities have been discovered in Xulrunner, a
    runtime environment for XUL applications, such as the Iceweasel web
    browser. The Common Vulnerabilities and Exposures project identifies
    the following problems:
        Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel
        Banchero, David Keeler and Boris Zbarsky reported crashes in
        layout engine, which might allow the execution of arbitrary code.
        Carsten Book reported a crash in the layout engine, which might
        allow the execution of arbitrary code.
        Jesse Ruderman and Sid Stamm discovered spoofing vulnerability
        in the file download dialog.
        Gregory Fleischer discovered a bypass of the same-origin policy
        using the document.getSelection() function.
        "moz_bug_r_a4" discovered a privilege escalation to Chrome status
        in the XPCOM utility XPCVariant::VariantDataToJS.
        "regenrecht" discovered a buffer overflow in the GIF parser, which
        might lead to the execution of arbitrary code.
        Marco C. discovered that a programming error in the proxy auto
        configuration code might lead to denial of service or the
        execution of arbitrary code.
        Jeremy Brown discovered that the filename of a downloaded file
        which is opened by the user is predictable, which might lead to
        tricking the user into a malicious file if the attacker has local
        access to the system.
        Paul Stone discovered that history information from web forms
        could be stolen.
    For the stable distribution (lenny), these problems have been fixed
    in version
    As indicated in the Etch release notes, security support for the
    Mozilla products in the oldstable distribution needed to be stopped
    before the end of the regular Etch security maintenance life cycle.
    You are strongly encouraged to upgrade to stable or switch to a still
    supported browser.
    For the unstable distribution (sid), these problems have been fixed in
    We recommend that you upgrade your xulrunner packages.
    Upgrade instructions
    - --------------------
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    Source archives:
        Size/MD5 checksum:   116164 3d995b59ffe890d36117f3103f38b9b1
        Size/MD5 checksum:     1779 7e8392a8b59ef9064df564ee03c23b14
        Size/MD5 checksum: 44085950 49aa2aee64997f9e802cf386d038d2d7
    Architecture independent packages:
        Size/MD5 checksum:  1464278 ea66718b41a4c282284d37672d0e7078
    alpha architecture (DEC Alpha)
        Size/MD5 checksum:  9494314 8cd7366b90d39c5c64064d1fb17c1022
        Size/MD5 checksum:   938304 bf39af51a378ed039c545730664857aa
        Size/MD5 checksum:   221588 1dd219c2812ca8d23fff415c9555d3db
        Size/MD5 checksum:   432182 5d32bfa9665c32fb1738f416f739b3ae
        Size/MD5 checksum:  3651374 14dd5f555695db43b94ceab3260c680d
        Size/MD5 checksum: 51089582 fa7f8faad8460d1049e9fb8f6fd1f7bb
        Size/MD5 checksum:   163912 d488634f9d36f6d0afcc7b27ee6699a0
        Size/MD5 checksum:   112022 9666fd74cd00bc0643993acc22d40c91
        Size/MD5 checksum:    71980 602c6780c2328141871f5d94b8a163f4
    amd64 architecture (AMD x86_64 (AMD64))
        Size/MD5 checksum:    69898 c0295f0b7e6957f236d769dc8bdfd2ca
        Size/MD5 checksum:   890260 2d4cb08b3e886e06be04ec7e43a82b0f
        Size/MD5 checksum:   151952 3e20640a2f4eb68a58731bba532aedb0
        Size/MD5 checksum: 50327552 5779e5efb1f7b6612bf8a774a8e8cd6a
        Size/MD5 checksum:   374218 86b4b4a30f5f30f4492fe11eca93dace
        Size/MD5 checksum:  3287960 741031dbbba1f6c6e8fe045d71547905
        Size/MD5 checksum:   222992 3e801bb57c442128512e599af5c9547e
        Size/MD5 checksum:  7722556 cc9b8e7ac989143255cb6ad53ce84884
        Size/MD5 checksum:   101512 396f03e0770dd73cf5820354a8b94a0f
    armel architecture (ARM EABI)
        Size/MD5 checksum:   223358 a881797fcf62521c0ab538e72b33bb70
        Size/MD5 checksum:    84272 1602bc59310724ee0f20d8f5a0ac0a8c
        Size/MD5 checksum:   821892 79baa048d939ac77273ac50237c7bfe3
        Size/MD5 checksum:    69726 cd5970b1776e5777686ce9208c074e79
        Size/MD5 checksum:  6954730 a8a092eab78826ef9ed0e98e8d7251bb
        Size/MD5 checksum:   141248 47668db41fd86750793bae3f59ff623e
        Size/MD5 checksum:   352870 99357abd251ccfe354b28ed441256eb4
        Size/MD5 checksum: 50116888 a19877e49d8d1037458d2531873181e0
        Size/MD5 checksum:  3579420 9091ebebb2d0b23a8f10300ff7340c16
    hppa architecture (HP PA RISC)
        Size/MD5 checksum:   105902 14573c4144b48dfcdeadca11dbf28fd1
        Size/MD5 checksum:   412252 703d501036427f18e6ffc3841c0434e7
        Size/MD5 checksum:   158830 9c6c95e2c55a59adaa4314022adaba97
        Size/MD5 checksum:  9512434 b479cbca6e9244681e8acf58afba706e
        Size/MD5 checksum: 51210900 7b5ae111a77a354adadb9a019892970b
        Size/MD5 checksum:  3621952 4a3cef66aa1b240f42c4c4c4de41ca64
        Size/MD5 checksum:   222858 1f6d47dc993cbc9a068517a06492beb9
        Size/MD5 checksum:   898430 c63b30f2604b2a08d9fed108253b6b5b
        Size/MD5 checksum:    71384 50c3026bc0d90b912e74c0892ac3cd8c
    i386 architecture (Intel ia32)
        Size/MD5 checksum:   851844 28f3d2c286d83a90df609b21699baf97
        Size/MD5 checksum:    79142 61aff31316b603d03921eb89b5df073b
        Size/MD5 checksum:  3565362 fd8674b08b704e5f0f9ef790da65b7f8
        Size/MD5 checksum:   141410 0182fcff2acf3987fa15128659fe7b38
        Size/MD5 checksum:  6602586 03aed73b528a0e36cef99361ae9da656
        Size/MD5 checksum: 49492306 82d2789b64cedcbf2406a09131032764
        Size/MD5 checksum:   223182 1872e9d86b45cb1b29f20c4d75467200
        Size/MD5 checksum:   350814 4e647513b860210f0c1bc1caef893e9f
        Size/MD5 checksum:    68094 f9e97cd83f976afa8959ea9f774f1994
    ia64 architecture (Intel ia64)
        Size/MD5 checksum:   223134 2ae79c69711959cb6cd75026882abd60
        Size/MD5 checksum:   542104 a8b314bf8ad3c48e1ab4ed231b83a450
        Size/MD5 checksum:   121518 18ec63c6f78623b2c744d9362d4b2be6
        Size/MD5 checksum:    76492 22f1645790b9540cc1a3b795573b3e46
        Size/MD5 checksum: 49667940 d01b4ee9da9f802eb24749992dd14be2
        Size/MD5 checksum:   180184 b26234c2f0d54a61e771ee478828c628
        Size/MD5 checksum: 11301676 95599d73eb33ae7e9613d92304b8d813
        Size/MD5 checksum:   811176 33ceb8965e9db8d79020777ab55e1838
        Size/MD5 checksum:  3397550 7eff41c031481161dfab1bc83cfa8450
    mipsel architecture (MIPS (Little Endian))
        Size/MD5 checksum: 49965510 8997b286648f39786e86826b5045e69d
        Size/MD5 checksum:   223146 2bdf56823a2075c6bbd4fe3fc2e0646c
        Size/MD5 checksum:  7375092 29d842979cbc5ee6ad659cf13927788b
        Size/MD5 checksum:    96764 5fa81a5541ae261f0a72b91bb5bf6626
        Size/MD5 checksum:   144986 d3da343322c085f952511248e3a69345
        Size/MD5 checksum:   900210 b87e5f91341b390cb2f1603a1071aff7
        Size/MD5 checksum:  3308536 7c5f7065d8961c7fc0ca7fb974e6611c
        Size/MD5 checksum:    69836 ace8648bf416d4804db9644c487dcdf1
        Size/MD5 checksum:   378586 18fd2ced744197472973e2cae61d4d64
    powerpc architecture (PowerPC)
        Size/MD5 checksum:   362482 a0bf9d0ba7a4695378f7ea053cd9cc46
        Size/MD5 checksum:  3283604 b98767e9b18704a2482c731309eef892
        Size/MD5 checksum: 51378802 bed95771a8d00f88bedc12d480ed91f0
        Size/MD5 checksum:    94786 fb7b21596585931a6edda7e2bebae561
        Size/MD5 checksum:   152276 d83cf113d2600c6ca9e691dfd25a1466
        Size/MD5 checksum:  7275222 008f00164ecbc43c681f1743ba33c0e8
        Size/MD5 checksum:    72990 2982ec8818b1ae7b47241dcdb046c8e0
        Size/MD5 checksum:   887776 9853592dc50b738bd7b223fc78c030c3
        Size/MD5 checksum:   223140 96d915d392dbb2cdc3a09268d97a206f
    s390 architecture (IBM S/390)
        Size/MD5 checksum:  3306276 95d049eaa0c2b95b8f98f2295d984454
        Size/MD5 checksum:   406680 9efe79857bd5fc05bf567f4840109135
        Size/MD5 checksum:   223124 ee4ed0dc817d276cbe22bcb5ef6314af
        Size/MD5 checksum: 51172466 33aeec198869e5b92132775938f1dba6
        Size/MD5 checksum:  8387566 5cf074573a634121d0981d927bdf8dc5
        Size/MD5 checksum:   105540 ad95c071cf5d0f16301e004800626ab6
        Size/MD5 checksum:   156084 69c04262268e1b13ffac80f8827e5776
        Size/MD5 checksum:   909030 9d9a82bbaa3501f41dd810c3bf3e7b0b
        Size/MD5 checksum:    72868 738b9ff7dafce724b01f032e568d145d
    sparc architecture (Sun SPARC/UltraSPARC)
        Size/MD5 checksum:   143228 8017cc9ebd542b69b5a33328e4db72fd
        Size/MD5 checksum:    69342 2a626affc178cb0bed8bd8dc0302308b
        Size/MD5 checksum:   821126 3107a47d82efbaf745b0a7355df82271
        Size/MD5 checksum:   223230 41277488a9fbf77e3864848e36ad1040
        Size/MD5 checksum:  7174794 ff98cd42b01c1b6da7f443a8513ec516
        Size/MD5 checksum:   350084 53b49c566cc58af0976b24382a144a16
        Size/MD5 checksum:    88202 d8ed5ea8a627c996c8890521551e14b3
        Size/MD5 checksum: 49353618 3919a69140cbf1cc726b9142a7f33f23
        Size/MD5 checksum:  3577270 0709623512ba6d57f6a475f8382b20a2
      These files will probably be moved into the stable distribution on
      its next update.
    - ---------------------------------------------------------------------------------
    For apt-get: deb stable/updates main
    For dpkg-ftp: dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and


    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"10","type":"x","order":"1","pct":32.26,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"6","type":"x","order":"2","pct":19.35,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"15","type":"x","order":"3","pct":48.39,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.