====================================================================                   Red Hat Security Advisory

Synopsis:          Critical: firefox security update
Advisory ID:       RHSA-2009:0315-00
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2009:0315.html
Issue date:        2009-03-04
CVE Names:         CVE-2009-0040 CVE-2009-0771 CVE-2009-0772 
                   CVE-2009-0773 CVE-2009-0774 CVE-2009-0775 
                   CVE-2009-0776 CVE-2009-0777 
====================================================================
1. Summary:

An updated firefox package that fixes various security issues is now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

Mozilla Firefox is an open source Web browser.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774,
CVE-2009-0775)

Several flaws were found in the way malformed content was processed. A
website containing specially-crafted content could, potentially, trick a
Firefox user into surrendering sensitive information. (CVE-2009-0776,
CVE-2009-0777)

For technical details regarding these flaws, please see the Mozilla
security advisories for Firefox 3.0.7. You can find a link to the Mozilla
advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.0.7, and which correct these issues. After installing the
update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at

5. Bugs fixed (http://bugzilla.redhat.com/):

486355 - CVE-2009-0040 libpng arbitrary free() flaw
488272 - CVE-2009-0771 Firefox 3 Layout Engine Crashes
488273 - CVE-2009-0772 Firefox 2 and 3 - Layout engine crashes
488276 - CVE-2009-0773 Firefox 3 crashes in the JavaScript engine
488283 - CVE-2009-0774 Firefox 2 and 3 crashes in the JavaScript engine
488287 - CVE-2009-0775 Firefox XUL Linked Clones Double Free Vulnerability
488290 - CVE-2009-0776 Firefox XML data theft via RDFXMLDataSource and cross-domain redirect
488292 - CVE-2009-0777 Firefox URL spoofing with invisible control characters

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:

i386:
firefox-3.0.7-1.el4.i386.rpm
firefox-debuginfo-3.0.7-1.el4.i386.rpm

ia64:
firefox-3.0.7-1.el4.ia64.rpm
firefox-debuginfo-3.0.7-1.el4.ia64.rpm

ppc:
firefox-3.0.7-1.el4.ppc.rpm
firefox-debuginfo-3.0.7-1.el4.ppc.rpm

s390:
firefox-3.0.7-1.el4.s390.rpm
firefox-debuginfo-3.0.7-1.el4.s390.rpm

s390x:
firefox-3.0.7-1.el4.s390x.rpm
firefox-debuginfo-3.0.7-1.el4.s390x.rpm

x86_64:
firefox-3.0.7-1.el4.x86_64.rpm
firefox-debuginfo-3.0.7-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:

i386:
firefox-3.0.7-1.el4.i386.rpm
firefox-debuginfo-3.0.7-1.el4.i386.rpm

x86_64:
firefox-3.0.7-1.el4.x86_64.rpm
firefox-debuginfo-3.0.7-1.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:

i386:
firefox-3.0.7-1.el4.i386.rpm
firefox-debuginfo-3.0.7-1.el4.i386.rpm

ia64:
firefox-3.0.7-1.el4.ia64.rpm
firefox-debuginfo-3.0.7-1.el4.ia64.rpm

x86_64:
firefox-3.0.7-1.el4.x86_64.rpm
firefox-debuginfo-3.0.7-1.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:

i386:
firefox-3.0.7-1.el4.i386.rpm
firefox-debuginfo-3.0.7-1.el4.i386.rpm

ia64:
firefox-3.0.7-1.el4.ia64.rpm
firefox-debuginfo-3.0.7-1.el4.ia64.rpm

x86_64:
firefox-3.0.7-1.el4.x86_64.rpm
firefox-debuginfo-3.0.7-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:

i386:
firefox-3.0.7-1.el5.i386.rpm
firefox-debuginfo-3.0.7-1.el5.i386.rpm
xulrunner-1.9.0.7-1.el5.i386.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm

x86_64:
firefox-3.0.7-1.el5.i386.rpm
firefox-3.0.7-1.el5.x86_64.rpm
firefox-debuginfo-3.0.7-1.el5.i386.rpm
firefox-debuginfo-3.0.7-1.el5.x86_64.rpm
xulrunner-1.9.0.7-1.el5.i386.rpm
xulrunner-1.9.0.7-1.el5.x86_64.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:

i386:
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.i386.rpm

x86_64:
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm
xulrunner-devel-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-1.9.0.7-1.el5.x86_64.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:

i386:
firefox-3.0.7-1.el5.i386.rpm
firefox-debuginfo-3.0.7-1.el5.i386.rpm
xulrunner-1.9.0.7-1.el5.i386.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.i386.rpm

ia64:
firefox-3.0.7-1.el5.ia64.rpm
firefox-debuginfo-3.0.7-1.el5.ia64.rpm
xulrunner-1.9.0.7-1.el5.ia64.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.ia64.rpm
xulrunner-devel-1.9.0.7-1.el5.ia64.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.ia64.rpm

ppc:
firefox-3.0.7-1.el5.ppc.rpm
firefox-debuginfo-3.0.7-1.el5.ppc.rpm
xulrunner-1.9.0.7-1.el5.ppc.rpm
xulrunner-1.9.0.7-1.el5.ppc64.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.ppc.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.ppc64.rpm
xulrunner-devel-1.9.0.7-1.el5.ppc.rpm
xulrunner-devel-1.9.0.7-1.el5.ppc64.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.ppc.rpm

s390x:
firefox-3.0.7-1.el5.s390.rpm
firefox-3.0.7-1.el5.s390x.rpm
firefox-debuginfo-3.0.7-1.el5.s390.rpm
firefox-debuginfo-3.0.7-1.el5.s390x.rpm
xulrunner-1.9.0.7-1.el5.s390.rpm
xulrunner-1.9.0.7-1.el5.s390x.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.s390.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.s390x.rpm
xulrunner-devel-1.9.0.7-1.el5.s390.rpm
xulrunner-devel-1.9.0.7-1.el5.s390x.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.s390x.rpm

x86_64:
firefox-3.0.7-1.el5.i386.rpm
firefox-3.0.7-1.el5.x86_64.rpm
firefox-debuginfo-3.0.7-1.el5.i386.rpm
firefox-debuginfo-3.0.7-1.el5.x86_64.rpm
xulrunner-1.9.0.7-1.el5.i386.rpm
xulrunner-1.9.0.7-1.el5.x86_64.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm
xulrunner-devel-1.9.0.7-1.el5.i386.rpm
xulrunner-devel-1.9.0.7-1.el5.x86_64.rpm
xulrunner-devel-unstable-1.9.0.7-1.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0773
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0774
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0775
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0776
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0777
http://www.redhat.com/security/updates/classification/#critical
https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.0/

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.

RedHat: Critical: firefox security update RHSA-2009:0315-00

An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact...

Summary

Mozilla Firefox is an open source Web browser.
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775)
Several flaws were found in the way malformed content was processed. A website containing specially-crafted content could, potentially, trick a Firefox user into surrendering sensitive information. (CVE-2009-0776, CVE-2009-0777)
For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.7. You can find a link to the Mozilla advisories in the References section of this errata.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.7, and which correct these issues. After installing the update, Firefox must be restarted for the changes to take effect.



Summary


Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0771 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0772 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0773 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0774 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0775 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0776 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0777 http://www.redhat.com/security/updates/classification/#critical https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.0/

Package List

Red Hat Enterprise Linux AS version 4:
Source:
i386: firefox-3.0.7-1.el4.i386.rpm firefox-debuginfo-3.0.7-1.el4.i386.rpm
ia64: firefox-3.0.7-1.el4.ia64.rpm firefox-debuginfo-3.0.7-1.el4.ia64.rpm
ppc: firefox-3.0.7-1.el4.ppc.rpm firefox-debuginfo-3.0.7-1.el4.ppc.rpm
s390: firefox-3.0.7-1.el4.s390.rpm firefox-debuginfo-3.0.7-1.el4.s390.rpm
s390x: firefox-3.0.7-1.el4.s390x.rpm firefox-debuginfo-3.0.7-1.el4.s390x.rpm
x86_64: firefox-3.0.7-1.el4.x86_64.rpm firefox-debuginfo-3.0.7-1.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
i386: firefox-3.0.7-1.el4.i386.rpm firefox-debuginfo-3.0.7-1.el4.i386.rpm
x86_64: firefox-3.0.7-1.el4.x86_64.rpm firefox-debuginfo-3.0.7-1.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
i386: firefox-3.0.7-1.el4.i386.rpm firefox-debuginfo-3.0.7-1.el4.i386.rpm
ia64: firefox-3.0.7-1.el4.ia64.rpm firefox-debuginfo-3.0.7-1.el4.ia64.rpm
x86_64: firefox-3.0.7-1.el4.x86_64.rpm firefox-debuginfo-3.0.7-1.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
i386: firefox-3.0.7-1.el4.i386.rpm firefox-debuginfo-3.0.7-1.el4.i386.rpm
ia64: firefox-3.0.7-1.el4.ia64.rpm firefox-debuginfo-3.0.7-1.el4.ia64.rpm
x86_64: firefox-3.0.7-1.el4.x86_64.rpm firefox-debuginfo-3.0.7-1.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
i386: firefox-3.0.7-1.el5.i386.rpm firefox-debuginfo-3.0.7-1.el5.i386.rpm xulrunner-1.9.0.7-1.el5.i386.rpm xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm
x86_64: firefox-3.0.7-1.el5.i386.rpm firefox-3.0.7-1.el5.x86_64.rpm firefox-debuginfo-3.0.7-1.el5.i386.rpm firefox-debuginfo-3.0.7-1.el5.x86_64.rpm xulrunner-1.9.0.7-1.el5.i386.rpm xulrunner-1.9.0.7-1.el5.x86_64.rpm xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
i386: xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm xulrunner-devel-1.9.0.7-1.el5.i386.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.i386.rpm
x86_64: xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm xulrunner-devel-1.9.0.7-1.el5.i386.rpm xulrunner-devel-1.9.0.7-1.el5.x86_64.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386: firefox-3.0.7-1.el5.i386.rpm firefox-debuginfo-3.0.7-1.el5.i386.rpm xulrunner-1.9.0.7-1.el5.i386.rpm xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm xulrunner-devel-1.9.0.7-1.el5.i386.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.i386.rpm
ia64: firefox-3.0.7-1.el5.ia64.rpm firefox-debuginfo-3.0.7-1.el5.ia64.rpm xulrunner-1.9.0.7-1.el5.ia64.rpm xulrunner-debuginfo-1.9.0.7-1.el5.ia64.rpm xulrunner-devel-1.9.0.7-1.el5.ia64.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.ia64.rpm
ppc: firefox-3.0.7-1.el5.ppc.rpm firefox-debuginfo-3.0.7-1.el5.ppc.rpm xulrunner-1.9.0.7-1.el5.ppc.rpm xulrunner-1.9.0.7-1.el5.ppc64.rpm xulrunner-debuginfo-1.9.0.7-1.el5.ppc.rpm xulrunner-debuginfo-1.9.0.7-1.el5.ppc64.rpm xulrunner-devel-1.9.0.7-1.el5.ppc.rpm xulrunner-devel-1.9.0.7-1.el5.ppc64.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.ppc.rpm
s390x: firefox-3.0.7-1.el5.s390.rpm firefox-3.0.7-1.el5.s390x.rpm firefox-debuginfo-3.0.7-1.el5.s390.rpm firefox-debuginfo-3.0.7-1.el5.s390x.rpm xulrunner-1.9.0.7-1.el5.s390.rpm xulrunner-1.9.0.7-1.el5.s390x.rpm xulrunner-debuginfo-1.9.0.7-1.el5.s390.rpm xulrunner-debuginfo-1.9.0.7-1.el5.s390x.rpm xulrunner-devel-1.9.0.7-1.el5.s390.rpm xulrunner-devel-1.9.0.7-1.el5.s390x.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.s390x.rpm
x86_64: firefox-3.0.7-1.el5.i386.rpm firefox-3.0.7-1.el5.x86_64.rpm firefox-debuginfo-3.0.7-1.el5.i386.rpm firefox-debuginfo-3.0.7-1.el5.x86_64.rpm xulrunner-1.9.0.7-1.el5.i386.rpm xulrunner-1.9.0.7-1.el5.x86_64.rpm xulrunner-debuginfo-1.9.0.7-1.el5.i386.rpm xulrunner-debuginfo-1.9.0.7-1.el5.x86_64.rpm xulrunner-devel-1.9.0.7-1.el5.i386.rpm xulrunner-devel-1.9.0.7-1.el5.x86_64.rpm xulrunner-devel-unstable-1.9.0.7-1.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package


Severity
Advisory ID: RHSA-2009:0315-00
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2009:0315.html
Issued Date: : 2009-03-04
CVE Names: CVE-2009-0040 CVE-2009-0771 CVE-2009-0772 CVE-2009-0773 CVE-2009-0774 CVE-2009-0775 CVE-2009-0776 CVE-2009-0777

Topic

An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.


Topic


 

Relevant Releases Architectures

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64


Bugs Fixed

486355 - CVE-2009-0040 libpng arbitrary free() flaw

488272 - CVE-2009-0771 Firefox 3 Layout Engine Crashes

488273 - CVE-2009-0772 Firefox 2 and 3 - Layout engine crashes

488276 - CVE-2009-0773 Firefox 3 crashes in the JavaScript engine

488283 - CVE-2009-0774 Firefox 2 and 3 crashes in the JavaScript engine

488287 - CVE-2009-0775 Firefox XUL Linked Clones Double Free Vulnerability

488290 - CVE-2009-0776 Firefox XML data theft via RDFXMLDataSource and cross-domain redirect

488292 - CVE-2009-0777 Firefox URL spoofing with invisible control characters


Related News

CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved