Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 545
Alerts This Week
Warning Icon 1 545

Red Hat: RHSA-2009-1162-01 Critical: Firefox Security Update

red hat
Calendar Grey July 22, 2009
Scroller Redhat Esm H88
Important Firefox patch for Red Hat Enterprise Linux fixes several vulnerabilities. Update now to maintain security.
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)
Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Topics%20covered

Topics Covered

security advisory security update critical Red Hat Enterprise Linux firefox web browser

References

https://www.cve.org/CVERecord?id=CVE-2009-2462 https://www.cve.org/CVERecord?id=CVE-2009-2463 https://www.cve.org/CVERecord?id=CVE-2009-2464 https://www.cve.org/CVERecord?id=CVE-2009-2465 https://www.cve.org/CVERecord?id=CVE-2009-2466 https://www.cve.org/CVERecord?id=CVE-2009-2467 https://www.cve.org/CVERecord?id=CVE-2009-2469 https://www.cve.org/CVERecord?id=CVE-2009-2471 https://www.cve.org/CVERecord?id=CVE-2009-2472 https://access.redhat.com/security/updates/classification#critical https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.0/

Package List

Red Hat Enterprise Linux AS version 4:
Source:
i386: firefox-3.0.12-1.el4.i386.rpm firefox-debuginfo-3.0.12-1.el4.i386.rpm
ia64: firefox-3.0.12-1.el4.ia64.rpm firefox-debuginfo-3.0.12-1.el4.ia64.rpm
ppc: firefox-3.0.12-1.el4.ppc.rpm firefox-debuginfo-3.0.12-1.el4.ppc.rpm
s390: firefox-3.0.12-1.el4.s390.rpm firefox-debuginfo-3.0.12-1.el4.s390.rpm
s390x: firefox-3.0.12-1.el4.s390x.rpm firefox-debuginfo-3.0.12-1.el4.s390x.rpm
x86_64: firefox-3.0.12-1.el4.x86_64.rpm firefox-debuginfo-3.0.12-1.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
i386: firefox-3.0.12-1.el4.i386.rpm firefox-debuginfo-3.0.12-1.el4.i386.rpm
x86_64: firefox-3.0.12-1.el4.x86_64.rpm firefox-debuginfo-3.0.12-1.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
i386: firefox-3.0.12-1.el4.i386.rpm firefox-debuginfo-3.0.12-1.el4.i386.rpm
ia64: firefox-3.0.12-1.el4.ia64.rpm firefox-debuginfo-3.0.12-1.el4.ia64.rpm
x86_64: firefox-3.0.12-1.el4.x86_64.rpm firefox-debuginfo-3.0.12-1.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
i386: firefox-3.0.12-1.el4.i386.rpm firefox-debuginfo-3.0.12-1.el4.i386.rpm
ia64: firefox-3.0.12-1.el4.ia64.rpm firefox-debuginfo-3.0.12-1.el4.ia64.rpm
x86_64: firefox-3.0.12-1.el4.x86_64.rpm firefox-debuginfo-3.0.12-1.el4.x86_64.rpm


Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2009:1162-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2009:1162.html
Issue date: 2009-07-21

Topic

Updated firefox packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5.This update has been rated as having critical security impact by the RedHat Security Response Team.

Topics%20covered

Topics Covered

security advisory security update critical Red Hat Enterprise Linux firefox web browser

Relevant Releases Architectures

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

512128 - CVE-2009-2462 Mozilla Browser engine crashes

512131 - CVE-2009-2463 Mozilla Base64 decoding crash

512133 - CVE-2009-2464 Mozilla crash with multiple RDFs in XUL tree

512135 - CVE-2009-2465 Mozilla double frame construction crashes

512136 - CVE-2009-2466 Mozilla JavaScript engine crashes

512137 - CVE-2009-2467 Mozilla remote code execution during Flash player unloading

512142 - CVE-2009-2469 Mozilla remote code execution using watch and __defineSetter__ on SVG element

512146 - CVE-2009-2471 Mozilla setTimeout loses XPCNativeWrappers512147 - CVE-2009-2472 Mozilla multiple cross origin wrapper bypasses

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.