SciLinux: CVE-2007-5947 firefox SL5.x, SL4.x i386/x86_64
Summary
Date: Tue, 27 Nov 2007 15:47:35 -0600Reply-To: Troy DawsonSender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA for firefox on SL5.x, SL4.x i386/x86_64Comments: To: "scientific-linux-errata@fnal.gov" Synopsis: Critical: firefox security updateIssue date: 2007-11-26CVE Names: CVE-2007-5947 CVE-2007-5959 CVE-2007-5960A cross-site scripting flaw was found in the way Firefox handled thejar: URI scheme. It was possible for a malicious website to leverage thisflaw and conduct a cross-site scripting attack against a user runningFirefox. (CVE-2007-5947)Several flaws were found in the way Firefox processed certain malformed webcontent. A webpage containing malicious content could cause Firefox tocrash, or potentially execute arbitrary code as the user running Firefox.(CVE-2007-5959)A race condition existed when Firefox set the "window.location" propertyfor a webpage. This flaw could allow a webpage to set an arbitrary Refererheader, which may lead to a Cross-site Request Forgery (CSRF) attackagainst websites that rely only on the Referer header for protection.(CVE-2007-5960)SL 4.x SRPMS:firefox-1.5.0.12-0.8.el4.src.rpm i386:firefox-1.5.0.12-0.8.el4.i386.rpm x86_64:firefox-1.5.0.12-0.8.el4.i386.rpmfirefox-1.5.0.12-0.8.el4.x86_64.rpmSL 5.x SRPMS:firefox-1.5.0.12-7.el5.src.rpm i386:firefox-1.5.0.12-7.el5.i386.rpmfirefox-devel-1.5.0.12-7.el5.i386.rpm x86_64:firefox-1.5.0.12-7.el5.i386.rpmfirefox-1.5.0.12-7.el5.x86_64.rpmfirefox-devel-1.5.0.12-7.el5.i386.rpmfirefox-devel-1.5.0.12-7.el5.x86_64.rpm-Connie Sieh-Troy Dawson