Scientific Linux: Firefox Critical Patch CVE-2009-3979 - Malicious Content

Date: Wed, 16 Dec 2009 13:25:37 -0600
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Critical: firefox on SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Critical: firefox security update
Issue date:	2009-12-16
CVE Names:	CVE-2009-3979 CVE-2009-3981 CVE-2009-3983
 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986

Several flaws were found in the processing of malformed web content. A
web page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user
running Firefox. (CVE-2009-3979, CVE-2009-3981, CVE-2009-3986)

A flaw was found in the Firefox NT Lan Manager (NTLM) authentication
protocol implementation. If an attacker could trick a local user that
has NTLM credentials into visiting a specially-crafted web page, they
could send arbitrary requests, authenticated with the user's NTLM
credentials, to other applications on the user's system. (CVE-2009-3983)

A flaw was found in the way Firefox displayed the SSL location bar
indicator. An attacker could create an unencrypted web page that appears
to be encrypted, possibly tricking the user into believing they are
visiting a secure page. (CVE-2009-3984)

A flaw was found in the way Firefox displayed blank pages after a user
navigates to an invalid address. If a user visits an attacker-controlled
web page that results in a blank page, the attacker could inject content
into that blank page, possibly tricking the user into believing they are
viewing a legitimate page. (CVE-2009-3985)

After installing the update, Firefox must be restarted for the changes
to take effect.

SL 4.x

 SRPMS:
firefox-3.0.16-4.el4.src.rpm
 i386:
firefox-3.0.16-4.el4.i386.rpm
 x86_64:
firefox-3.0.16-4.el4.i386.rpm
firefox-3.0.16-4.el4.x86_64.rpm

SL 5.x

 SRPMS:
firefox-3.0.16-1.el5_4.src.rpm
xulrunner-1.9.0.16-2.el5_4.src.rpm
 i386:
firefox-3.0.16-1.el5_4.i386.rpm
xulrunner-1.9.0.16-2.el5_4.i386.rpm
xulrunner-devel-1.9.0.16-2.el5_4.i386.rpm
xulrunner-devel-unstable-1.9.0.16-2.el5_4.i386.rpm
 x86_64:
firefox-3.0.16-1.el5_4.i386.rpm
firefox-3.0.16-1.el5_4.x86_64.rpm
xulrunner-1.9.0.16-2.el5_4.i386.rpm
xulrunner-1.9.0.16-2.el5_4.x86_64.rpm
xulrunner-devel-1.9.0.16-2.el5_4.i386.rpm
xulrunner-devel-1.9.0.16-2.el5_4.x86_64.rpm
xulrunner-devel-unstable-1.9.0.16-2.el5_4.x86_64.rpm

-Connie Sieh
-Troy Dawson