Scientific Linux: CVE-2012-5842 Critical: Firefox Security Flaws

Date: Wed, 21 Nov 2012 10:40:08 -0600
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Organization: Fermilab
Subject: Security ERRATA Critical: firefox on SL5.x, SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Critical: firefox security update
Issue Date: 2012-11-20
CVE Numbers: CVE-2012-5842
 CVE-2012-4202
 CVE-2012-4201
 CVE-2012-5841
 CVE-2012-4207
 CVE-2012-4209
 CVE-2012-4214
 CVE-2012-4215
 CVE-2012-4216
 CVE-2012-5829
 CVE-2012-5839
 CVE-2012-5840
 CVE-2012-5830
 CVE-2012-5833
 CVE-2012-5835
 CVE-2012-4210
--

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829,
CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5839, CVE-2012-5840,
CVE-2012-5842)

A buffer overflow flaw was found in the way Firefox handled GIF (Graphics
Interchange Format) images. A web page containing a malicious GIF image
could cause Firefox to crash or, possibly, execute arbitrary code with the
privileges of the user running Firefox. (CVE-2012-4202)

A flaw was found in the way the Style Inspector tool in Firefox handled
certain Cascading Style Sheets (CSS). Running the tool (Tools -> Web
Developer -> Inspect) on malicious CSS could result in the execution of
HTML and CSS content with chrome privileges. (CVE-2012-4210)

A flaw was found in the way Firefox decoded the HZ-GB-2312 character
encoding. A web page containing malicious content could cause Firefox to
run JavaScript code with the permissions of a different website.
(CVE-2012-4207)

A flaw was found in the location object implementation in Firefox.
Malicious content could possibly use this flaw to allow restricted content
to be loaded by plug-ins. (CVE-2012-4209)

A flaw was found in the way cross-origin wrappers were implemented.
Malicious content could use this flaw to perform cross-site scripting
attacks. (CVE-2012-5841)

A flaw was found in the evalInSandbox implementation in Firefox. Malicious
content could use this flaw to perform cross-site scripting attacks.
(CVE-2012-4201)

After installing the update, Firefox must be restarted for the
changes to take effect.
--

SL5
 x86_64
 firefox-10.0.11-1.el5_8.i386.rpm
 firefox-10.0.11-1.el5_8.x86_64.rpm
 xulrunner-10.0.11-1.el5_8.i386.rpm
 xulrunner-10.0.11-1.el5_8.x86_64.rpm
 xulrunner-devel-10.0.11-1.el5_8.i386.rpm
 xulrunner-devel-10.0.11-1.el5_8.x86_64.rpm
 i386
 firefox-10.0.11-1.el5_8.i386.rpm
 xulrunner-10.0.11-1.el5_8.i386.rpm
 xulrunner-devel-10.0.11-1.el5_8.i386.rpm
SL6
 x86_64
 firefox-10.0.11-1.el6_3.i686.rpm
 firefox-10.0.11-1.el6_3.x86_64.rpm
 xulrunner-10.0.11-1.el6_3.i686.rpm
 xulrunner-10.0.11-1.el6_3.x86_64.rpm
 xulrunner-devel-10.0.11-1.el6_3.i686.rpm
 xulrunner-devel-10.0.11-1.el6_3.x86_64.rpm
 i386
 firefox-10.0.11-1.el6_3.i686.rpm
 xulrunner-10.0.11-1.el6_3.i686.rpm
 xulrunner-devel-10.0.11-1.el6_3.i686.rpm

- Scientific Linux Development Team