Scientific Linux: SLSA-2013:1476-1 Critical: Firefox Remote Code Execution

Date: Wed, 30 Oct 2013 14:53:21 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Critical: firefox on SL5.x, SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Critical: firefox security update
Advisory ID: SLSA-2013:1476-1
Issue Date: 2013-10-29
CVE Numbers: CVE-2013-5590
 CVE-2013-5595
 CVE-2013-5597
 CVE-2013-5599
 CVE-2013-5600
 CVE-2013-5601
 CVE-2013-5602
 CVE-2013-5604
--

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to terminate
unexpectedly or, potentially, execute arbitrary code with the privileges
of the user running Firefox. (CVE-2013-5590, CVE-2013-5597, CVE-2013-5599,
CVE-2013-5600, CVE-2013-5601, CVE-2013-5602)

It was found that the Firefox JavaScript engine incorrectly allocated
memory for certain functions. An attacker could combine this flaw with
other vulnerabilities to execute arbitrary code with the privileges of the
user running Firefox. (CVE-2013-5595)

A flaw was found in the way Firefox handled certain Extensible Stylesheet
Language Transformations (XSLT) files. An attacker could combine this flaw
with other vulnerabilities to execute arbitrary code with the privileges
of the user running Firefox. (CVE-2013-5604)

After installing the update, Firefox must be restarted for the changes to
take effect.
--

SL5
 x86_64
 firefox-17.0.10-1.el5_10.i386.rpm
 firefox-17.0.10-1.el5_10.x86_64.rpm
 firefox-debuginfo-17.0.10-1.el5_10.i386.rpm
 firefox-debuginfo-17.0.10-1.el5_10.x86_64.rpm
 xulrunner-17.0.10-1.el5_10.i386.rpm
 xulrunner-17.0.10-1.el5_10.x86_64.rpm
 xulrunner-debuginfo-17.0.10-1.el5_10.i386.rpm
 xulrunner-debuginfo-17.0.10-1.el5_10.x86_64.rpm
 xulrunner-devel-17.0.10-1.el5_10.i386.rpm
 xulrunner-devel-17.0.10-1.el5_10.x86_64.rpm
 i386
 firefox-17.0.10-1.el5_10.i386.rpm
 firefox-debuginfo-17.0.10-1.el5_10.i386.rpm
 xulrunner-17.0.10-1.el5_10.i386.rpm
 xulrunner-debuginfo-17.0.10-1.el5_10.i386.rpm
 xulrunner-devel-17.0.10-1.el5_10.i386.rpm
SL6
 x86_64
 firefox-17.0.10-1.el6_4.i686.rpm
 firefox-17.0.10-1.el6_4.x86_64.rpm
 firefox-debuginfo-17.0.10-1.el6_4.i686.rpm
 firefox-debuginfo-17.0.10-1.el6_4.x86_64.rpm
 xulrunner-17.0.10-1.el6_4.i686.rpm
 xulrunner-17.0.10-1.el6_4.x86_64.rpm
 xulrunner-debuginfo-17.0.10-1.el6_4.i686.rpm
 xulrunner-debuginfo-17.0.10-1.el6_4.x86_64.rpm
 xulrunner-devel-17.0.10-1.el6_4.i686.rpm
 xulrunner-devel-17.0.10-1.el6_4.x86_64.rpm
 i386
 firefox-17.0.10-1.el6_4.i686.rpm
 firefox-debuginfo-17.0.10-1.el6_4.i686.rpm
 xulrunner-17.0.10-1.el6_4.i686.rpm
 xulrunner-debuginfo-17.0.10-1.el6_4.i686.rpm
 xulrunner-devel-17.0.10-1.el6_4.i686.rpm

- Scientific Linux Development Team