PROBLEM:
Multiple vulnerabilities were reported in Mozilla Firefox.
PLATFORM:
Linux (Any), UNIX (Any), Windows (Any) Version(s): prior to 3.2.26; prior to 10.0
ABSTRACT:
Mozilla Firefox Multiple Flaws Permit Remote Code Execution, Information Disclosure, and Cross-Site Scripting.
reference LINKS:
SecurityTracker Alert ID: 1026605
CVE-2011-3659, CVE-2012-0442
CVE-2012-0443, CVE-2012-0444
CVE-2012-0445, CVE-2012-0446
CVE-2012-0447, CVE-2012-0449
CVE-2012-0450
Vendor Site
IMPACT ASSESSMENT:
Medium
Discussion:
Multiple vulnerabilities were reported in Mozilla Firefox. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can conduct cross-site scripting attacks. A remote user can obtain cross-domain information. A local user can obtain potentially sensitive information.
A remote user can create a specially crafted content that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target user's system [CVE-2012-0442, CVE-2012-0443]. The code will run with the privileges of the target user.
In certain situations, a removed child node of nsDOMAttribute can be accessed [CVE-2011-3659].
Frame scripts can bypass XPConnect security checks when calling untrusted objects, allowing a remote user to conduct cross-site scripting attacks via web pages and Firefox extensions [CVE-2012-0446].
The 'image/vnd.microsoft.icon' output may include uninitialized memory [CVE-2012-0447]. A remote user may be able to access potentially sensitive data, such as when a PNG image is converted from an ICO format. Version 3.6 is not affected.
A remote user can create a specially crafted Ogg Vorbis file that, when loaded by the target user, will trigger a memory corruption error and potentially execute arbitrary code on the target user's system [CVE-2012-0444].
A remote user can create a specially crafted embedded XSLT stylesheet that, when loaded by the target user, will trigger a memory corruption error and potentially execute arbitrary code on the target user's system [CVE-2012-0449].
A remote user can bypass HTML5 frame navigation controls, replacing a sub-frame in a target domain's document by using the name attribute of the sub-frame as a form submission target [CVE-2012-0445]. Version 3.6 is not affected.
When a user exports their Firefox Sync key, the "Firefox Recovery Key.html" file is created with unsafe permissions [CVE-2012-0450]. A local user on Linux/UNIX-based systems may be able to read the file. Version 3.6 is not affected.
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Solution:
The vendor has issued a fix (3.6.26, 10.0).