The installed version of Firefox is earlier than 3.0.12. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could     potentially be exploited to execute arbitrary code.     (MFSA 2009-34)

  - It may be possible to crash the browser or potentially     execute arbitrary code by using a flash object that     presents a slow script dialog. (MFSA 2009-35) 

  - Glyph rendering libraries are affected by multiple heap/     integer overflows. (MFSA 2009-36)

  - A vulnerability involving SVG element could be exploited     to crash the browser or execute arbitrary code on the     remote system. (MFSA 2009-37)

  - A SOCKS5 proxy that replies with a hostname containing     more than 15 characters can corrupt the subsequent     data stream.  This can lead to a denial of service,     though there is reportedly no memory corruption.
    (MFSA 2009-38)

  - A vulnerability in 'setTimeout' could allow unsafe     access to the 'this' object from chrome code. An     attacker could exploit this flaw to run arbitrary     JavaScript with chrome privileges. (MFSA 2009-39)

  - It may be possible for JavaScript from one website     to bypass cross origin wrapper, and unsafely access     properties of an object from another website.
    (MFSA 2009-40)

複数のセキュリティ上の問題を修正する更新済みの firefox パッケージが、 Red Hat Enterprise Linux 4 および 5 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新には重大なセキュリティインパクトがあるものとして評価しています。

Mozilla Firefox はオープンソースの Web ブラウザです。XULRunner は、Mozilla Firefox 用の XUL Runtime 環境を提供しています。

不正な形式の Web コンテンツの処理に様々な欠陥が見つかりました。悪意のあるコンテンツが含まれる Web ページは Firefox をクラッシュさせたり、 Firefox を実行しているユーザーとして任意のコードを実行する可能性があります。
（CVE-2009-2462、CVE-2009-2463、CVE-2009-2464、CVE-2009-2465、CVE-2009-2466、CVE-2009-2467、CVE-2009-2469、CVE-2009-2471）

Firefox が無効な形式の JavaScript コードを処理する方法で、複数の欠陥が見つかりました。悪意のあるコンテンツを含むウェブサイトが、クロスサイトスクリプティング（XSS）攻撃を仕掛けたり、別のウェブサイトの権限を利用して任意の JavaScript を実行する可能性があります。（CVE-2009-2472）

これらの欠陥の技術的な詳細については、Firefox 3.0.12 向けの Mozilla セキュリティアドバイザリを参照してください。Mozilla アドバイザリへのリンクは、このエラータの参照セクションにあります。

すべての Firefox ユーザーは、これらの問題を修正する Firefox バ―ジョン 3.0.12 を含む、更新済みのこれらのパッケージにアップグレードする必要があります。更新をインストールした後、変更した内容を反映させるには Firefox を再起動する必要があります。

遠端主機受到 GLSA-201405-13 中所述的弱點影響 (Pango：多個弱點)

在 Pango 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

內容相依的攻擊者可引誘使用者使用連結 Pango 的應用程式，載入特製的文字，進而可能導致以處理程序的權限執行任意程式碼或造成拒絕服務情形。
 因應措施：

目前尚無已知的因應措施。

远程主机受到 GLSA-201405-13 中所述漏洞的影响（Pango：多种漏洞）

在 Pango 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

上下文有关的攻击者可引诱用户使用链接到 Pango 的应用程序来加载特别构建的文本，从而可能导致以进程的权限执行任意代码或造成拒绝服务情况。
 变通方案：

目前无任何已知的变通方案。

リモートホストは、GLSA-201405-13 で説明されている脆弱性の影響を受けます（Pango：複数の脆弱性）

Pango で複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

コンテキスト依存の攻撃者がユーザーを誘導して、特別に細工されたテキストを Pango にリンクされたアプリケーションで読み込ませることで、プロセスの権限で任意のコードを実行したり、サービス拒否状態を引き起こしたりする可能性があります。
 回避策：

現時点で、既知の回避策はありません。

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Security vulnerabilities have been discovered and corrected in Mozilla Firefox 3.0.x :

Several flaws were discovered in the Firefox browser and JavaScript engines, which could allow a malicious website to cause a denial of service or possibly execute arbitrary code with user privileges.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2468, CVE-2009-2471)

Attila Suszter discovered a flaw in the way Firefox processed Flash content, which could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2467)

It was discovered that Firefox did not properly handle some SVG content, which could lead to a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2469)

A flaw was discovered in the JavaScript engine which could be used to perform cross-site scripting attacks. (CVE-2009-2472)

This update provides the latest Mozilla Firefox 3.0.x to correct these issues.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

The version of Safari installed on the remote Windows host is earlier than 4.0.3.  Such versions are potentially affected by several issues :

  - A buffer overflow exists in the handling of EXIF     metadata that ccould lead to a crash or arbitrary code     execution. (CVE-2009-2188)

  - A vulnerability in WebKit's parsing of floating point     numbers may allow for remote code execution.
    (CVE-2009-2195)

  - A vulnerability in Safari may allow a malicious website     to be promoted in Safari's Top Sites. (CVE-2009-2196)

  - A vulnerability in how WebKit renders an URL with look-     alike characters could be used to masquerade a website.
    (CVE-2009-2199)

  - A vulnerability in WebKit may lead to the disclosure of     sensitive information. (CVE-2009-2200)

  - A heap-based buffer overflow in CoreGraphics involving     the drawing of long text strings could lead to a crash     or arbitrary code execution. (CVE-2009-2468)

The remote host is affected by the vulnerability described in GLSA-201405-13 (Pango: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pango. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to load specially       crafted text using an application linked against Pango, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of Firefox prior to 3.0.12 are affected by the following security issues :

 - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-34)
 - It may be possible to crash the browser or potentially execute arbitrary code by using a flash object that presents a slow script dialog. (MFSA 2009-35)
 - Glyph rendering libraries are affected by multiple heap/integer overflows. (MFSA 2009-36)
 - A vulnerability involving SVG element could be exploited to crash the browser or execute arbitrary code on the remote system. (MFSA 2009-37)
 - A vulnerability in 'setTimeout' could allow unsafe access to the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary JavaScript with chrome privileges. (MFSA 2009-39)
 - It may be possible for JavaScript from one website to bypass cross-origin wrapper, and unsafely access properties of an object from another website. (MFSA 2009-40)  

The version of Safari installed on the remote host is earlier than 4.0.3.  Such versions are potentially affected by several issues : 

  - A buffer overflow exists in the handling of EXIF metadata could lead to a crash or arbitrary code execution. (CVE-2009-2188)

  - A vulnerability in WebKit's parsing of floating point numbers may allow for remote code execution. (CVE-2009-2195)

  - A vulnerability in Safari may let a malicious website to be promoted in Safari's Top Sites. (CVE-2009-2196)

  - A vulnerability in how WebKit renders an URL with look alike characters could be used to masquerade a website. (CVE-2009-2199)

  - A vulnerability in WebKit may lead to the disclosure of sensitive information. (CVE-2009-2200)

  - A heap buffer overflow in CoreGraphics involving the drawing of long text strings could lead to a crash or arbitrary code execution. (CVE-2009-2468)

The installed version of Firefox is earlier than 3.0.12. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-34)

  - It may be possible to crash the browser or potentially execute arbitrary code by using a flash object that presents a slow script dialog. (MFSA 2009-35)

  - Glyph rendering libraries are affected by multiple heap/integer overflows. (MFSA 2009-36)

  - A vulnerability involving SVG element could be exploited to crash the browser or execute arbitrary code on the remote system. (MFSA 2009-37)

  - A vulnerability in 'setTimeout' could allow unsafe access to the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary JavaScript with chrome privileges. (MFSA 2009-39)

  - It may be possible for JavaScript from one website to bypass cross-origin wrapper, and unsafely access properties of an object from another website. (MFSA 2009-40)

ID	名稱	產品	系列	已發布	已更新	嚴重性
40351	Firefox < 3.0.12 Multiple Vulnerabilities	Nessus	Windows	2009/7/22	2018/7/16	high
43769	CentOS 5：firefox（CESA-2009:1162）	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	critical
74056	GLSA-201405-13：Pango：多個弱點	Nessus	Gentoo Local Security Checks	2014/5/19	2021/1/6	critical
74056	GLSA-201405-13：Pango：多种漏洞	Nessus	Gentoo Local Security Checks	2014/5/19	2021/1/6	critical
74056	GLSA-201405-13：Pango：複数の脆弱性	Nessus	Gentoo Local Security Checks	2014/5/19	2021/1/6	critical
40340	RHEL 4 / 5 : firefox (RHSA-2009:1162)	Nessus	Red Hat Local Security Checks	2009/7/22	2021/1/14	critical
43769	CentOS 5 : firefox (CESA-2009:1162)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	critical
40438	Mandriva Linux Security Advisory : firefox (MDVSA-2009:182)	Nessus	Mandriva Local Security Checks	2009/7/31	2021/1/6	critical
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	2009/9/11	2024/5/28	critical
40554	Safari < 4.0.3 Multiple Vulnerabilities	Nessus	Windows	2009/8/11	2018/7/27	high
74056	GLSA-201405-13 : Pango: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/5/19	2021/1/6	critical
5101	Mozilla Firefox < 3.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/7/28	2019/3/6	medium
5125	Safari < 4.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/8/11	2019/3/6	medium
801007	Safari < 4.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2009/8/11		high
800767	Firefox < 3.0.12 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2009/7/28		high

偵測

搜尋 Plugin

high

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

medium

medium

high

high