Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3982, CVE-2012-3988, CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188)

Two flaws in Firefox could allow a malicious website to bypass intended restrictions, possibly leading to information disclosure, or Firefox executing arbitrary code. Note that the information disclosure issue could possibly be combined with other flaws to achieve arbitrary code execution. (CVE-2012-3986, CVE-2012-3991)

Multiple flaws were found in the location object implementation in Firefox. Malicious content could be used to perform cross-site scripting attacks, script injection, or spoofing attacks.
(CVE-2012-1956, CVE-2012-3992, CVE-2012-3994)

Two flaws were found in the way Chrome Object Wrappers were implemented. Malicious content could be used to perform cross-site scripting attacks or cause Firefox to execute arbitrary code.
(CVE-2012-3993, CVE-2012-4184)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.8 ESR.

This update also fixes the following bug :

  - In certain environments, storing personal Firefox     configuration files (~/.mozilla/) on an NFS share, such     as when your home directory is on a NFS share, led to     Firefox functioning incorrectly, for example, navigation     buttons not working as expected, and bookmarks not     saving. This update adds a new configuration option,     storage.nfs_filesystem, that can be used to resolve this     issue.

If you experience this issue :

1) Start Firefox.

2) Type 'about:config' (without quotes) into the URL bar and press the Enter key.

3) If prompted with 'This might void your warranty!', click the 'I'll be careful, I promise!' button.

4) Right-click in the Preference Name list. In the menu that opens, select New -> Boolean.

5) Type 'storage.nfs_filesystem' (without quotes) for the preference name and then click the OK button.

6) Select 'true' for the boolean value and then press the OK button.

After installing the update, Firefox must be restarted for the changes to take effect.

The installed version of Firefox is earlier than 16.0 and thus, is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

Mozilla Firefox was updated to the 10.0.9ESR security release which fixes bugs and security issues :

  - Security researchers Thai Duong and Juliano Rizzo     reported that SPDY's request header compression leads to     information leakage, which can allow the extraction of     private data such as session cookies, even over an     encrypted SSL connection. (This does not affect Firefox     10 as it does not feature the SPDY extension. It was     silently fixed for Firefox 15.). (MFSA 2012-73 /     CVE-2012-3977)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-74)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Henrik Skupin, Jesse Ruderman and moz_bug_r_a4 reported     memory safety problems and crashes that affect Firefox     15. (CVE-2012-3983)

  - Christian Holler and Jesse Ruderman reported memory     safety problems and crashes that affect Firefox ESR 10     and Firefox 15. (CVE-2012-3982)

  - Security researcher David Bloom of Cue discovered that     'select' elements are always-on-top chromeless windows     and that navigation away from a page with an active     'select' menu does not remove this window.When another     menu is opened programmatically on a new page, the     original 'select' menu can be retained and arbitrary     HTML content within it rendered, allowing an attacker to     cover arbitrary portions of the new page through     absolute positioning/scrolling, leading to spoofing     attacks. Security researcher Jordi Chancel found a     variation that would allow for click-jacking attacks was     well. (MFSA 2012-75 / CVE-2012-3984)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Navigation away from a page with an active 'select'     dropdown menu can be used for URL spoofing, other evil

    Firefox 10.0.1 : Navigation away from a page with     multiple active 'select' dropdown menu can be used for     Spoofing And ClickJacking with XPI using window.open and     geolocalisation

  - Security researcher Collin Jackson reported a violation     of the HTML5 specifications for document.domain     behavior. Specified behavior requires pages to only have     access to windows in a new document.domain but the     observed violation allowed pages to retain access to     windows from the page's initial origin in addition to     the new document.domain. This could potentially lead to     cross-site scripting (XSS) attacks. (MFSA 2012-76 /     CVE-2012-3985)

  - Mozilla developer Johnny Stenback discovered that     several methods of a feature used for testing     (DOMWindowUtils) are not protected by existing security     checks, allowing these methods to be called through     script by web pages. This was addressed by adding the     existing security checks to these methods. (MFSA 2012-77     / CVE-2012-3986)

  - Security researcher Warren He reported that when a page     is transitioned into Reader Mode in Firefox for Android,     the resulting page has chrome privileges and its content     is not thoroughly sanitized. A successful attack     requires user enabling of reader mode for a malicious     page, which could then perform an attack similar to     cross-site scripting (XSS) to gain the privileges     allowed to Firefox on an Android device. This has been     fixed by changing the Reader Mode page into an     unprivileged page. (MFSA 2012-78 / CVE-2012-3987)

    This vulnerability only affects Firefox for Android.

  - Security researcher Soroush Dalili reported that a     combination of invoking full screen mode and navigating     backwards in history could, in some circumstances, cause     a hang or crash due to a timing dependent use-after-free     pointer reference. This crash may be potentially     exploitable. (MFSA 2012-79 / CVE-2012-3988)

  - Mozilla community member Ms2ger reported a crash due to     an invalid cast when using the instanceof operator on     certain types of JavaScript objects. This can lead to a     potentially exploitable crash. (MFSA 2012-80 /     CVE-2012-3989)

  - Mozilla community member Alice White reported that when     the GetProperty function is invoked through JSAPI,     security checking can be bypassed when getting     cross-origin properties. This potentially allowed for     arbitrary code execution. (MFSA 2012-81 / CVE-2012-3991)

  - Security researcher Mariusz Mlynski reported that the     location property can be accessed by binary plugins     through top.location and top can be shadowed by     Object.defineProperty as well. This can allow for     possible cross-site scripting (XSS) attacks through     plugins. (MFSA 2012-82 / CVE-2012-3994)

  - Security researcher Mariusz Mlynski reported that when     InstallTrigger fails, it throws an error wrapped in a     Chrome Object Wrapper (COW) that fails to specify     exposed properties. These can then be added to the     resulting object by an attacker, allowing access to     chrome privileged functions through script. (MFSA     2012-83)

    While investigating this issue, Mozilla security     researcher moz_bug_r_a4 found that COW did not disallow     accessing of properties from a standard prototype in     some situations, even when the original issue had been     fixed.

    These issues could allow for a cross-site scripting     (XSS) attack or arbitrary code execution.

  - XrayWrapper pollution via unsafe COW. (CVE-2012-3993)

  - ChromeObjectWrapper is not implemented as intended.
    (CVE-2012-4184)

  - Security researcher Mariusz Mlynski reported an issue     with spoofing of the location property. In this issue,     writes to location.hash can be used in concert with     scripted history navigation to cause a specific website     to be loaded into the history object. The baseURI can     then be changed to this stored site, allowing an     attacker to inject a script or intercept posted data     posted to a location specified with a relative path.
    (MFSA 2012-84 / CVE-2012-3992)

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team discovered a series of     use-after-free, buffer overflow, and out of bounds read     issues using the Address Sanitizer tool in shipped     software. These issues are potentially exploitable,     allowing for remote code execution. We would also like     to thank Abhishek for reporting two additional     use-after-free flaws introduced during Firefox 16     development and fixed before general release. (MFSA     2012-85)

  - Out of bounds read in IsCSSWordSpacingSpace.
    (CVE-2012-3995)

  - Heap-use-after-free in     nsHTMLCSSUtils::CreateCSSPropertyTxn. (CVE-2012-4179)

  - Heap-buffer-overflow in     nsHTMLEditor::IsPrevCharInNodeWhitespace.
    (CVE-2012-4180)

  - Heap-use-after-free in     nsSMILAnimationController::DoSample. (CVE-2012-4181)

  - Heap-use-after-free in nsTextEditRules::WillInsert.
    (CVE-2012-4182)

  - Heap-use-after-free in DOMSVGTests::GetRequiredFeatures.
    (CVE-2012-4183)

  - Security researcher Atte Kettunen from OUSPG reported     several heap memory corruption issues found using the     Address Sanitizer tool. These issues are potentially     exploitable, allowing for remote code execution. (MFSA     2012-86)

  - Global-buffer-overflow in nsCharTraits::length.
    (CVE-2012-4185)

  - Heap-buffer-overflow in nsWaveReader::DecodeAudioData.
    (CVE-2012-4186)

  - Crash with ASSERTION: insPos too small. (CVE-2012-4187)

  - Heap-buffer-overflow in Convolve3x3. (CVE-2012-4188)

  - Security researcher miaubiz used the Address Sanitizer     tool to discover a use-after-free in the IME State     Manager code. This could lead to a potentially     exploitable crash. (MFSA 2012-87 / CVE-2012-3990)

  - Mozilla security researcher moz_bug_r_a4 reported a     regression where security wrappers are unwrapped without     doing a security check in defaultValue(). This can allow     for improper access access to the Location object. In     versions 15 and earlier of affected products, there was     also the potential for arbitrary code execution. (MFSA     2012-89 / CVE-2012-4192 / CVE-2012-4193)

ID	名稱	產品	系列	已發布	已更新	嚴重性
62492	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20121009)	Nessus	Scientific Linux Local Security Checks	2012/10/11	2021/1/14	critical
62580	Firefox < 16.0 Multiple Vulnerabilities	Nessus	Windows	2012/10/17	2026/6/23	critical
64133	SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 6951)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	critical

偵測

搜尋 Plugin

critical

critical

critical