remote code execution

Please Install the Updated Packages.

Mozilla Firefox was updated to update 3.6.13 to fix several security issues. Also Mozilla Thunderbird and Seamonkey were updated on openSUSE. Following security issues were fixed: MFSA 2010-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesee Ruderman, Andreas Gal, Nils, and Brian Hackett reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. CVE-2010-3776 Igor Bukanov reported a memory safety problem that was fixed in Firefox 3.6 only. CVE-2010-3777 Jesse Ruderman reported a crash which affected Firefox 3.5 only. CVE-2010-3778 CVE-2010-3769: Dirk Heinrich reported that on Windows platforms when document.write() was called with a very long string a buffer overflow was caused in line breaking routines attempting to process the string for display. Such cases triggered an invalid read past the end of an array causing a crash which an attacker could potentially use to run arbitrary code on a victim's computer. CVE-2010-3771: Security researcher echo reported that a web page could open a window with an about:blank location and then inject an &lt isindex&gt element into that page which upon submission would redirect to a chrome: document. The effect of this defect was that the original page would wind up with a reference to a chrome-privileged object, the opened window, which could be leveraged for privilege escalation attacks. Mozilla security researcher moz_bug_r_a4 provided proof-of-concept code demonstrating how the above vulnerability could be used to run arbitrary code with chrome privileges. CVE-2010-3772: Security researcher wushi of team509 reported that when a XUL tree had an HTML &lt div&gt element nested inside a &lt treechildren&gt element then code attempting to display content in the XUL tree would incorrectly treat the &lt div&gt element as a parent node to tree content underneath it resulting in incorrect indexes being calculated for the child content. These incorrect indexes were used in subsequent array operations which resulted in writing data past the end of an allocated buffer. An attacker could use this issue to crash a victim's browser and run arbitrary code on their machine. CVE-2010-3768: Mozilla ... Description truncated, for more information please check the Reference URL

MozillaFirefox,MozillaThunderbird,Seamonkey on openSUSE 11.1, openSUSE 11.2, openSUSE 11.3

• http://www.novell.com/linux/security/advisories/2011_03_firefox.html

---

Updated on 2015-03-25