remote code execution

Please Install the Updated Packages.

The Mozilla Firefox packages were brought to security update version 2.0.0.10 for SUSE Linux Enterprise 10, SUSE Linux 10.0, 10.1 and openSUSE 10.2 and 10.3. These packages include the Canvas regression fix also fixed in 2.0.0.11, so we are effectively at 2.0.0.11 with our packages. Mozilla Firefox for Novell Linux Desktop 9 is still being prepared, same for Mozilla Thunderbird 2.0.0.9 and Mozilla and Seamonkey Suite packages. The update was released on 29th of November. Following security problems were fixed: CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks.

MozillaFirefox on SUSE LINUX 10.1, openSUSE 10.2, openSUSE 10.3, SUSE Linux Enterprise Desktop 10 SP1, SUSE Linux Enterprise Server 10 SP1

• http://www.novell.com/linux/security/advisories/2007_66_firefox.html

---

Updated on 2015-03-25