Vulnerabilities > CVE-2009-1696 - Cryptographic Issues vulnerability in Apple Safari

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
apple
CWE-310
nessus
NVD
Published: 2009-06-10
Updated: 2024-11-21

Summary

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session.

Vulnerable Configurations

Part Description Count
Application
Apple
50

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

  • NASL familyWindows
    NASL idSAFARI_4.0.NASL
    descriptionThe version of Safari installed on the remote Windows host is earlier than 4.0. It therefore is potentially affected by numerous issues in the following components : - CFNetwork - CoreGraphics - ImageIO - International Components for Unicode - libxml - Safari - Safari Windows Installer - WebKit
    last seen2020-06-01
    modified2020-06-02
    plugin id39339
    published2009-06-09
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39339
    titleSafari < 4.0 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(39339);
  script_version("1.30");
  script_cvs_date("Date: 2018/07/27 18:38:15");

  script_cve_id("CVE-2006-2783", "CVE-2008-1588", "CVE-2008-2320", "CVE-2008-2321",
                "CVE-2008-3281", "CVE-2008-3529", "CVE-2008-3632", "CVE-2008-4225",
                "CVE-2008-4226", "CVE-2008-4231", "CVE-2008-4409", "CVE-2009-0040",
                "CVE-2009-0145", "CVE-2009-0153", "CVE-2009-0946", "CVE-2009-1179",
                "CVE-2009-1681", "CVE-2009-1682", "CVE-2009-1684", "CVE-2009-1685",
                "CVE-2009-1686", "CVE-2009-1687", "CVE-2009-1688", "CVE-2009-1689",
                "CVE-2009-1690", "CVE-2009-1691", "CVE-2009-1693", "CVE-2009-1694",
                "CVE-2009-1695", "CVE-2009-1696", "CVE-2009-1697", "CVE-2009-1698",
                "CVE-2009-1699", "CVE-2009-1700", "CVE-2009-1701", "CVE-2009-1702",
                "CVE-2009-1703", "CVE-2009-1704", "CVE-2009-1705", "CVE-2009-1706",
                "CVE-2009-1707", "CVE-2009-1708", "CVE-2009-1709", "CVE-2009-1710",
                "CVE-2009-1711", "CVE-2009-1712", "CVE-2009-1713", "CVE-2009-1714",
                "CVE-2009-1715", "CVE-2009-1716", "CVE-2009-1718", "CVE-2009-2027",
                "CVE-2009-2420", "CVE-2009-2421");
  script_bugtraq_id(30487, 31092, 32326, 33276, 35260, 35270, 35271, 35272, 35283,
                    35284, 35308, 35309, 35310, 35311, 35315, 35317, 35318, 35319,
                    35320, 35321, 35322, 35325, 35327, 35328, 35330, 35331, 35332,
                    35333, 35334, 35339, 35340, 35344, 35346, 35347, 35348, 35349,
                    35350, 35351, 35352, 35353, 35481, 35482);

  script_name(english:"Safari < 4.0 Multiple Vulnerabilities");
  script_summary(english:"Checks Safari's version number");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web browser that is affected by several
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Safari installed on the remote Windows host is earlier
than 4.0.  It therefore is potentially affected by numerous issues in
the following components :

  - CFNetwork
  - CoreGraphics
  - ImageIO
  - International Components for Unicode
  - libxml
  - Safari
  - Safari Windows Installer
  - WebKit");
  script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT3613");
  script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2009/Jun/msg00002.html");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/17079");
  script_set_attribute(attribute:"solution", value:"Upgrade to Safari 4.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(20, 79, 94, 119, 189, 200, 255, 264, 310, 362, 399);

  script_set_attribute(attribute:"plugin_publication_date", value:"2009/06/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:safari");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("safari_installed.nasl");
  script_require_keys("SMB/Safari/FileVersion");

  exit(0);
}


include("global_settings.inc");


path = get_kb_item("SMB/Safari/Path");
version = get_kb_item("SMB/Safari/FileVersion");
if (isnull(version)) exit(0);

ver = split(version, sep:'.', keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

if (
  ver[0] < 4 ||
  (
    ver[0] == 4 &&
    (
      ver[1] < 530 ||
      (ver[1] == 530 && ver[2] < 17)
    )
  )
)
{
  if (report_verbosity > 0)
  {
    if (isnull(path)) path = "n/a";

    prod_version = get_kb_item("SMB/Safari/ProductVersion");
    if (!isnull(prod_version)) version = prod_version;

    report = string(
      "\n",
      "Nessus collected the following information about the current install\n",
      "of Safari on the remote host :\n",
      "\n",
      "  Version : ", version, "\n",
      "  Path    : ", path, "\n"
    );
    security_hole(port:get_kb_item("SMB/transport"), extra:report);
  }
  else security_hole(get_kb_item("SMB/transport"));
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_LIBWEBKIT-110111.NASL
    descriptionVarious bugs in webkit have been fixed. The CVE id
    last seen2020-06-01
    modified2020-06-02
    plugin id53764
    published2011-05-05
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/53764
    titleopenSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update libwebkit-3787.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(53764);
  script_version("1.8");
  script_cvs_date("Date: 2019/10/25 13:36:41");

  script_cve_id("CVE-2009-0945", "CVE-2009-1681", "CVE-2009-1684", "CVE-2009-1685", "CVE-2009-1686", "CVE-2009-1687", "CVE-2009-1688", "CVE-2009-1689", "CVE-2009-1690", "CVE-2009-1691", "CVE-2009-1692", "CVE-2009-1693", "CVE-2009-1694", "CVE-2009-1695", "CVE-2009-1696", "CVE-2009-1697", "CVE-2009-1698", "CVE-2009-1699", "CVE-2009-1700", "CVE-2009-1701", "CVE-2009-1702", "CVE-2009-1703", "CVE-2009-1709", "CVE-2009-1710", "CVE-2009-1711", "CVE-2009-1712", "CVE-2009-1713", "CVE-2009-1714", "CVE-2009-1715", "CVE-2009-1718", "CVE-2009-1724", "CVE-2009-1725", "CVE-2009-2195", "CVE-2009-2199", "CVE-2009-2200", "CVE-2009-2419", "CVE-2009-2797", "CVE-2009-2816", "CVE-2009-2841", "CVE-2009-3272", "CVE-2009-3384", "CVE-2009-3933", "CVE-2009-3934", "CVE-2010-0046", "CVE-2010-0047", "CVE-2010-0048", "CVE-2010-0049", "CVE-2010-0050", "CVE-2010-0051", "CVE-2010-0052", "CVE-2010-0053", "CVE-2010-0054", "CVE-2010-0315", "CVE-2010-0647", "CVE-2010-0650", "CVE-2010-0651", "CVE-2010-0656", "CVE-2010-0659", "CVE-2010-0661", "CVE-2010-1029", "CVE-2010-1126", "CVE-2010-1233", "CVE-2010-1236", "CVE-2010-1386", "CVE-2010-1387", "CVE-2010-1388", "CVE-2010-1389", "CVE-2010-1390", "CVE-2010-1391", "CVE-2010-1392", "CVE-2010-1393", "CVE-2010-1394", "CVE-2010-1395", "CVE-2010-1396", "CVE-2010-1397", "CVE-2010-1398", "CVE-2010-1399", "CVE-2010-1400", "CVE-2010-1401", "CVE-2010-1402", "CVE-2010-1403", "CVE-2010-1404", "CVE-2010-1405", "CVE-2010-1406", "CVE-2010-1407", "CVE-2010-1408", "CVE-2010-1409", "CVE-2010-1410", "CVE-2010-1412", "CVE-2010-1413", "CVE-2010-1414", "CVE-2010-1415", "CVE-2010-1416", "CVE-2010-1417", "CVE-2010-1418", "CVE-2010-1419", "CVE-2010-1421", "CVE-2010-1422", "CVE-2010-1729", "CVE-2010-1749", "CVE-2010-1757", "CVE-2010-1758", "CVE-2010-1759", "CVE-2010-1760", "CVE-2010-1761", "CVE-2010-1762", "CVE-2010-1763", "CVE-2010-1764", "CVE-2010-1766", "CVE-2010-1767", "CVE-2010-1769", "CVE-2010-1770", "CVE-2010-1771", "CVE-2010-1772", "CVE-2010-1773", "CVE-2010-1774", "CVE-2010-1780", "CVE-2010-1781", "CVE-2010-1782", "CVE-2010-1783", "CVE-2010-1784", "CVE-2010-1785", "CVE-2010-1786", "CVE-2010-1787", "CVE-2010-1788", "CVE-2010-1789", "CVE-2010-1790", "CVE-2010-1791", "CVE-2010-1792", "CVE-2010-1793", "CVE-2010-1807", "CVE-2010-1812", "CVE-2010-1813", "CVE-2010-1814", "CVE-2010-1815", "CVE-2010-1822", "CVE-2010-1823", "CVE-2010-1824", "CVE-2010-1825", "CVE-2010-2264", "CVE-2010-2295", "CVE-2010-2297", "CVE-2010-2300", "CVE-2010-2301", "CVE-2010-2302", "CVE-2010-2441", "CVE-2010-3116", "CVE-2010-3257", "CVE-2010-3259", "CVE-2010-3312", "CVE-2010-3803", "CVE-2010-3804", "CVE-2010-3805", "CVE-2010-3808", "CVE-2010-3809", "CVE-2010-3810", "CVE-2010-3811", "CVE-2010-3812", "CVE-2010-3813", "CVE-2010-3816", "CVE-2010-3817", "CVE-2010-3818", "CVE-2010-3819", "CVE-2010-3820", "CVE-2010-3821", "CVE-2010-3822", "CVE-2010-3823", "CVE-2010-3824", "CVE-2010-3826", "CVE-2010-3829", "CVE-2010-3900");

  script_name(english:"openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)");
  script_summary(english:"Check for the libwebkit-3787 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685,
CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689,
CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693,
CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697,
CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701,
CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710,
CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714,
CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725,
CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419,
CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272,
CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046,
CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050,
CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315,
CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651,
CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029,
CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386,
CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390,
CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394,
CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398,
CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402,
CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406,
CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410,
CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415,
CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419,
CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749,
CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760,
CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764,
CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770,
CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774,
CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783,
CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787,
CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791,
CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812,
CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822,
CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264,
CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301,
CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257,
CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804,
CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810,
CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816,
CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820,
CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824,
CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=601349"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2011-01/msg00013.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected libwebkit packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(20, 79, 94, 119, 189, 200, 264, 310, 352, 399);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libwebkit-1_0-2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libwebkit-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libwebkit-lang");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:webkit-jsc");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/05/05");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.2", reference:"libwebkit-1_0-2-1.2.6-0.5.1") ) flag++;
if ( rpm_check(release:"SUSE11.2", reference:"libwebkit-devel-1.2.6-0.5.1") ) flag++;
if ( rpm_check(release:"SUSE11.2", reference:"libwebkit-lang-1.2.6-0.5.1") ) flag++;
if ( rpm_check(release:"SUSE11.2", reference:"webkit-jsc-1.2.6-0.5.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libwebkit-1_0-2 / libwebkit-devel / libwebkit-lang / webkit-jsc");
}
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SAFARI4_0.NASL
    descriptionThe version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0. As such, it is potentially affected by numerous issues in the following components : - CFNetwork - libxml - Safari - WebKit
    last seen2020-06-01
    modified2020-06-02
    plugin id39338
    published2009-06-09
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39338
    titleMac OS X : Apple Safari < 4.0
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_LIBWEBKIT-110104.NASL
    descriptionVarious bugs in webkit have been fixed. The CVE id
    last seen2020-06-01
    modified2020-06-02
    plugin id75629
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75629
    titleopenSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)

Seebug

  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 35260 CVE(CAN) ID: CVE-2009-1718,CVE-2009-1715,CVE-2009-1714,CVE-2009-1713,CVE-2009-1712,CVE-2009-1711,CVE-2009-1710,CVE-2009-1709,CVE-2009-1703,CVE-2009-1702,CVE-2009-1701,CVE-2009-1700,CVE-2009-1699,CVE-2009-1698,CVE-2009-1697,CVE-2009-1696,CVE-2009-1695,CVE-2009-1694,CVE-2009-1693,CVE-2009-1691,CVE-2009-1690,CVE-2009-1689,CVE-2009-1688,CVE-2009-1687,CVE-2009-1686,CVE-2009-1685,CVE-2009-1684,CVE-2009-1681,CVE-2009-1708,CVE-2009-1707,CVE-2009-1706,CVE-2009-1682,CVE-2009-1705,CVE-2009-1716,CVE-2009-1704 Safari是苹果家族机器操作系统中默认捆绑的WEB浏览器。 远程攻击者可以利用Safari浏览器中的多个内存破坏和设计错误导致拒绝服务、执行任意代码或执行网络钓鱼攻击。 CVE-2009-1704 safe类型的文件在下载后未经警告用户便会由Safari显示。Safari中的漏洞可能导致无法确认某些本地图形文件的文件类型。在这种情况下，Safari会检查这些文件的内容并可能将其处理为HTML。如果文件包含有JavaScript，就会在本地安全环境中执行。对于下载的文件，不应未经提示用户便执行。 CVE-2009-1716 CFNetwork在下载时以不安全方式创建临时文件，本地用户可以在下载时访问其他用户的文件，导致泄漏敏感信息。 CVE-2009-1705 处理TrueType字体时存在内存破坏漏洞，自动提示字体时的算术错误可能触发内存破坏。 CVE-2009-1682 Safari处理EV证书时的错误可能导致绕过撤销检查，这可能允许未经发布已撤销EV证书警告便加载页面。 CVE-2009-1706 Safari的Private Browsing功能允许用户在进行浏览时不在磁盘上留下浏览器会话的证据。该功能中的实现漏洞可能导致在保密浏览结束后在磁盘上留下Cookie，意外泄漏敏感信息。 CVE-2009-1707 在“重置Safari...”菜单选项中点击了“重置保存的名称和口令”的“重置”键后，Safari可能需要30秒钟才能清除口令。在这个时间窗口访问了系统的用户可以访问储存的凭据。 CVE-2009-1708 Safari的open-help-anchor URL处理器可能允许恶意网站打开本地帮助文件，导致泄漏敏感信息或执行任意代码。 CVE-2009-1681 用于限制网站间交互的同源策略机制中存在设计问题，该策略允许网站将第三方网站的网页加载到子帧，这个帧可能导致点击劫持攻击。 CVE-2009-1684 JavaScript环境隔离中存在跨站脚本漏洞，恶意网页可能使用事件处理器在其窗口或帧所加载的下一个网页的安全环境中执行脚本。 CVE-2009-1685 JavaScript环境隔离中存在跨站脚本漏洞，用户受骗访问了恶意站点就会导致覆盖不同安全区所提供的嵌入式或父文档的document.implementation。 CVE-2009-1686 WebKit的JavaScript异常处理中存在类型转换问题。在尝试对声明为常量的变量分配异常时，对象会被赋值为无效类型，导致内存破坏。 CVE-2009-1687 WebKit的JavaScript垃圾收集器中存在内存破坏。如果分配失败，可能出现对空指针偏移的写操作，导致应用程序意外终止或执行任意代码。 CVE-2009-1688 WebKit没有使用HTML 5标准方法确定指定脚本相关的安全环境，WebKit方法中的实现问题在某些条件下可能导致跨站脚本攻击。 CVE-2009-1689 WebKit中存在跨站脚本漏洞，包含有提交给about:blank表单的恶意网站可以同步替换文档的安全环境，导致在新的安全环境中运行正在执行的脚本。 CVE-2009-1690 WebKit处理某些DOM事件处理器中的递归时存在内存破坏，访问恶意网站可能导致应用程序意外终止或执行任意代码。 CVE-2009-1691 Safari中的跨站脚本漏洞允许恶意网站更改不同域所提供网站的标准JavaScript原型。如果用户受骗访问了恶意网页，攻击者就可以更改其他网站所提供的 JavaScript的执行。 CVE-2009-1693 WebKit中存在跨站图形抓取漏洞，恶意网站可以使用带有SVG图形的画布加载并抓取其他网站的图形。 CVE-2009-1694 WebKit中存在跨站图形抓取漏洞，恶意网站可以使用画布和重新定向加载并抓取其他网站的图形。 CVE-2009-1695 WebKit允许HTML文档在页面过渡之后访问帧的内容，这可能允许恶意网站执行跨站脚本攻击。 CVE-2009-1696 Safari使用可预测的算法为JavaScript应用生成随机数，这可能允许网站无需使用cookie、隐藏表单元素、IP地址等技术便可追踪特定的Safari会话。 CVE-2009-1697 在处理WebKit的XMLHttpRequest头时存在CRLF注入漏洞，可能允许恶意网站通过发布缺少Host头的XMLHttpRequest绕过同源策略。缺少Host头的XMLHttpRequest可能到达同一服务 器上的其他网站，允许攻击者所提供的JavaScript与这些网站交互。 CVE-2009-1698 处理CSS attr函数时存在未初始化的指针漏洞，查看恶意网页可能导致应用程序意外终止或执行任意代码。 CVE-2009-1699 WebKit处理XML时存在XML外部实体漏洞，恶意汪涵可以从用户系统读取文件。 CVE-2009-1700 WebKit在处理XSLT时没有正确的处理重新定向，这可能允许恶意网站从其他网站的页面检索XML内容，导致泄漏敏感信息。 CVE-2009-1701 WebKit处理JavaScript DOM时存在释放后使用漏洞，访问恶意网站可能导致应用程序意外终止或执行任意代码。 CVE-2009-1702 WebKit处理位置和历史对象时存在漏洞，访问恶意网站可能导致跨站脚本攻击。 CVE-2009-1703 WebKit处理音频和视频HTML元素可能允许远程网站引用本地file: URL，恶意网站可以检查文件是否存在。 CVE-2009-1709 WebKit处理SVG动画元素时存在释放后使用漏洞，访问恶意站点可能导致应用程序意外终止或执行任意代码。 CVE-2009-1710 恶意网站可以通过指定很大的几乎透明的自定义光标并调整CSS3热点属性来伪造浏览器UI元素，如主机名和安全指示符。 CVE-2009-1711 WebKit处理Attr DOM对象时存在未初始化内存访问漏洞，访问恶意站点可能导致应用程序意外终止或执行任意代码。 CVE-2009-1712 WebKit允许远程网站加载本地系统的Java applet。本地applet不应远程加载，可能允许远程站点执行任意代码或许可非预期的权限。 CVE-2009-1713 WebKit在实现XSLT文档中所使用的document()函数时存在信息泄露漏洞，恶意站点可以读取其他安全区中的文件。 CVE-2009-1714 Web Inspector中的漏洞允许正在检查的页面以提升的权限运行注入的脚本，包括读取用户的文件系统。 CVE-2009-1715 Web Inspector中的漏洞允许正在检查的页面以提升的权限运行注入的脚本，包括读取用户的文件系统。 CVE-2009-1718 WebKit处理拖放事件中的漏洞可能导致在从恶意网页拖放内容时泄露敏感信息。 Apple Safari &lt; 4.0 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href="http://www.apple.com/safari/download/" target="_blank" rel=external nofollow>http://www.apple.com/safari/download/</a>
    idSSV:11574
    last seen2017-11-19
    modified2009-06-11
    published2009-06-11
    reporterRoot
    titleApple Safari 4.0多个安全漏洞
  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 33276 CVE ID: CVE-2009-1696,CVE-2008-5913 Firefox是非常流行的开源WEB浏览器。 Firefox的JavaScript实现的Math.random()函数中存在安全漏洞，攻击者可以对该函数的种子值进行逆向。由于对于每个浏览的会话伪随机数生成器仅提供了一次种子，因此可以将这个种子值用作唯一的令牌跨不同的网站识别和追踪用户。 Mozilla Firefox 3.6.x Mozilla Firefox 3.5.x Mozilla SeaMonkey &lt; 2.0.5 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-2064-1）以及相应补丁: DSA-2064-1：New xulrunner packages fix several vulnerabilities 链接：http://www.debian.org/security/2010/dsa-2064 补丁下载： Source archives: http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19.orig.tar.gz Size/MD5 checksum: 44174623 83667df1e46399960593fdd8832e958e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19-2.dsc Size/MD5 checksum: 1755 417c6652438319f99497be2d751a8173 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19-2.diff.gz Size/MD5 checksum: 131694 adaff492562749fc0deb0b3a9aa98a6a Architecture independent packages: http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.19-2_all.deb Size/MD5 checksum: 1465474 9147fba7fd01e7692ce317eee6df74ed alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_alpha.deb Size/MD5 checksum: 9484704 ccb788e476329f5d8601ac46c3324402 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_alpha.deb Size/MD5 checksum: 223352 d935848a008a633456abab7eb6408673 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_alpha.deb Size/MD5 checksum: 433056 9b05559c9e7dceaa71e7470419ccd2ef http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_alpha.deb Size/MD5 checksum: 940244 309d3d7cc8e1551081ec0249656d2ce9 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_alpha.deb Size/MD5 checksum: 165414 2672110161283eec4d2cb9b1b7bd245b http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_alpha.deb Size/MD5 checksum: 113404 b58e8e0c45c434df5e96e821bb17aedc http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_alpha.deb Size/MD5 checksum: 51139568 b363f55880ffd0b827379edbb3f0602b http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_alpha.deb Size/MD5 checksum: 72496 637eb8ed29c6ebb843151c7628f66869 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_alpha.deb Size/MD5 checksum: 3356878 63c85461418061e8987bacfc76caf62f amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_amd64.deb Size/MD5 checksum: 890602 00af69b2dffb6d7a61e18efc0b226b74 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_amd64.deb Size/MD5 checksum: 7732578 58fc9b422b09d3faa026bc95ed065edb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_amd64.deb Size/MD5 checksum: 152220 d675895b72aa8e6bbf35d2c5c09849d3 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_amd64.deb Size/MD5 checksum: 101778 60ab2e8035019d73c6f3b1363c52d597 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_amd64.deb Size/MD5 checksum: 374562 c2d65837de4ab1793033fcb604c57f64 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_amd64.deb Size/MD5 checksum: 70170 088bba00712801bf522dbb2e1b81d031 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_amd64.deb Size/MD5 checksum: 3290310 0684b22dad0402705db3850a4572eb55 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_amd64.deb Size/MD5 checksum: 223252 983d0009fcb3aff8ab0e61acda30e73e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_amd64.deb Size/MD5 checksum: 50368084 449665d4b1348ee262b09aa01c10ca2f arm architecture (ARM) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_arm.deb Size/MD5 checksum: 84154 c38cf0e79bc8fc7b4459dba239e0f633 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_arm.deb Size/MD5 checksum: 6799136 6b0eb2cbcab63d0c4a2dcbd77ca5de12 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_arm.deb Size/MD5 checksum: 222308 052db8a2b1ff4954054146106173c39e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_arm.deb Size/MD5 checksum: 49322578 56c89f3d0c6a6d3317a371a2add64129 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_arm.deb Size/MD5 checksum: 815382 6a48ade57480ab360b4d8308538c753a http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_arm.deb Size/MD5 checksum: 68488 7d1cd5f9ef7b884d1bfe0a0ad96e62a3 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_arm.deb Size/MD5 checksum: 140892 3630b02fa23def97a0393bcb4edf9c28 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_arm.deb Size/MD5 checksum: 3583726 3f43328bfefd3dc1ec3790cacf7b4c4c http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_arm.deb Size/MD5 checksum: 350918 3c294e0a24835cc97a727bcbf8f0e247 armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_armel.deb Size/MD5 checksum: 69978 937428415481c1976e599b338562bcf5 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_armel.deb Size/MD5 checksum: 223614 8fd71a0c2ea76fa0d22ee7217709e658 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_armel.deb Size/MD5 checksum: 6958220 96188e513073e23576641f76f8122577 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_armel.deb Size/MD5 checksum: 3581070 b74bbbe6b208b96ed6cb8a29255df522 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_armel.deb Size/MD5 checksum: 822336 acd000d0d058940363e086b0bf74ca89 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_armel.deb Size/MD5 checksum: 50161620 0d52664ef75395be9c4c303d6e01c75d http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_armel.deb Size/MD5 checksum: 141432 8374f4999c95a85af32373e6454e4556 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_armel.deb Size/MD5 checksum: 353252 d2fef0d7e42e071da38500952bac25a0 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_armel.deb Size/MD5 checksum: 84468 e88ffba8ed74f94a4e857cf92c4990fe hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_hppa.deb Size/MD5 checksum: 51253494 494d60aef7e2d7860e0a300907c3bf8d http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_hppa.deb Size/MD5 checksum: 106944 6091943971bec65a5aa53583b15090c3 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_hppa.deb Size/MD5 checksum: 413270 05e1bc9367c11dbff9733d0f7c8dbb2c http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_hppa.deb Size/MD5 checksum: 223546 26946f1a97c1323c522cf4f206f15be7 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_hppa.deb Size/MD5 checksum: 158712 a5d03f9c671ca98f97283a077a025a02 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_hppa.deb Size/MD5 checksum: 72230 366cfa2959438258c951e65268a701ea http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_hppa.deb Size/MD5 checksum: 899556 cabb8ccc698d3fd4885583606b901736 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_hppa.deb Size/MD5 checksum: 9517606 e70e8173e428f4e7ac292ec75b6616b1 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_hppa.deb Size/MD5 checksum: 3631282 c0207a8714ba380f339144d7763f978f i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_i386.deb Size/MD5 checksum: 6605590 435fc0a456535eada574d09179cf697e http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_i386.deb Size/MD5 checksum: 68370 a6aff46291d47363210ba869def030c4 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_i386.deb Size/MD5 checksum: 140990 000267e271547d136052f6f51df4922e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_i386.deb Size/MD5 checksum: 3569886 fb82669f63f637bd004652f22323b050 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_i386.deb Size/MD5 checksum: 852136 c073bc6e0a84b8b449f2ac4a6835cfc6 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_i386.deb Size/MD5 checksum: 82772 ca7763ef6791fcf37163b4ffd9a8faab http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_i386.deb Size/MD5 checksum: 351188 778ea8dc4ba55afa057f227bc7040caa http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_i386.deb Size/MD5 checksum: 222150 c75a359f4230c6e731c98b0a637757ee http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_i386.deb Size/MD5 checksum: 49537814 cb1c1548047447465a1fb5b0eeb00374 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_ia64.deb Size/MD5 checksum: 543316 d53f87afd74d7c521b790f932f671078 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_ia64.deb Size/MD5 checksum: 120786 6a400d3187c7dc38584de9f3de429cf6 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_ia64.deb Size/MD5 checksum: 49720446 c2990e1293bbf5d2111f91c8a97ec3ec http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_ia64.deb Size/MD5 checksum: 76478 192e115017a1f3eebc0a8c5c99704f6d http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_ia64.deb Size/MD5 checksum: 179644 41788aab793a0cc10c25c0c107706b0d http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_ia64.deb Size/MD5 checksum: 11307860 f49d046a5aa64d33878feedea7e3ec5d http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_ia64.deb Size/MD5 checksum: 3392470 596baf4e48701811bc77d8d9cdabed55 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_ia64.deb Size/MD5 checksum: 223242 296a200cb10263e6f61e47c4e2cb3a3b http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_ia64.deb Size/MD5 checksum: 810068 54a2ed9c1025cbf453b0be47990d8622 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_mips.deb Size/MD5 checksum: 145350 b58696b904f82ed7fb7237766503743c http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_mips.deb Size/MD5 checksum: 7672140 c11eea29282f7afa80e9f82e7e864052 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_mips.deb Size/MD5 checksum: 51883884 238e6833eaccc9fe353826ec2e2ea70b http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_mips.deb Size/MD5 checksum: 379844 01d3e756d62776e2c01f8871470bee57 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_mips.deb Size/MD5 checksum: 96276 c113eb6863dd2c1bdefe71bf884eb661 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_mips.deb Size/MD5 checksum: 222384 5486230dfa7ae2eab6f8068fa21bf76e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_mips.deb Size/MD5 checksum: 3607762 64fd108d8b6a0aaf6b519d89e7e3a4f2 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_mips.deb Size/MD5 checksum: 69512 b37b38fecb8aa8b86ee8d6cb6ec2f5b4 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_mips.deb Size/MD5 checksum: 918302 dd1004ee4c0c6999d215a39e38d9a4d9 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 96982 183bdcf817805540cdf6015ae0b85a83 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 145246 d845585edb7d3f5c8144f13854fc8606 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 378882 b9d2d689539ed6fc53dc7f44ae6bf54b http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 7382594 09afb7262cf650330c586648ae4c6fd3 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 3310262 f344b5fe156e20fbcd36484a9d993284 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 900882 e68c0075ca23ce8b0986822ef05eb643 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 223348 8319e80747bc288ab3f44db2d04f142e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 50006906 8b794da4ab347acf7565b861bb88b897 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_mipsel.deb Size/MD5 checksum: 70122 58b6f926ff60210626229f470421b62e powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 3592536 7551dfd63a7b43e9a1669da97e5593a9 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 888570 97a2be2273abd565933a3a8d399182f4 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 363526 2f863c8631dbdee8f47cce05cb783fe1 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 51437824 21d72b750e6bb60525e37bbb80cddb24 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 7306516 c87d2e02134a094864f5b855f52d8439 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 152786 890104ba8be602a5f16d4dc338a1c9c0 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 223370 ef8da6ed4bb453367301918aa1c0eb80 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 73574 bb59623bcbb45bd6c898090281ebb50f http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_powerpc.deb Size/MD5 checksum: 94584 0d6e75fc74b64d0034a8375c7ca28eb8 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_s390.deb Size/MD5 checksum: 3607064 40f70e8bbc8c8825a9da4f4eecc7ef83 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_s390.deb Size/MD5 checksum: 8418766 8f4d975d1d06d70ded82311b7b7aaa64 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_s390.deb Size/MD5 checksum: 51216094 db3f0645c964f2978b9dcadaa7377f24 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_s390.deb Size/MD5 checksum: 105648 4d55f5f22ac553181f499d0519788b87 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_s390.deb Size/MD5 checksum: 407360 10f44ee635484dcf058c93a930a9db17 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_s390.deb Size/MD5 checksum: 909424 a659639cb459491110a02f04d1568860 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_s390.deb Size/MD5 checksum: 155384 310aa3e4a80f88deb24adc2143485a09 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_s390.deb Size/MD5 checksum: 223126 a2404446949c11207551549f700297e8 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_s390.deb Size/MD5 checksum: 73426 bf629f49c166ee1241f68578479a00f5 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-2_sparc.deb Size/MD5 checksum: 222506 4b66d7353c58a79af12c706c2791ca4a http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-2_sparc.deb Size/MD5 checksum: 3569724 c70447e9c1d9a34deab3d23f81cfd8b5 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-2_sparc.deb Size/MD5 checksum: 88464 a52b143930867a5e7a5706ee7fb22336 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-2_sparc.deb Size/MD5 checksum: 821862 36bfba9ec0a1fdf8610d78296d9465ac http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-2_sparc.deb Size/MD5 checksum: 143382 bc21e94220ea092643657d387a02d4c8 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-2_sparc.deb Size/MD5 checksum: 350410 d3bd6721ded9caa19c8686a6513f3b22 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-2_sparc.deb Size/MD5 checksum: 69614 b8f344735b818b6ebb90edde9896851f http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-2_sparc.deb Size/MD5 checksum: 49386956 988b0a0395fc50425cf1bf03bda46e2d http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-2_sparc.deb Size/MD5 checksum: 7174040 5fb3f68909ceddba12950c4e0446d17d 补丁安装方法： 1. 手工安装补丁包： 首先，使用下面的命令来下载补丁软件： # wget url (url是补丁下载链接地址) 然后，使用下面的命令来安装补丁： # dpkg -i file.deb (file是相应的补丁名) 2. 使用apt-get自动安装补丁包： 首先，使用下面的命令更新内部数据库： # apt-get update 然后，使用下面的命令安装更新软件包： # apt-get upgrade Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/ RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2010:0500-01）以及相应补丁: RHSA-2010:0500-01：Critical: firefox security, bug fix, and enhancement update 链接：https://www.redhat.com/support/errata/RHSA-2010-0500.html
    idSSV:19872
    last seen2017-11-19
    modified2010-06-28
    published2010-06-28
    reporterRoot
    titleFirefox JavaScript引擎Math.Random()跨域信息泄露漏洞

References