Vulnerabilities > CVE-2009-3378 - Remote Memory Corruption vulnerability in Mozilla Firefox 3.5.1/3.5.2/3.5.3
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The oggplay_data_handle_theora_frame function in media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a crafted .ogg video file.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1530.NASL description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR). A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370) A flaw was found in the way Firefox creates temporary file names for downloaded files. If a local attacker knows the name of a file Firefox is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274) A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file processor. If Firefox loads a malicious PAC file, it could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3372) A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3373) A heap-based buffer overflow flaw was found in the Firefox string to floating point conversion routines. A web page containing malicious JavaScript could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-1563) A flaw was found in the way Firefox handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375) A flaw was found in the way Firefox displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382) For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.15. You can find a link to the Mozilla advisories in the References section of this errata. All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.15, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 42287 published 2009-10-28 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42287 title RHEL 4 / 5 : firefox (RHSA-2009:1530) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-6609.NASL description The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues. The following security issues have been fixed : - Security researcher Paul Stone reported that a user last seen 2020-06-01 modified 2020-06-02 plugin id 49887 published 2010-10-11 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/49887 title SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6609) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1530.NASL description From Red Hat Security Advisory 2009:1530 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR). A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370) A flaw was found in the way Firefox creates temporary file names for downloaded files. If a local attacker knows the name of a file Firefox is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274) A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file processor. If Firefox loads a malicious PAC file, it could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3372) A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3373) A heap-based buffer overflow flaw was found in the Firefox string to floating point conversion routines. A web page containing malicious JavaScript could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-1563) A flaw was found in the way Firefox handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375) A flaw was found in the way Firefox displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382) For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.15. You can find a link to the Mozilla advisories in the References section of this errata. All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.15, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 67948 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67948 title Oracle Linux 4 / 5 : firefox (ELSA-2009-1530) NASL family SuSE Local Security Checks NASL id SUSE_11_MOZILLAFIREFOX-091030.NASL description The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues. The following security issues have been fixed : - Security researcher Paul Stone reported that a user last seen 2020-06-01 modified 2020-06-02 plugin id 42363 published 2009-11-04 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/42363 title SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1488) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-294.NASL description Security issues were identified and fixed in firefox 3.5.x : Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla last seen 2020-06-01 modified 2020-06-02 plugin id 48157 published 2010-07-30 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/48157 title Mandriva Linux Security Advisory : firefox (MDVSA-2009:294) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-6606.NASL description The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues. The following security issues have been fixed : - Security researcher Paul Stone reported that a user last seen 2020-06-01 modified 2020-06-02 plugin id 42365 published 2009-11-04 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42365 title SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6606) NASL family Windows NASL id MOZILLA_FIREFOX_354.NASL description The installed version of Firefox 3.5 is earlier than 3.5.4. Such versions are potentially affected by the following security issues : - It may be possible for a malicious web page to steal form history. (MFSA 2009-52) - By predicting the filename of an already downloaded file in the downloads directory, a local attacker may be able to trick the browser into opening an incorrect file. (MFSA 2009-53) - Recursive creation of JavaScript web-workers could crash the browser or allow execution of arbitrary code on the remote system. (MFSA 2009-54) - Provided the browser is configured to use Proxy Auto-configuration it may be possible for an attacker to crash the browser or execute arbitrary code. (MFSA 2009-55) - Mozilla last seen 2020-06-01 modified 2020-06-02 plugin id 42306 published 2009-10-29 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/42306 title Firefox 3.5.x < 3.5.4 Multiple Vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201301-01.NASL description The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL’s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser’s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 63402 published 2013-01-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63402 title GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1530.NASL description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR). A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370) A flaw was found in the way Firefox creates temporary file names for downloaded files. If a local attacker knows the name of a file Firefox is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274) A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file processor. If Firefox loads a malicious PAC file, it could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3372) A heap-based buffer overflow flaw was found in the Firefox GIF image processor. A malicious GIF image could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3373) A heap-based buffer overflow flaw was found in the Firefox string to floating point conversion routines. A web page containing malicious JavaScript could crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-1563) A flaw was found in the way Firefox handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375) A flaw was found in the way Firefox displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382) For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.15. You can find a link to the Mozilla advisories in the References section of this errata. All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.15, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 42295 published 2009-10-29 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42295 title CentOS 4 : firefox (CESA-2009:1530) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_C87AA2D2C3C411DEAB08000F20797EDE.NASL description Mozilla Foundation reports : MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15) MFSA 2009-63 Upgrade media libraries to fix memory safety bugs MFSA 2009-62 Download filename spoofing with RTL override MFSA 2009-61 Cross-origin data theft through document.getSelection() MFSA 2009-59 Heap buffer overflow in string to number conversion MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS() MFSA 2009-56 Heap buffer overflow in GIF color map parser MFSA 2009-55 Crash in proxy auto-configuration regexp parsing MFSA 2009-54 Crash with recursive web-worker calls MFSA 2009-53 Local downloaded file tampering MFSA 2009-52 Form history vulnerable to stealing last seen 2020-06-01 modified 2020-06-02 plugin id 42298 published 2009-10-29 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42298 title FreeBSD : mozilla -- multiple vulnerabilities (c87aa2d2-c3c4-11de-ab08-000f20797ede)
Oval
| accepted | 2014-10-06T04:04:12.303-04:00 | ||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||
| description | The oggplay_data_handle_theora_frame function in media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a crafted .ogg video file. | ||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:6443 | ||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||
| submitted | 2009-11-04T12:10:11 | ||||||||||||||||||||||||
| title | The oggplay_data_handle_theora_frame in liboggplay in Mozilla Firefox 3.5.x before 3.5.4 to cuase denial of service | ||||||||||||||||||||||||
| version | 24 |
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 36872,36871,36870,36866,36869,36873,36875 CVE ID: CVE-2009-3377,CVE-2009-3378,CVE-2009-3379,CVE-2009-3380,CVE-2009-3381,CVE-2009-3382,CVE-2009-3383 Firefox是一款流行的开源WEB浏览器。 Firefox所使用的liboggz、libvorbis和liboggplay媒体渲染库及浏览器引擎、JavaScript引擎中存在多个内存破坏漏洞。如果用户受骗打开了恶意网页或媒体文件链接的话，就可以触发这些漏洞，导致浏览器崩溃或执行任意代码。 Mozilla Firefox 3.5.x Mozilla Firefox 3.0.x Mozilla SeaMonkey 1.1.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1922-1）以及相应补丁: DSA-1922-1：New xulrunner packages fix several vulnerabilities 链接：http://www.debian.org/security/2009/dsa-1922 补丁下载： Source archives: http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.15-0lenny1.diff.gz Size/MD5 checksum: 116164 3d995b59ffe890d36117f3103f38b9b1 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.15-0lenny1.dsc Size/MD5 checksum: 1779 7e8392a8b59ef9064df564ee03c23b14 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.15.orig.tar.gz Size/MD5 checksum: 44085950 49aa2aee64997f9e802cf386d038d2d7 Architecture independent packages: http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.15-0lenny1_all.deb Size/MD5 checksum: 1464278 ea66718b41a4c282284d37672d0e7078 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 9494314 8cd7366b90d39c5c64064d1fb17c1022 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 938304 bf39af51a378ed039c545730664857aa http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 221588 1dd219c2812ca8d23fff415c9555d3db http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 432182 5d32bfa9665c32fb1738f416f739b3ae http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 3651374 14dd5f555695db43b94ceab3260c680d http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 51089582 fa7f8faad8460d1049e9fb8f6fd1f7bb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 163912 d488634f9d36f6d0afcc7b27ee6699a0 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 112022 9666fd74cd00bc0643993acc22d40c91 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_alpha.deb Size/MD5 checksum: 71980 602c6780c2328141871f5d94b8a163f4 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 69898 c0295f0b7e6957f236d769dc8bdfd2ca http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 890260 2d4cb08b3e886e06be04ec7e43a82b0f http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 151952 3e20640a2f4eb68a58731bba532aedb0 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 50327552 5779e5efb1f7b6612bf8a774a8e8cd6a http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 374218 86b4b4a30f5f30f4492fe11eca93dace http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 3287960 741031dbbba1f6c6e8fe045d71547905 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 222992 3e801bb57c442128512e599af5c9547e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 7722556 cc9b8e7ac989143255cb6ad53ce84884 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_amd64.deb Size/MD5 checksum: 101512 396f03e0770dd73cf5820354a8b94a0f armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 223358 a881797fcf62521c0ab538e72b33bb70 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 84272 1602bc59310724ee0f20d8f5a0ac0a8c http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 821892 79baa048d939ac77273ac50237c7bfe3 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 69726 cd5970b1776e5777686ce9208c074e79 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 6954730 a8a092eab78826ef9ed0e98e8d7251bb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 141248 47668db41fd86750793bae3f59ff623e http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 352870 99357abd251ccfe354b28ed441256eb4 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 50116888 a19877e49d8d1037458d2531873181e0 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_armel.deb Size/MD5 checksum: 3579420 9091ebebb2d0b23a8f10300ff7340c16 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 105902 14573c4144b48dfcdeadca11dbf28fd1 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 412252 703d501036427f18e6ffc3841c0434e7 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 158830 9c6c95e2c55a59adaa4314022adaba97 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 9512434 b479cbca6e9244681e8acf58afba706e http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 51210900 7b5ae111a77a354adadb9a019892970b http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 3621952 4a3cef66aa1b240f42c4c4c4de41ca64 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 222858 1f6d47dc993cbc9a068517a06492beb9 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 898430 c63b30f2604b2a08d9fed108253b6b5b http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_hppa.deb Size/MD5 checksum: 71384 50c3026bc0d90b912e74c0892ac3cd8c i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 851844 28f3d2c286d83a90df609b21699baf97 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 79142 61aff31316b603d03921eb89b5df073b http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 3565362 fd8674b08b704e5f0f9ef790da65b7f8 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 141410 0182fcff2acf3987fa15128659fe7b38 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 6602586 03aed73b528a0e36cef99361ae9da656 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 49492306 82d2789b64cedcbf2406a09131032764 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 223182 1872e9d86b45cb1b29f20c4d75467200 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 350814 4e647513b860210f0c1bc1caef893e9f http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_i386.deb Size/MD5 checksum: 68094 f9e97cd83f976afa8959ea9f774f1994 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 223134 2ae79c69711959cb6cd75026882abd60 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 542104 a8b314bf8ad3c48e1ab4ed231b83a450 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 121518 18ec63c6f78623b2c744d9362d4b2be6 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 76492 22f1645790b9540cc1a3b795573b3e46 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 49667940 d01b4ee9da9f802eb24749992dd14be2 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 180184 b26234c2f0d54a61e771ee478828c628 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 11301676 95599d73eb33ae7e9613d92304b8d813 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 811176 33ceb8965e9db8d79020777ab55e1838 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_ia64.deb Size/MD5 checksum: 3397550 7eff41c031481161dfab1bc83cfa8450 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 49965510 8997b286648f39786e86826b5045e69d http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 223146 2bdf56823a2075c6bbd4fe3fc2e0646c http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 7375092 29d842979cbc5ee6ad659cf13927788b http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 96764 5fa81a5541ae261f0a72b91bb5bf6626 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 144986 d3da343322c085f952511248e3a69345 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 900210 b87e5f91341b390cb2f1603a1071aff7 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 3308536 7c5f7065d8961c7fc0ca7fb974e6611c http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 69836 ace8648bf416d4804db9644c487dcdf1 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_mipsel.deb Size/MD5 checksum: 378586 18fd2ced744197472973e2cae61d4d64 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 362482 a0bf9d0ba7a4695378f7ea053cd9cc46 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 3283604 b98767e9b18704a2482c731309eef892 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 51378802 bed95771a8d00f88bedc12d480ed91f0 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 94786 fb7b21596585931a6edda7e2bebae561 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 152276 d83cf113d2600c6ca9e691dfd25a1466 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 7275222 008f00164ecbc43c681f1743ba33c0e8 http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 72990 2982ec8818b1ae7b47241dcdb046c8e0 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 887776 9853592dc50b738bd7b223fc78c030c3 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_powerpc.deb Size/MD5 checksum: 223140 96d915d392dbb2cdc3a09268d97a206f s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 3306276 95d049eaa0c2b95b8f98f2295d984454 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 406680 9efe79857bd5fc05bf567f4840109135 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 223124 ee4ed0dc817d276cbe22bcb5ef6314af http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 51172466 33aeec198869e5b92132775938f1dba6 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 8387566 5cf074573a634121d0981d927bdf8dc5 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 105540 ad95c071cf5d0f16301e004800626ab6 http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 156084 69c04262268e1b13ffac80f8827e5776 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 909030 9d9a82bbaa3501f41dd810c3bf3e7b0b http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_s390.deb Size/MD5 checksum: 72868 738b9ff7dafce724b01f032e568d145d sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 143228 8017cc9ebd542b69b5a33328e4db72fd http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 69342 2a626affc178cb0bed8bd8dc0302308b http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 821126 3107a47d82efbaf745b0a7355df82271 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 223230 41277488a9fbf77e3864848e36ad1040 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 7174794 ff98cd42b01c1b6da7f443a8513ec516 http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 350084 53b49c566cc58af0976b24382a144a16 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 88202 d8ed5ea8a627c996c8890521551e14b3 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 49353618 3919a69140cbf1cc726b9142a7f33f23 http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.15-0lenny1_sparc.deb Size/MD5 checksum: 3577270 0709623512ba6d57f6a475f8382b20a2 补丁安装方法： 1. 手工安装补丁包： 首先，使用下面的命令来下载补丁软件： # wget url (url是补丁下载链接地址) 然后，使用下面的命令来安装补丁： # dpkg -i file.deb (file是相应的补丁名) 2. 使用apt-get自动安装补丁包： 首先，使用下面的命令更新内部数据库： # apt-get update 然后，使用下面的命令安装更新软件包： # apt-get upgrade Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/ RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2009:1530-01）以及相应补丁: RHSA-2009:1530-01：Critical: firefox security update 链接：https://www.redhat.com/support/errata/RHSA-2009-1530.html |
| id | SSV:12570 |
| last seen | 2017-11-19 |
| modified | 2009-11-03 |
| published | 2009-11-03 |
| reporter | Root |
| source | https://www.seebug.org/vuldb/ssvid-12570 |
| title | Mozilla Firefox多个内存破坏漏洞 |
References
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:294
- http://www.mozilla.org/security/announce/2009/mfsa2009-63.html
- http://www.vupen.com/english/advisories/2009/3334
- https://bugzilla.mozilla.org/show_bug.cgi?id=500311
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6443