mozilla security update

2006-02-0218:17:59

CentOS Project

lists.centos.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.961

Percentile

99.5%

JSON

CentOS Errata and Security Advisory CESA-2006:0199

Mozilla is an open source Web browser, advanced email and newsgroup client,
IRC chat client, and HTML editor.

Igor Bukanov discovered a bug in the way Mozilla’s Javascript interpreter
dereferences objects. If a user visits a malicious web page, Mozilla could
crash or execute arbitrary code as the user running Mozilla. The Common
Vulnerabilities and Exposures project assigned the name CVE-2006-0292 to
this issue.

moz_bug_r_a4 discovered a bug in Mozilla’s XULDocument.persist() function.
A malicious web page could inject arbitrary RDF data into a user’s
localstore.rdf file, which can cause Mozilla to execute arbitrary
javascript when a user runs Mozilla. (CVE-2006-0296)

A denial of service bug was found in the way Mozilla saves history
information. If a user visits a web page with a very long title, it is
possible Mozilla will crash or take a very long time the next time it is
run. (CVE-2005-4134)

Note that the Red Hat Enterprise Linux 3 packages also fix a bug when
using XSLT to transform documents. Passing DOM Nodes as parameters to
functions expecting an xsl:param could cause Mozilla to throw an exception.

Users of Mozilla are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Affected packages:
mozilla
mozilla-chat
mozilla-devel
mozilla-dom-inspector
mozilla-js-debugger
mozilla-mail
mozilla-nspr
mozilla-nspr-devel
mozilla-nss
mozilla-nss-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2006:0199

OSVersionArchitecturePackageVersionFilename
CentOS3ia64mozilla< 1.7.12-1.1.3.4.centos3mozilla-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-chat< 1.7.12-1.1.3.4.centos3mozilla-chat-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-devel< 1.7.12-1.1.3.4.centos3mozilla-devel-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-dom-inspector< 1.7.12-1.1.3.4.centos3mozilla-dom-inspector-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-js-debugger< 1.7.12-1.1.3.4.centos3mozilla-js-debugger-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-mail< 1.7.12-1.1.3.4.centos3mozilla-mail-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-nspr< 1.7.12-1.1.3.4.centos3mozilla-nspr-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-nspr-devel< 1.7.12-1.1.3.4.centos3mozilla-nspr-devel-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-nss< 1.7.12-1.1.3.4.centos3mozilla-nss-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS3ia64mozilla-nss-devel< 1.7.12-1.1.3.4.centos3mozilla-nss-devel-1.7.12-1.1.3.4.centos3.ia64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	ia64	mozilla	< 1.7.12-1.1.3.4.centos3	mozilla-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-chat	< 1.7.12-1.1.3.4.centos3	mozilla-chat-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-devel	< 1.7.12-1.1.3.4.centos3	mozilla-devel-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-dom-inspector	< 1.7.12-1.1.3.4.centos3	mozilla-dom-inspector-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-js-debugger	< 1.7.12-1.1.3.4.centos3	mozilla-js-debugger-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-mail	< 1.7.12-1.1.3.4.centos3	mozilla-mail-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-nspr	< 1.7.12-1.1.3.4.centos3	mozilla-nspr-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-nspr-devel	< 1.7.12-1.1.3.4.centos3	mozilla-nspr-devel-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-nss	< 1.7.12-1.1.3.4.centos3	mozilla-nss-1.7.12-1.1.3.4.centos3.ia64.rpm
CentOS	3	ia64	mozilla-nss-devel	< 1.7.12-1.1.3.4.centos3	mozilla-nss-devel-1.7.12-1.1.3.4.centos3.ia64.rpm