10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.2 High
AI Score
Confidence
Low
0.8 High
EPSS
Percentile
98.3%
Debian Security Advisory DSA-2296-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
August 17, 2011 http://www.debian.org/security/faq
Package : iceweasel
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-0084 CVE-2011-2378 CVE-2011-2981 CVE-2011-2982
CVE-2011-2983 CVE-2011-2984
Several vulnerabilities have been discovered in Iceweasel, a web browser
based on Firefox. The included XULRunner library provides rendering
services for several other applications included in Debian.
CVE-2011-0084
"regenrecht" discovered that incorrect pointer handling in the SVG
processing code could lead to the execution of arbitrary code.
CVE-2011-2378
"regenrecht" discovered that incorrect memory management in DOM
processing could lead to the execution of arbitrary code.
CVE-2011-2981
"moz_bug_r_a_4" discovered a Chrome privilege escalation
vulnerability in the event handler code.
CVE-2011-2982
Gary Kwong, Igor Bukanov, Nils and Bob Clary discovered memory
corruption bugs, which may lead to the execution of arbitrary code.
CVE-2011-2983
"shutdown" discovered an information leak in the handling of
RegExp.input.
CVE-2011-2984
"moz_bug_r_a4" discovered a Chrome privilege escalation vulnerability.
For the oldstable distribution (lenny), this problem has been fixed in
version 1.9.0.19-13 of the xulrunner source package.
For the stable distribution (squeeze), this problem has been fixed in
version 3.5.16-9.
For the unstable distribution (sid), this problem has been fixed in
version 6.0-1
We recommend that you upgrade your iceweasel packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 6 | sparc | libmozjs2d | < 1.9.1.16-9 | libmozjs2d_1.9.1.16-9_sparc.deb |
Debian | 6 | kfreebsd-amd64 | xulrunner-dev | < 1.9.1.16-9 | xulrunner-dev_1.9.1.16-9_kfreebsd-amd64.deb |
Debian | 5 | powerpc | xulrunner-1.9 | < 1.9.0.19-13 | xulrunner-1.9_1.9.0.19-13_powerpc.deb |
Debian | 5 | amd64 | xulrunner-1.9-dbg | < 1.9.0.19-13 | xulrunner-1.9-dbg_1.9.0.19-13_amd64.deb |
Debian | 6 | i386 | iceape-mailnews | < 2.0.11-7 | iceape-mailnews_2.0.11-7_i386.deb |
Debian | 6 | mips | iceweasel | < 3.5.16-9 | iceweasel_3.5.16-9_mips.deb |
Debian | 6 | sparc | iceweasel | < 3.5.16-9 | iceweasel_3.5.16-9_sparc.deb |
Debian | 5 | all | xulrunner | < 1.9.0.19-13 | xulrunner_1.9.0.19-13_all.deb |
Debian | 5 | hppa | python-xpcom | < 1.9.0.19-13 | python-xpcom_1.9.0.19-13_hppa.deb |
Debian | 5 | s390 | xulrunner-1.9-gnome-support | < 1.9.0.19-13 | xulrunner-1.9-gnome-support_1.9.0.19-13_s390.deb |