Mozilla Firefox has been updated to the 17.0.10ESR release,
which fixes various bugs and security issues:
MFSA 2013-93: Mozilla developers identified and fixed
several memory safety bugs in the browser engine used in
Firefox and other Mozilla-based products. Some of these
bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary
code.
Jesse Ruderman and Christoph Diehl reported memory
safety problems and crashes that affect Firefox ESR 17,
Firefox ESR 24, and Firefox 24. (CVE-2013-5590)
Carsten Book reported a crash fixed in the NSS
library used by Mozilla-based products fixed in Firefox 25,
Firefox ESR 24.1, and Firefox ESR 17.0.10.(CVE-2013-1739)
MFSA 2013-95 / CVE-2013-5604: Security researcher
Abhishek Arya (Inferno) of the Google Chrome Security Team
used the Address Sanitizer tool to discover an access
violation due to uninitialized data during Extensible
Stylesheet Language Transformation (XSLT) processing. This
leads to a potentially exploitable crash.
MFSA 2013-96 / CVE-2013-5595: Compiler Engineer Dan
Gohman of Google discovered a flaw in the JavaScript engine
where memory was being incorrectly allocated for some
functions and the calls for allocations were not always
properly checked for overflow, leading to potential buffer
overflows. When combined with other vulnerabilities, these
flaws could be potentially exploitable.
MFSA 2013-98 / CVE-2013-5597: Security researcher
Byoungyoung Lee of Georgia Tech Information Security Center
(GTISC) used the Address Sanitizer tool to discover a
use-after-free during state change events while updating
the offline cache. This leads to a potentially exploitable
crash.
MFSA 2013-100: Security researcher Nils used the
Address Sanitizer tool while fuzzing to discover missing
strong references in browsing engine leading to
use-after-frees. This can lead to a potentially exploitable
crash.
o ASAN heap-use-after-free in
nsIPresShell::GetPresContext() with canvas, onresize and
mozTextStyle (CVE-2013-5599) o ASAN use-after-free in
nsIOService::NewChannelFromURIWithProxyFlags with Blob URL
(CVE-2013-5600) o ASAN use-after free in GC allocation in
nsEventListenerManager::SetEventHandler (CVE-2013-5601)
*
MFSA 2013-101 / CVE-2013-5602: Security researcher
Nils used the Address Sanitizer tool while fuzzing to
discover a memory corruption issue with the JavaScript
engine when using workers with direct proxies. This results
in a potentially exploitable crash.
download.novell.com/patch/finder/?keywords=07c7008fa5d3132fbafd48744ab7c997
download.novell.com/patch/finder/?keywords=1edf663f8550de4b96445d1cbca59315
download.novell.com/patch/finder/?keywords=30958073bccf2d3c9d16900439fc7ec3
download.novell.com/patch/finder/?keywords=574e354cc19e6404e0964c3b1348f211
download.novell.com/patch/finder/?keywords=92ad00fe40f67f855b720f6d4ae5751a
download.novell.com/patch/finder/?keywords=96c6d994dc18c3fd7399e875d9d14ac1
download.novell.com/patch/finder/?keywords=d36d3817c15a3112e57723f3b4a2059a
download.novell.com/patch/finder/?keywords=f4dc527883357fa1c73dfcbfaa52ddfe
bugzilla.novell.com/847708