Security update for Mozilla Firefox
SUSE Security Update: Security update for Mozilla Firefox
MozillaFirefox was updated to the 10.0.10ESR security
release.
The following issues have been fixed:
*
MFSA 2012-90: Mozilla has fixed a number of issues
related to the Location object in order to enhance overall
security. Details for each of the current fixed issues are
below.
Thunderbird is only affected by window.location
issues through RSS feeds and extensions that load web
content.
*
CVE-2012-4194: Security researcher Mariusz Mlynski
reported that the true value of window.location could be
shadowed by user content through the use of the valueOf
method, which can be combined with some plugins to perform
a cross-site scripting (XSS) attack on users.
*
CVE-2012-4195: Mozilla security researcher
moz_bug_r_a4 discovered that the CheckURL function in
window.location can be forced to return the wrong calling
document and principal, allowing a cross-site scripting
(XSS) attack. There is also the possibility of gaining
arbitrary code execution if the attacker can take advantage
of an add-on that interacts with the page content.
*
CVE-2012-4196: Security researcher Antoine
Delignat-Lavaud of the PROSECCO research team at INRIA
Paris reported the ability to use property injection by
prototype to bypass security wrapper protections on the
Location object, allowing the cross-origin reading of the
Location object.
| Announcement ID: | SUSE-SU-2012:1426-1 |
| Rating: | important |
| References: | #786522 |
| Affected Products: |
An update that contains security fixes can now be installed. It includes two new package versions.
Description:
MozillaFirefox was updated to the 10.0.10ESR security
release.
The following issues have been fixed:
*
MFSA 2012-90: Mozilla has fixed a number of issues
related to the Location object in order to enhance overall
security. Details for each of the current fixed issues are
below.
Thunderbird is only affected by window.location
issues through RSS feeds and extensions that load web
content.
*
CVE-2012-4194: Security researcher Mariusz Mlynski
reported that the true value of window.location could be
shadowed by user content through the use of the valueOf
method, which can be combined with some plugins to perform
a cross-site scripting (XSS) attack on users.
*
CVE-2012-4195: Mozilla security researcher
moz_bug_r_a4 discovered that the CheckURL function in
window.location can be forced to return the wrong calling
document and principal, allowing a cross-site scripting
(XSS) attack. There is also the possibility of gaining
arbitrary code execution if the attacker can take advantage
of an add-on that interacts with the page content.
*
CVE-2012-4196: Security researcher Antoine
Delignat-Lavaud of the PROSECCO research team at INRIA
Paris reported the ability to use property injection by
prototype to bypass security wrapper protections on the
Location object, allowing the cross-origin reading of the
Location object.
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP2:
zypper in -t patch sdksp2-firefox-201210b-7004 - SUSE Linux Enterprise Server 11 SP2 for VMware:
zypper in -t patch slessp2-firefox-201210b-7004 - SUSE Linux Enterprise Server 11 SP2:
zypper in -t patch slessp2-firefox-201210b-7004 - SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp2-firefox-201210b-7004
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 4.9.3]:
- mozilla-nspr-devel-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.10 and 4.9.3]:
- MozillaFirefox-10.0.10-0.3.1
- MozillaFirefox-translations-10.0.10-0.3.1
- mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 4.9.3]:
- mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.10 and 4.9.3]:
- MozillaFirefox-10.0.10-0.3.1
- MozillaFirefox-translations-10.0.10-0.3.1
- mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 4.9.3]:
- mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 4.9.3]:
- mozilla-nspr-x86-4.9.3-0.2.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 4.9.3]:
- mozilla-nspr-4.9.3-0.5.1
- mozilla-nspr-devel-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x):
- MozillaFirefox-10.0.10-0.5.2
- MozillaFirefox-translations-10.0.10-0.5.2
- SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 4.9.3]:
- mozilla-nspr-32bit-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 4.9.3]:
- mozilla-nspr-x86-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 4.9.3]:
- mozilla-nspr-64bit-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.10 and 4.9.3]:
- MozillaFirefox-10.0.10-0.3.1
- MozillaFirefox-translations-10.0.10-0.3.1
- mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 4.9.3]:
- mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 4.9.3]:
- mozilla-nspr-4.9.3-0.5.1
- mozilla-nspr-devel-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 4.9.3]:
- mozilla-nspr-32bit-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586):
- MozillaFirefox-10.0.10-0.5.2
- MozillaFirefox-translations-10.0.10-0.5.2
- SLE SDK 10 SP4 (i586 ia64 ppc s390x):
- MozillaFirefox-branding-upstream-10.0.10-0.5.2
References:
- https://bugzilla.novell.com/786522
- http://download.suse.com/patch/finder/?keywords=67c3a0325cfb67cf4cabe8f44fe58645
- http://download.suse.com/patch/finder/?keywords=a779e3f3d65e3943cbd34d5b913f5501
Run SAP
SUSE for Public Cloud
Security
