Test ID:	1.3.6.1.4.1.25623.1.0.840986
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-1400-5)
Summary:	The remote host is missing an update for the 'gsettings-desktop-schemas' package(s) announced via the USN-1400-5 advisory.
Description:	Summary: The remote host is missing an update for the 'gsettings-desktop-schemas' package(s) announced via the USN-1400-5 advisory. Vulnerability Insight: USN-1400-1 fixed vulnerabilities in Firefox. Firefox 11 started using GSettings to access the system proxy settings. If there is a GSettings proxy settings schema, Firefox will consume it. The GSettings proxy settings schema that was shipped by default was unused by other applications and broke Firefox's ability to use system proxy settings. This update removes the unused schema. We apologize for the inconvenience. Original advisory details: Soroush Dalili discovered that Firefox did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents or steal confidential data. (CVE-2012-0455) Atte Kettunen discovered a use-after-free vulnerability in Firefox's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0457) Atte Kettunen discovered an out of bounds read vulnerability in Firefox's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. (CVE-2012-0456) Mike Brooks discovered that using carriage return line feed (CRLF) injection, one could introduce a new Content Security Policy (CSP) rule which allows for cross-site scripting (XSS) on sites with a separate header injection vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0451) Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458) Daniel Glazman discovered that the Cascading Style Sheets (CSS) implementation is vulnerable to crashing due to modification of a keyframe followed by access to the cssText of the keyframe. If the user were tricked into opening a specially crafted web page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0459) Matt Brubeck discovered that Firefox did not properly restrict access to the window.fullScreen object. If the user were tricked into opening a specially crafted web page, an attacker could potentially use this vulnerability to spoof the user interface. (CVE-2012-0460) Bob Clary, Christian Holler, Jesse Ruderman, Michael Bebenita, David Anderson, Jeff Walden, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'gsettings-desktop-schemas' package(s) on Ubuntu 11.04. Solution: Please install the updated package(s). CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-0451 BugTraq ID: 52463 http://www.securityfocus.com/bid/52463 http://www.mandriva.com/security/advisories?name=MDVSA-2012:032 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14909 RedHat Security Advisories: RHSA-2012:0387 http://rhn.redhat.com/errata/RHSA-2012-0387.html RedHat Security Advisories: RHSA-2012:0388 http://rhn.redhat.com/errata/RHSA-2012-0388.html http://www.securitytracker.com/id?1026801 http://www.securitytracker.com/id?1026803 http://www.securitytracker.com/id?1026804 http://secunia.com/advisories/48359 http://secunia.com/advisories/48402 http://secunia.com/advisories/48496 http://secunia.com/advisories/48513 http://secunia.com/advisories/48553 http://secunia.com/advisories/48561 http://secunia.com/advisories/48629 http://secunia.com/advisories/49055 SuSE Security Announcement: SUSE-SU-2012:0424 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html SuSE Security Announcement: openSUSE-SU-2012:0417 (Google Search) http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://www.ubuntu.com/usn/USN-1400-1 http://www.ubuntu.com/usn/USN-1400-2 http://www.ubuntu.com/usn/USN-1400-3 http://www.ubuntu.com/usn/USN-1400-4 http://www.ubuntu.com/usn/USN-1400-5 Common Vulnerability Exposure (CVE) ID: CVE-2012-0455 BugTraq ID: 52458 http://www.securityfocus.com/bid/52458 Debian Security Information: DSA-2433 (Google Search) http://www.debian.org/security/2012/dsa-2433 Debian Security Information: DSA-2458 (Google Search) http://www.debian.org/security/2012/dsa-2458 http://www.mandriva.com/security/advisories?name=MDVSA-2012:031 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14829 http://secunia.com/advisories/48414 http://secunia.com/advisories/48495 http://secunia.com/advisories/48624 http://secunia.com/advisories/48823 http://secunia.com/advisories/48920 SuSE Security Announcement: SUSE-SU-2012:0425 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html http://www.ubuntu.com/usn/USN-1401-1 Common Vulnerability Exposure (CVE) ID: CVE-2012-0456 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15007 Common Vulnerability Exposure (CVE) ID: CVE-2012-0457 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14775 Common Vulnerability Exposure (CVE) ID: CVE-2012-0458 BugTraq ID: 52460 http://www.securityfocus.com/bid/52460 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15122 Common Vulnerability Exposure (CVE) ID: CVE-2012-0459 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15066 Common Vulnerability Exposure (CVE) ID: CVE-2012-0460 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15114
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.