Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2013.0645.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2013:0645-1)
Summary:The remote host is missing an update for the 'Mozilla Firefox' package(s) announced via the SUSE-SU-2013:0645-1 advisory.
Description:Summary:
The remote host is missing an update for the 'Mozilla Firefox' package(s) announced via the SUSE-SU-2013:0645-1 advisory.

Vulnerability Insight:
MozillaFirefox has been updated to the 17.0.5ESR release fixing bugs and security issues.

Also Mozilla NSS has been updated to version 3.14.3 and Mozilla NSPR to 4.9.6.

*

MFSA 2013-30: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan Sreckovic, and Joe Drew reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 19. (CVE-2013-0788)

Andrew McCreight, Randell Jesup, Gary Kwong, Jesse Ruderman, Christian Holler, and Mats Palmgren reported memory safety problems and crashes that affect Firefox 19.
(CVE-2013-0789)

Jim Chen reported a memory safety problem that affects Firefox for Android

*

(CVE-2013-0790)

*

MFSA 2013-31 / CVE-2013-0800: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an out-of-bounds write in Cairo graphics library. When certain values are passed to it during rendering, Cairo attempts to use negative boundaries or sizes for boxes, leading to a potentially exploitable crash in some instances.

*

MFSA 2013-32 / CVE-2013-0799: Security researcher Frederic Hoguin discovered that the Mozilla Maintenance Service on Windows was vulnerable to a buffer overflow.
This system is used to update software without invoking the User Account Control (UAC) prompt. The Mozilla Maintenance Service is configured to allow unprivileged users to start it with arbitrary arguments. By manipulating the data passed in these arguments, an attacker can execute arbitrary code with the system privileges used by the service. This issue requires local file system access to be exploitable.

*

MFSA 2013-33 / CVE-2013-0798: Security researcher Shuichiro Suzuki of the Fourteenforty Research Institute reported the app_tmp directory is set to be world readable and writeable by Firefox for Android. This potentially allows for third party applications to replace or alter Firefox add-ons when downloaded because they are temporarily stored in the app_tmp directory before installation.

This vulnerability only affects Firefox for Android.

*

MFSA 2013-34 / CVE-2013-0797: Security researcher Ash reported an issue with the Mozilla Updater. The Mozilla Updater can be made to load a malicious local DLL file in a privileged context through either the Mozilla Maintenance Service or independently on systems that do not use the service. This occurs when the DLL file is placed in a specific location on the local system before the Mozilla Updater is run. Local file system access is necessary in order for this issue to be exploitable.

*

MFSA ... [Please see the references for more information on the vulnerabilities]

Affected Software/OS:
'Mozilla Firefox' package(s) on SUSE Linux Enterprise Software Development Kit 11 SP2, SUSE Linux Enterprise Server 11 SP2, SUSE Linux Enterprise Server 10 SP4, SUSE Linux Enterprise Desktop 11 SP2, SUSE Linux Enterprise Desktop 10 SP4, SLE SDK 10 SP4

Solution:
Please install the updated package(s).

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2013-0788
Debian Security Information: DSA-2699 (Google Search)
http://www.debian.org/security/2013/dsa-2699
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16629
RedHat Security Advisories: RHSA-2013:0696
http://rhn.redhat.com/errata/RHSA-2013-0696.html
RedHat Security Advisories: RHSA-2013:0697
http://rhn.redhat.com/errata/RHSA-2013-0697.html
SuSE Security Announcement: SUSE-SU-2013:0645 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html
SuSE Security Announcement: SUSE-SU-2013:0850 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html
SuSE Security Announcement: openSUSE-SU-2013:0630 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html
SuSE Security Announcement: openSUSE-SU-2013:0631 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html
SuSE Security Announcement: openSUSE-SU-2013:0875 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-06/msg00012.html
http://www.ubuntu.com/usn/USN-1791-1
Common Vulnerability Exposure (CVE) ID: CVE-2013-0789
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17079
Common Vulnerability Exposure (CVE) ID: CVE-2013-0790
Common Vulnerability Exposure (CVE) ID: CVE-2013-0791
BugTraq ID: 58826
http://www.securityfocus.com/bid/58826
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17150
RedHat Security Advisories: RHSA-2013:1135
http://rhn.redhat.com/errata/RHSA-2013-1135.html
RedHat Security Advisories: RHSA-2013:1144
http://rhn.redhat.com/errata/RHSA-2013-1144.html
Common Vulnerability Exposure (CVE) ID: CVE-2013-0792
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17021
Common Vulnerability Exposure (CVE) ID: CVE-2013-0794
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17065
Common Vulnerability Exposure (CVE) ID: CVE-2013-0795
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16842
Common Vulnerability Exposure (CVE) ID: CVE-2013-0796
Common Vulnerability Exposure (CVE) ID: CVE-2013-0797
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17146
Common Vulnerability Exposure (CVE) ID: CVE-2013-0798
Common Vulnerability Exposure (CVE) ID: CVE-2013-0799
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17155
Common Vulnerability Exposure (CVE) ID: CVE-2013-0800
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16909
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.