| Revision Date: | 2014-06-23 | Version: | 18 |
| Title: | DSA-1707 iceweasel -- several vulnerabilities |
| Description: | Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems: Jesse Ruderman discovered that the layout engine is vulnerable to DoS attacks that might trigger memory corruption and an integer overflow. (MFSA 2008-60) Boris Zbarsky discovered that an information disclosure attack could be performed via XBL bindings. (MFSA 2008-61) It was discovered that attackers could run arbitrary JavaScript with chrome privileges via vectors related to the feed preview. (MFSA 2008-62) Marius Schilder discovered that it is possible to obtain sensible data via a XMLHttpRequest. (MFSA 2008-64) Chris Evans discovered that it is possible to obtain sensible data via a JavaScript URL. (MFSA 2008-65) Chip Salzenberg discovered possible phishing attacks via URLs with leading whitespaces or control characters. (MFSA 2008-66) Kojima Hajime and Jun Muto discovered that escaped null characters were ignored by the CSS parser and could lead to the bypass of protection mechanisms (MFSA 2008-67) It was discovered that it is possible to perform cross-site scripting attacks via an XBL binding to an "unloaded document." (MFSA 2008-68) It was discovered that it is possible to run arbitrary JavaScript with chrome privileges via unknown vectors. (MFSA 2008-68) moz_bug_r_a4 discovered that the session-restore feature does not properly sanitise input leading to arbitrary injections. This issue could be used to perform an XSS attack or run arbitrary JavaScript with chrome privileges. (MFSA 2008-69) |
| Family: | unix | Class: | patch |
| Status: | ACCEPTED | Reference(s): | CVE-2008-5500
CVE-2008-5503
CVE-2008-5504
CVE-2008-5506
CVE-2008-5507
CVE-2008-5508
CVE-2008-5510
CVE-2008-5511
CVE-2008-5512
CVE-2008-5513
DSA-1707
|
| Platform(s): | Debian GNU/Linux 4.0
| Product(s): | iceweasel
|
| Definition Synopsis |
| Debian GNU/Linux 4.0 is installed. AND Architecture section
Architecture independent section
Installed architecture is all
AND Packages section
mozilla-firefox is earlier than 2.0.0.19-0etch1
OR firefox is earlier than 2.0.0.19-0etch1
OR firefox-dom-inspector is earlier than 2.0.0.19-0etch1
OR iceweasel-dom-inspector is earlier than 2.0.0.19-0etch1
OR mozilla-firefox-gnome-support is earlier than 2.0.0.19-0etch1
OR mozilla-firefox-dom-inspector is earlier than 2.0.0.19-0etch1
OR firefox-gnome-support is earlier than 2.0.0.19-0etch1
OR iceweasel-gnome-support is earlier than 2.0.0.19-0etch1
OR iceweasel-dbg is earlier than 2.0.0.19-0etch1
OR iceweasel is earlier than 2.0.0.19-0etch1
|