------------------------------------------------------------------------
Pardus Linux Security Advisory 2008-84            security@pardus.org.tr
------------------------------------------------------------------------
     Date: 2008-12-23
 Severity: 5
     Type: Remote
------------------------------------------------------------------------

Summary
=======

Some vulnerabilities have been reported in Mozilla Firefox, which can be
exploited by malicious people to bypass certain security  restrictions,
disclose sensitive information, conduct cross-site scripting attacks, or
potentially compromise a user's system.


Description
===========

1) Multiple errors in the layout and JavaScript engines can be exploited
to corrupt memory and potentially execute arbitrary code.



2) An error when processing the "persist" XUL attribute can be exploited
to bypass cookie settings and uniquely identify a  user  in  subsequent
browsing sessions.



3) Multiple errors can be exploited to bypass the  same-origin  policy,
disclose sensitive information, and execute JavaScript code with chrome
privileges.



Affected packages:

 Pardus 2008:
   firefox, all before 3.0.5-93-19
   firefox-devel, all before 3.0.5-93-19

 Pardus 2007:
   firefox, all before 2.0.0.19-81-73
   firefox-devel, all before 2.0.0.19-81-46



Resolution
==========

There are update(s) for firefox, firefox-devel. You can update them via
Package Manager or with a single command from console:

 Pardus 2008:
   pisi up firefox firefox-devel

 Pardus 2007:
   pisi up firefox firefox-devel


References
==========

 * http://www.mozilla.org/security/announce/2008/mfsa2008-60.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-63.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-64.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-65.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-66.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-67.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-68.html
 * http://www.mozilla.org/security/announce/2008/mfsa2008-69.html
 * http://secunia.com/Advisories/33203/

------------------------------------------------------------------------

--
Pardus Security Team
http://security.pardus.org.tr


_______________________________________________
Pardus-security mailing list
Pardus-security@pardus.org.tr
http://liste.pardus.org.tr/mailman/listinfo/pardus-security