Bugzilla Bug 135254

http://secunia.com/advisories/20376/


Description:
Multiple vulnerabilities have been reported in Firefox, which can be exploited
by malicious people to bypass certain security restrictions, conduct cross-site
scripting and HTTP response smuggling attacks, and potentially compromise a
user's system.

1) An error in the sandbox protection of JavaScript run via EvalInSandbox can
be exploited to execute arbitrary JavaScript code with escalated privileges by
calling the "valueOf()" function on external objects outside of the sandbox.

Successful exploitation requires that the attacker is able to execute
JavaScript code inside the EvalInSandbox (e.g. via a Proxy Autoconfig script or
a third-party extension using the vulnerable functionality).

2) Some errors in the browser engine can be exploited to cause a memory
corruption.

Successful exploitation may allow execution of arbitrary code.

3) Two errors in the handling of specially crafted HTTP responses in certain
situations can be exploited to cause the browser to process a response as two
separate responses from different sites.

Successful exploitation allows execution of arbitrary HTML and script in a
user's browser session in context of an arbitrary site, but requires that the
browser is configured to use a proxy or that the malicious site shares the same
IP address as the targeted site.

4) Two errors in the handling of the "View Image" and "Show only this frame"
functionalities can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an arbitrary site by e.g. tricking a user
into right-clicking and choosing "View Image" on a broken image.

5) An error caused due to persisted XUL attributes in certain situations being
associated with an incorrect URL can be exploited to execute arbitrary
JavaScript code with escalated privileges.

6) An error caused due to content-defined setters on an object prototype being
called by privileged code in the user interface can be exploited to execute
arbitrary JavaScript code with escalated privileges.

7) An error caused due to an off-by-two array boundary error in the
"crypto.signText()" function can be exploited to cause a buffer overflow by
passing optional Certificate Authority name arguments.

8) An error exists due to Unicode Byte-order-Mark (BOM) data being stripped
from documents served in UTF-8 during the conversion to Unicode. This can be
exploited to bypass certain HTML and JavaScript filtering mechanisms in web
applications using the UTF-8 character encoding.

9) An error in the processing of the addSelectionListener when handling
notifications in certain situations can be exploited to execute arbitrary
JavaScript code with escalated privileges.

Solution:
Update to version 1.5.0.4.
http://www.mozilla.com/firefox/

Provided and/or discovered by:
1) moz_bug_r_a4
2) Mozilla Developers
3) Kazuho Oku, Cybozu Labs
4) Paul Nickerson
5) Jonas Sicking, Mozilla
6) Paul Nickerson and moz_bug_r_a4
7) Mikolaj J. Habryn
8) Masatoshi Kimura
9) moz_bug_r_a4

Original Advisory:
1) http://www.mozilla.org/security/announce/2006/mfsa2006-31.html
2) http://www.mozilla.org/security/announce/2006/mfsa2006-32.html
3) http://www.mozilla.org/security/announce/2006/mfsa2006-33.html
4) http://www.mozilla.org/security/announce/2006/mfsa2006-34.html
5) http://www.mozilla.org/security/announce/2006/mfsa2006-35.html
6) http://www.mozilla.org/security/announce/2006/mfsa2006-37.html
7) http://www.mozilla.org/security/announce/2006/mfsa2006-38.html
8) http://www.mozilla.org/security/announce/2006/mfsa2006-42.html
9) http://www.mozilla.org/security/announce/2006/mfsa2006-43.html

Moz team, please bump 1.5.0.4 ebuild please

The 1.0 branch is probably vulnerable to certain of the issues, but this is not
fixed yet regarding
http://www.mozilla.org/projects/security/known-vulnerabilities.html

adding
http://www.mozilla.org/security/announce/2006/mfsa2006-39.html
and
http://www.mozilla.org/security/announce/2006/mfsa2006-41.html
to what Secunia reports

the whole list it then :

MFSA 2006-43  Privilege escalation using addSelectionListener
MFSA 2006-42 Web site XSS using BOM on UTF-8 pages
MFSA 2006-41 File stealing by changing input type (variant)
MFSA 2006-39 "View Image" local resource linking (Windows)
MFSA 2006-38 Buffer overflow in crypto.signText()
MFSA 2006-37 Remote compromise via content-defined setter on object prototypes
MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2
MFSA 2006-35 Privilege escalation through XUL persist
MFSA 2006-34 XSS viewing javascript: frames or images from context menu
MFSA 2006-33 HTTP response smuggling
MFSA 2006-32 Fixes for crashes with potential memory corruption
MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey)

sorry for the spam. I shoud stop bugzie or take some rest

According to the advisory all versions are affected. No bugfix for 1.0.8, yet
and despite the announcement, I still get "access denied" when I try to look at
the relevant upstream bugs.

*** Bug 135282 has been marked as a duplicate of this bug. ***

(In reply to comment #5)
> According to the advisory all versions are affected. No bugfix for 1.0.8, yet
> and despite the announcement, I still get "access denied" when I try to look at
> the relevant upstream bugs.
> 

There won't be any more updates to the 1.0.x-series (and the mozilla-suite),
this was publicly announced a few weeks ago:

http://developer.mozilla.org/devnews/index.php/2006/04/12/sunset-announcement-for-fxtb-10x-and-mozilla-suite-17x/

1.5.0.4 is in the tree feel free to add all archs and have them mark stable. Do
not forget to have amd64 and x86 mark -bin stable.

Well time is here it is 1.5.0.4 for all or nothing. There are gonna be no more
revisions for the 1.0.x branch!! If for some reason your arch will not work
with 1.5.x we will have to mask firefox on that arch until problem is resolved,
patches can be backported but that will be left up to the archs to handle that
can not deal with 1.5.x series of firefox. I will handle amd64 source and
binary package x86 team do not forget -bin as well please.

amd64 and ppc already done sorry forgot to add you last go around

amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be
unmaintained by upstream now.

arches, don't forget -bin :)

(In reply to comment #11)
> amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be
> unmaintained by upstream now.
> 
I would suggest ya read the entire bug before adding archs that are already
done.

Stable on hppa.

x86 done

firefox is still broken on alpha, see bug #128777. I've masked
'www-client/mozilla-firefox' in profiles/default-linux/alpha/package.mask until
it is fixed. I also masked the 'firefox' USE flag in 
profiles/default-linux/alpha/use.mask.

sparc stable.

Ready for GLSA.

GLSA 200606-12