Synopsis: Critical: firefox security update
Issue Date: 2012-11-20
CVE Numbers: CVE-2012-5842
CVE-2012-4202
CVE-2012-4201
CVE-2012-5841
CVE-2012-4207
CVE-2012-4209
CVE-2012-4214
CVE-2012-4215
CVE-2012-4216
CVE-2012-5829
CVE-2012-5839
CVE-2012-5840
CVE-2012-5830
CVE-2012-5833
CVE-2012-5835
CVE-2012-4210
—
Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829,
CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5839, CVE-2012-5840,
CVE-2012-5842)
A buffer overflow flaw was found in the way Firefox handled GIF (Graphics
Interchange Format) images. A web page containing a malicious GIF image
could cause Firefox to crash or, possibly, execute arbitrary code with the
privileges of the user running Firefox. (CVE-2012-4202)
A flaw was found in the way the Style Inspector tool in Firefox handled
certain Cascading Style Sheets (CSS). Running the tool (Tools -> Web
Developer -> Inspect) on malicious CSS could result in the execution of
HTML and CSS content with chrome privileges. (CVE-2012-4210)
A flaw was found in the way Firefox decoded the HZ-GB-2312 character
encoding. A web page containing malicious content could cause Firefox to
run JavaScript code with the permissions of a different website.
(CVE-2012-4207)
A flaw was found in the location object implementation in Firefox.
Malicious content could possibly use this flaw to allow restricted content
to be loaded by plug-ins. (CVE-2012-4209)
A flaw was found in the way cross-origin wrappers were implemented.
Malicious content could use this flaw to perform cross-site scripting
attacks. (CVE-2012-5841)
A flaw was found in the evalInSandbox implementation in Firefox. Malicious
content could use this flaw to perform cross-site scripting attacks.
(CVE-2012-4201)
After installing the update, Firefox must be restarted for the
changes to take effect.
—
SL5
x86_64
firefox-10.0.11-1.el5_8.i386.rpm
firefox-10.0.11-1.el5_8.x86_64.rpm
xulrunner-10.0.11-1.el5_8.i386.rpm
xulrunner-10.0.11-1.el5_8.x86_64.rpm
xulrunner-devel-10.0.11-1.el5_8.i386.rpm
xulrunner-devel-10.0.11-1.el5_8.x86_64.rpm
i386
firefox-10.0.11-1.el5_8.i386.rpm
xulrunner-10.0.11-1.el5_8.i386.rpm
xulrunner-devel-10.0.11-1.el5_8.i386.rpm
SL6
x86_64
firefox-10.0.11-1.el6_3.i686.rpm
firefox-10.0.11-1.el6_3.x86_64.rpm
xulrunner-10.0.11-1.el6_3.i686.rpm
xulrunner-10.0.11-1.el6_3.x86_64.rpm
xulrunner-devel-10.0.11-1.el6_3.i686.rpm
xulrunner-devel-10.0.11-1.el6_3.x86_64.rpm
i386
firefox-10.0.11-1.el6_3.i686.rpm
xulrunner-10.0.11-1.el6_3.i686.rpm
xulrunner-devel-10.0.11-1.el6_3.i686.rpm
– Scientific Linux Development Team
