Synopsis

firefox security update

Type/Severity

Security Advisory: Critical

Topic

Updated firefox packages that fix various bugs are now available.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

Mozilla Firefox is an open source Web browser.

A buffer overflow bug was found in the way Firefox processes GIF images. It
is possible for an attacker to create a specially crafted GIF image, which
when viewed by a victim will execute arbitrary code as the victim. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0399 to this issue.

A bug was found in the way Firefox processes XUL content. If a malicious
web page can trick a user into dragging an object, it is possible to load
malicious XUL content. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0401 to this issue.

A bug was found in the way Firefox bookmarks content to the sidebar. If a
user can be tricked into bookmarking a malicious web page into the sidebar
panel, that page could execute arbitrary programs. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0402 to this issue.

Users of Firefox are advised to upgrade to this updated package which
contains Firefox version 1.0.2 and is not vulnerable to these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 150877 - CAN-2005-0399 firefox GIF buffer overflow
• BZ - 151153 - CAN-2005-0402 arbitrary code execution via sidebar
• BZ - 151714 - CAN-2005-0401 Drag and drop loading of privileged XUL

CVEs

• CVE-2005-0401
• CVE-2005-0399
• CVE-2005-0402

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
firefox-1.0.2-1.4.1.src.rpm	SHA-256: f051e26c048d6cc0a7a3c776fe4190b4bc76ed0792c9c985c3fb551723188146
x86_64
firefox-1.0.2-1.4.1.x86_64.rpm	SHA-256: d7d82658e7d8dda7ac0b28704a2ad6201dffba6eda983e174e7d6afa2ceaaf06
firefox-1.0.2-1.4.1.x86_64.rpm	SHA-256: d7d82658e7d8dda7ac0b28704a2ad6201dffba6eda983e174e7d6afa2ceaaf06
ia64
firefox-1.0.2-1.4.1.ia64.rpm	SHA-256: 892bb525a1e1bdf7451343837c1d98b39ba18aaa1a8f6a5581cc8843a2a07149
firefox-1.0.2-1.4.1.ia64.rpm	SHA-256: 892bb525a1e1bdf7451343837c1d98b39ba18aaa1a8f6a5581cc8843a2a07149
i386
firefox-1.0.2-1.4.1.i386.rpm	SHA-256: 50f2fbb9590bd93f076389642cbd88e5d8a13df934951e9e5aa243e5725e8e1a
firefox-1.0.2-1.4.1.i386.rpm	SHA-256: 50f2fbb9590bd93f076389642cbd88e5d8a13df934951e9e5aa243e5725e8e1a

Red Hat Enterprise Linux Workstation 4

SRPM
firefox-1.0.2-1.4.1.src.rpm	SHA-256: f051e26c048d6cc0a7a3c776fe4190b4bc76ed0792c9c985c3fb551723188146
x86_64
firefox-1.0.2-1.4.1.x86_64.rpm	SHA-256: d7d82658e7d8dda7ac0b28704a2ad6201dffba6eda983e174e7d6afa2ceaaf06
ia64
firefox-1.0.2-1.4.1.ia64.rpm	SHA-256: 892bb525a1e1bdf7451343837c1d98b39ba18aaa1a8f6a5581cc8843a2a07149
i386
firefox-1.0.2-1.4.1.i386.rpm	SHA-256: 50f2fbb9590bd93f076389642cbd88e5d8a13df934951e9e5aa243e5725e8e1a

Red Hat Enterprise Linux Desktop 4

SRPM
firefox-1.0.2-1.4.1.src.rpm	SHA-256: f051e26c048d6cc0a7a3c776fe4190b4bc76ed0792c9c985c3fb551723188146
x86_64
firefox-1.0.2-1.4.1.x86_64.rpm	SHA-256: d7d82658e7d8dda7ac0b28704a2ad6201dffba6eda983e174e7d6afa2ceaaf06
i386
firefox-1.0.2-1.4.1.i386.rpm	SHA-256: 50f2fbb9590bd93f076389642cbd88e5d8a13df934951e9e5aa243e5725e8e1a

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
firefox-1.0.2-1.4.1.src.rpm	SHA-256: f051e26c048d6cc0a7a3c776fe4190b4bc76ed0792c9c985c3fb551723188146
s390x
firefox-1.0.2-1.4.1.s390x.rpm	SHA-256: e01b1028a3ad9bd40595f04aa56e1c6d248d55285397e3c01de5007aa982b038
s390
firefox-1.0.2-1.4.1.s390.rpm	SHA-256: 41710fbe0aaca9fd7fdc3f61101258a8f2a23e06e4ca8b75befb059e0af750b6

Red Hat Enterprise Linux for Power, big endian 4

SRPM
firefox-1.0.2-1.4.1.src.rpm	SHA-256: f051e26c048d6cc0a7a3c776fe4190b4bc76ed0792c9c985c3fb551723188146
ppc
firefox-1.0.2-1.4.1.ppc.rpm	SHA-256: 2e2cc496f43b013b0b5a098271e7872ad460da3cb3fb55199684ce5974dc3d91