Synopsis

Critical: firefox security update

Type/Severity

Security Advisory: Critical

Topic

An updated firefox package that fixes one security issue is now available
for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Mozilla Firefox is an open source web browser.

A heap-based buffer overflow flaw was found in the way Firefox handled
PNG (Portable Network Graphics) images. A web page containing a malicious
PNG image could cause Firefox to crash or, possibly, execute arbitrary
code with the privileges of the user running Firefox. (CVE-2011-3026)

All Firefox users should upgrade to this updated package, which corrects
this issue. After installing the update, Firefox must be restarted for the
changes to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 790737 - CVE-2011-3026 libpng: Heap-buffer-overflow in png_decompress_chunk

CVEs

• CVE-2011-3026

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server 4

SRPM
firefox-3.6.26-3.el4.src.rpm	SHA-256: 6caa13d0761e0e463327149e1f0f509d87f16dfc4088fbe29607786a61e32305
x86_64
firefox-3.6.26-3.el4.x86_64.rpm	SHA-256: 2ad5797c002f2a8c8e54518c452dae16981403e5850ae98bff9c0769cea2bb8f
firefox-3.6.26-3.el4.x86_64.rpm	SHA-256: 2ad5797c002f2a8c8e54518c452dae16981403e5850ae98bff9c0769cea2bb8f
ia64
firefox-3.6.26-3.el4.ia64.rpm	SHA-256: 0214ba88f15acbec7c0294035fa34c4c3516ad3a415c7480e4266b2ad18fff50
firefox-3.6.26-3.el4.ia64.rpm	SHA-256: 0214ba88f15acbec7c0294035fa34c4c3516ad3a415c7480e4266b2ad18fff50
i386
firefox-3.6.26-3.el4.i386.rpm	SHA-256: fe1dd9c661fbe9e4b30aafc64f840fdb8ad74d2e76d21c24b5a02373246e15d8
firefox-3.6.26-3.el4.i386.rpm	SHA-256: fe1dd9c661fbe9e4b30aafc64f840fdb8ad74d2e76d21c24b5a02373246e15d8

Red Hat Enterprise Linux Workstation 4

SRPM
firefox-3.6.26-3.el4.src.rpm	SHA-256: 6caa13d0761e0e463327149e1f0f509d87f16dfc4088fbe29607786a61e32305
x86_64
firefox-3.6.26-3.el4.x86_64.rpm	SHA-256: 2ad5797c002f2a8c8e54518c452dae16981403e5850ae98bff9c0769cea2bb8f
ia64
firefox-3.6.26-3.el4.ia64.rpm	SHA-256: 0214ba88f15acbec7c0294035fa34c4c3516ad3a415c7480e4266b2ad18fff50
i386
firefox-3.6.26-3.el4.i386.rpm	SHA-256: fe1dd9c661fbe9e4b30aafc64f840fdb8ad74d2e76d21c24b5a02373246e15d8

Red Hat Enterprise Linux Desktop 4

SRPM
firefox-3.6.26-3.el4.src.rpm	SHA-256: 6caa13d0761e0e463327149e1f0f509d87f16dfc4088fbe29607786a61e32305
x86_64
firefox-3.6.26-3.el4.x86_64.rpm	SHA-256: 2ad5797c002f2a8c8e54518c452dae16981403e5850ae98bff9c0769cea2bb8f
i386
firefox-3.6.26-3.el4.i386.rpm	SHA-256: fe1dd9c661fbe9e4b30aafc64f840fdb8ad74d2e76d21c24b5a02373246e15d8

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
firefox-3.6.26-3.el4.src.rpm	SHA-256: 6caa13d0761e0e463327149e1f0f509d87f16dfc4088fbe29607786a61e32305
s390x
firefox-3.6.26-3.el4.s390x.rpm	SHA-256: bd7a9b18988b8b789c87b08ec704c22ddbe47256b48bd16029ec134569dea146
s390
firefox-3.6.26-3.el4.s390.rpm	SHA-256: aee63160486d605585a287014f1bc47aba661cadc6061422eee9f9deece6691f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
firefox-3.6.26-3.el4.src.rpm	SHA-256: 6caa13d0761e0e463327149e1f0f509d87f16dfc4088fbe29607786a61e32305
ppc
firefox-3.6.26-3.el4.ppc.rpm	SHA-256: c55ed1937833bae82946f5891e4757f7671f79df2d1dd1071369601c332f5328