Security World: [SECURITY] [DSA 1756-1] New xulrunner packages fix multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1756-1 security@debian.org
http://www.debian.org/security/ Noah Meyerhans
March 29, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : xulrunner
Vulnerability : multiple
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2009-1169 CVE-2009-1044

Several remote vulnerabilities have been discovered in Xulrunner, a
runtime environment for XUL applications, such as the Iceweasel web
browser. The Common Vulnerabilities and Exposures project identifies
the following problems:

CVE-2009-1169

Security researcher Guido Landi discovered that a XSL stylesheet could
be used to crash the browser during a XSL transformation. An attacker
could potentially use this crash to run arbitrary code on a victim's
computer.

CVE-2009-1044

Security researcher Nils reported via TippingPoint's Zero Day Initiative
that the XUL tree method _moveToEdgeShift was in some cases triggering
garbage collection routines on objects which were still in use. In such
cases, the browser would crash when attempting to access a previously
destroyed object and this crash could be used by an attacker to run
arbitrary code on a victim's computer.

Note that after installing these updates, you will need to restart any
packages using xulrunner, typically iceweasel or epiphany.

For the stable distribution (lenny), these problems have been fixed in version
1.9.0.7-0lenny2.

As indicated in the Etch release notes, security support for the
Mozilla products in the oldstable distribution needed to be stopped
before the end of the regular Etch security maintenance life cycle.
You are strongly encouraged to upgrade to stable or switch to a still
supported browser.

For the unstable distribution (sid), these problems have been fixed in
version 1.9.0.8-1

We recommend that you upgrade your xulrunner package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.7-0lenny2.dsc
Size/MD5 checksum: 1777 be107e8cce28d09395d6c2b0e2880e0b
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.7.orig.tar.gz
Size/MD5 checksum: 43683292 f49b66c10e021debdfd9cd3705847d9b
http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.7-0lenny2.diff.gz
Size/MD5 checksum: 115665 4886b961a24c13d9017e8f261b7a4ad4

Architecture independent packages:

http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.7-0lenny2_all.deb
Size/MD5 checksum: 1480030 c12b4d6d534c0f12ec8e19760ca52a9b

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJz7e0YrVLjBFATsMRAqErAJ9G+BuPEzepVX1SyrbSfGFG+k9yOACfZzE6
CR8tiMWR7RD51xVEfCsbY/I=
=Ax89
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Sunday, March 29, 2009

[SECURITY] [DSA 1756-1] New xulrunner packages fix multiple vulnerabilities

No comments: