RedHat: Critical: firefox security update
Summary
Summary
Mozilla Firefox is an open source Web browser. A buffer overflow bug was found in the way Firefox processes GIF images. It is possible for an attacker to create a specially crafted GIF image, which when viewed by a victim will execute arbitrary code as the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0399 to this issue. A bug was found in the way Firefox processes XUL content. If a malicious web page can trick a user into dragging an object, it is possible to load malicious XUL content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0401 to this issue. A bug was found in the way Firefox bookmarks content to the sidebar. If a user can be tricked into bookmarking a malicious web page into the sidebar panel, that page could execute arbitrary programs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0402 to this issue. Users of Firefox are advised to upgrade to this updated package which contains Firefox version 1.0.2 and is not vulnerable to these issues.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
150877 -
151153 -
151714 -
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
b4d2d6699d60086f14232a1d1c58b027 firefox-1.0.2-1.4.1.src.rpm
i386:
08057be5ef2e887f407eef14c3b871f2 firefox-1.0.2-1.4.1.i386.rpm
ia64:
d8006388e5625a9baf65fa0bd6a7fc16 firefox-1.0.2-1.4.1.ia64.rpm
ppc:
661a3b104b9a4e5ddd04dcd56113a365 firefox-1.0.2-1.4.1.ppc.rpm
s390:
36441f3878cd58dd420c8ecb9774bb97 firefox-1.0.2-1.4.1.s390.rpm
s390x:
e2c20602640075d8f4424cb88fcf9145 firefox-1.0.2-1.4.1.s390x.rpm
x86_64:
f922c5283e24f14d0ac5128bb58f85d1 firefox-1.0.2-1.4.1.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
b4d2d6699d60086f14232a1d1c58b027 firefox-1.0.2-1.4.1.src.rpm
i386:
08057be5ef2e887f407eef14c3b871f2 firefox-1.0.2-1.4.1.i386.rpm
x86_64:
f922c5283e24f14d0ac5128bb58f85d1 firefox-1.0.2-1.4.1.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
b4d2d6699d60086f14232a1d1c58b027 firefox-1.0.2-1.4.1.src.rpm
i386:
08057be5ef2e887f407eef14c3b871f2 firefox-1.0.2-1.4.1.i386.rpm
ia64:
d8006388e5625a9baf65fa0bd6a7fc16 firefox-1.0.2-1.4.1.ia64.rpm
x86_64:
f922c5283e24f14d0ac5128bb58f85d1 firefox-1.0.2-1.4.1.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
b4d2d6699d60086f14232a1d1c58b027 firefox-1.0.2-1.4.1.src.rpm
i386:
08057be5ef2e887f407eef14c3b871f2 firefox-1.0.2-1.4.1.i386.rpm
ia64:
d8006388e5625a9baf65fa0bd6a7fc16 firefox-1.0.2-1.4.1.ia64.rpm
x86_64:
f922c5283e24f14d0ac5128bb58f85d1 firefox-1.0.2-1.4.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0399 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0401 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0402
Package List
Topic
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Bugs Fixed