-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SUSE Security Announcement

        Package:                MozillaFirefox,MozillaThunderbird,seamonkey,mozilla-nss
        Announcement ID:        SUSE-SA:2010:021
        Date:                   Wed, 14 Apr 2010 15:00:00 +0000
        Affected Products:      openSUSE 11.0
                                openSUSE 11.1
                                openSUSE 11.2
                                SLE SDK 10 SP2
                                SLE SDK 10 SP3
                                SUSE Linux Enterprise Desktop 10 SP2
                                SUSE Linux Enterprise Desktop 10 SP3
                                SUSE Linux Enterprise Server 10 SP2
                                SUSE Linux Enterprise Server 10 SP3
                                SUSE Linux Enterprise Software Development Kit 11
                                SUSE Linux Enterprise Desktop 11
                                SUSE Linux Enterprise Server 11
        Vulnerability Type:     remote code execution
        CVSS v2 Base Score:     10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
        SUSE Default Package:   yes
        Cross-References:       CVE-2009-3555, CVE-2010-0173, CVE-2010-0174
                                CVE-2010-0175, CVE-2010-0176, CVE-2010-0177
                                CVE-2010-0178, CVE-2010-0179, CVE-2010-0181
                                CVE-2010-0182, MFSA 2010-16, MFSA 2010-17
                                MFSA 2010-18, MFSA 2010-19, MFSA 2010-20
                                MFSA 2010-21, MFSA 2010-22, MFSA 2010-23
                                MFSA 2010-24

    Content of This Advisory:
        1) Security Vulnerability Resolved:
             Mozilla browsers and libraries security update
           Problem Description
        2) Solution or Work-Around
        3) Special Instructions and Notes
        4) Package Location and Checksums
        5) Pending Vulnerabilities, Solutions, and Work-Arounds:
            See SUSE Security Summary Report.
        6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

   The Mozilla Firefox browser was updated to version 3.5.9 fixing lots
   of bugs and security issues. On openSUSE 11.0 and 11.1 the browser
   was updated from the 3.0 branch to 3.5.9

   Also the Mozilla NSS libraries were updated to version 3.12.6 to fix
   the CVE-2009-3555 TLS renegotiation issue.

   Mozilla Thunderbird on openSUSE 11.2 was updated to 3.0.4 and Seamonkey
   2 was updated to 2.0.4.

   Following security issues were fixed:
   MFSA 2010-16: Mozilla developers identified and fixed several stability
   bugs in the browser engine used in Firefox and other Mozilla-based
   products. Some of these crashes showed evidence of memory corruption
   under certain circumstances, and we presume that with enough effort
   at least some of these could be exploited to run arbitrary code.
   References

   Martijn Wargers, Josh Soref, and Jesse Ruderman reported crashes
   in the browser engine that affected Firefox 3.5 and Firefox
   3.6. (CVE-2010-0173)

   Jesse Ruderman and Ehsan Akhgari reported crashes that affected all
   supported versions of the browser engine. (CVE-2010-0174)


   MFSA 2010-17 / CVE-2010-0175: Security researcher regenrecht reported
   via TippingPoint's Zero Day Initiative that a select event handler for
   XUL tree items could be called after the tree item was deleted. This
   results in the execution of previously freed memory which an attacker
   could use to crash a victim's browser and run arbitrary code on the
   victim's computer.


   MFSA 2010-18 / CVE-2010-0176: Security researcher regenrecht reported
   via TippingPoint's Zero Day Initiative an error in the way . In certain cases,
   the number of references to an

SuSE: 2010-021: Mozilla Firefox 3.5.9 Security Update

April 14, 2010
The Mozilla Firefox browser was updated to version 3.5.9 fixing lots The Mozilla Firefox browser was updated to version 3.5.9 fixing lots of bugs and security issues

Summary


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SUSE Security Announcement

        Package:                MozillaFirefox,MozillaThunderbird,seamonkey,mozilla-nss
        Announcement ID:        SUSE-SA:2010:021
        Date:                   Wed, 14 Apr 2010 15:00:00 +0000
        Affected Products:      openSUSE 11.0
                                openSUSE 11.1
                                openSUSE 11.2
                                SLE SDK 10 SP2
                                SLE SDK 10 SP3
                                SUSE Linux Enterprise Desktop 10 SP2
                                SUSE Linux Enterprise Desktop 10 SP3
                                SUSE Linux Enterprise Server 10 SP2
                                SUSE Linux Enterprise Server 10 SP3
                                SUSE Linux Enterprise Software Development Kit 11
                                SUSE Linux Enterprise Desktop 11
                                SUSE Linux Enterprise Server 11
        Vulnerability Type:     remote code execution
        CVSS v2 Base Score:     10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
        SUSE Default Package:   yes
        Cross-References:       CVE-2009-3555, CVE-2010-0173, CVE-2010-0174
                                CVE-2010-0175, CVE-2010-0176, CVE-2010-0177
                                CVE-2010-0178, CVE-2010-0179, CVE-2010-0181
                                CVE-2010-0182, MFSA 2010-16, MFSA 2010-17
                                MFSA 2010-18, MFSA 2010-19, MFSA 2010-20
                                MFSA 2010-21, MFSA 2010-22, MFSA 2010-23
                                MFSA 2010-24

    Content of This Advisory:
        1) Security Vulnerability Resolved:
             Mozilla browsers and libraries security update
           Problem Description
        2) Solution or Work-Around
        3) Special Instructions and Notes
        4) Package Location and Checksums
        5) Pending Vulnerabilities, Solutions, and Work-Arounds:
            See SUSE Security Summary Report.
        6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

   The Mozilla Firefox browser was updated to version 3.5.9 fixing lots
   of bugs and security issues. On openSUSE 11.0 and 11.1 the browser
   was updated from the 3.0 branch to 3.5.9

   Also the Mozilla NSS libraries were updated to version 3.12.6 to fix
   the CVE-2009-3555 TLS renegotiation issue.

   Mozilla Thunderbird on openSUSE 11.2 was updated to 3.0.4 and Seamonkey
   2 was updated to 2.0.4.

   Following security issues were fixed:
   MFSA 2010-16: Mozilla developers identified and fixed several stability
   bugs in the browser engine used in Firefox and other Mozilla-based
   products. Some of these crashes showed evidence of memory corruption
   under certain circumstances, and we presume that with enough effort
   at least some of these could be exploited to run arbitrary code.
   References

   Martijn Wargers, Josh Soref, and Jesse Ruderman reported crashes
   in the browser engine that affected Firefox 3.5 and Firefox
   3.6. (CVE-2010-0173)

   Jesse Ruderman and Ehsan Akhgari reported crashes that affected all
   supported versions of the browser engine. (CVE-2010-0174)


   MFSA 2010-17 / CVE-2010-0175: Security researcher regenrecht reported
   via TippingPoint's Zero Day Initiative that a select event handler for
   XUL tree items could be called after the tree item was deleted. This
   results in the execution of previously freed memory which an attacker
   could use to crash a victim's browser and run arbitrary code on the
   victim's computer.


   MFSA 2010-18 / CVE-2010-0176: Security researcher regenrecht reported
   via TippingPoint's Zero Day Initiative an error in the way . In certain cases,
   the number of references to an

References

Severity

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved