Security update for Mozilla suite

Knowledgebase

(Last modified: 15MAR2007)

solutions Security update for Mozilla suite SuSE Linux Maintenance Web (adf5cccb9b0cfb2f9cb649652f793fdc)

Applies to

Package: mozilla
mozilla-calendar
mozilla-devel
mozilla-dom-inspector
mozilla-irc
mozilla-mail
mozilla-venkman
mozilla-cs
mozilla-deat
mozilla-hu
mozilla-lib64
Product(s): SUSE CORE 9 for x86
SUSE CORE 9 for Itanium Processor Family
SUSE CORE 9 for IBM POWER
SUSE CORE 9 for IBM S/390 31bit
SUSE CORE 9 for IBM zSeries 64bit
SUSE CORE 9 for AMD64 and Intel EM64T
Novell Linux Desktop 9 for x86
Novell Linux Desktop 9 for x86_64
Novell Linux POS 9
Open Enterprise Server
Patch: patch-11458
Release: 20070315
Obsoletes: 23c2f7e232f2a20be862d4cbaf1e30e5

Indications

Everyone using Mozilla should update.

Contraindications

None.

Problem description

This security update brings Mozilla Seamonkey to version 1.0.8.
Please also see http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details.
It includes fixes to the following security problems:

MFSA 2007-01: As part of the Firefox 2.0.0.2 and 1.5.0.10 update releases several bugs were fixed to improve the stability of the browser. Some of these were crashes that showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code. These fixes affected the layout engine (CVE-2007-0775), SVG renderer (CVE-2007-0776) and javascript engine (CVE-2007-0777).
MFSA 2007-02: Various enhancements were done to make XSS exploits against websites less effective. These included fixes for invalid trailing characters (CVE-2007-0995), child frame character set inheritance (CVE-2007-0996), password form injection (CVE-2006-6077), and the Adobe Reader universal XSS problem.
MFSA 2007-03/CVE-2007-0778: AAd reported a potential disk cache collision that could be exploited by remote attackers to steal confidential data or execute code.
MFSA 2007-04/CVE-2007-0779: David Eckel reported that browser UI elements--such as the host name and security indicators--could be spoofed by using a large, mostly transparent, custom cursor and adjusting the CSS3 hotspot property so that the visible part of the cursor floated outside the browser content area.
MFSA 2007-05: Manually opening blocked popups could be exploited by remote attackers to allow XSS attacks (CVE-2007-0780) or to execute code in local files (CVE-2007-0800).
MFSA 2007-06: Two buffer overflows were found in the NSS handling of Mozilla.
- CVE-2007-0008: SSL clients such as Firefox and Thunderbird can suffer a buffer overflow if a malicious server presents a certificate with a public key that is too small to encrypt the entire "Master Secret". Exploiting this overflow appears to be unreliable but possible if the SSLv2 protocol is enabled.
- CVE-2007-0009: Servers that use NSS for the SSLv2 protocol can be exploited by a client that presents a "Client Master Key" with invalid length values in any of several fields that are used without adequate error checking. This can lead to a buffer overflow that presumably could be exploitable.
MFSA 2007-06/CVE-2007-0981: Michal Zalewski demonstrated that setting location.hostname to a value with embedded null characters can confuse the browsers domain checks. Setting the value triggers a load, but the networking software reads the hostname only up to the null character while other checks for "parent domain" start at the right and so can have a completely different idea of what the current host is.

Since the Mozilla Suite is discontinued, this update contains a version upgrade to the SeaMonkey Suite version 1.0.8.

Solution

Please install the updates provided at the location noted below.

Installation notes

This update is provided as an RPM package that can easily be installed onto a running system by using this command:


rpm -Fvh mozilla.rpm mozilla-calendar.rpm mozilla-devel.rpm mozilla-dom-inspector.rpm mozilla-irc.rpm mozilla-mail.rpm mozilla-venkman.rpm mozilla-cs.rpm mozilla-deat.rpm mozilla-hu.rpm mozilla-lib64.rpm

links to download packages

Download Source Packages

Download the source code of the patches for maintained products.

Disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.

Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.