Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> Gentoo Local Security Checks >> [GLSA-200503-30] Mozilla Suite: Multiple vulnerabilities


Vulnerability Assessment Details

[GLSA-200503-30] Mozilla Suite: Multiple vulnerabilities

Vulnerability Assessment Summary
Mozilla Suite: Multiple vulnerabilities

Detailed Explanation for this Vulnerability Assessment
The remote host is affected by the vulnerability described in GLSA-200503-30
(Mozilla Suite: Multiple vulnerabilities)

Impact

The GIF heap overflow could be triggered by a malicious GIF
image that would end up executing arbitrary code with the rights of the
user running Mozilla. The other overflow issues, while not thought to
be exploitable, would have the same impact
By setting up
malicious websites and convincing users to follow untrusted links or
obey very specific drag-and-drop or download instructions, attackers
may leverage the various spoofing issues to fake other websites to get
access to confidential information, push users to download malicious
files or make them interact with their browser preferences
The
temporary directory issue permits local attackers to overwrite arbitrary
files with the rights of another local user

Workaround

There is no known workaround at this time.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1156
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0230
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0233
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0399
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0527
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0578
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0584
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0585
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0588
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0590
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0591
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0592
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0593
http://www.mozilla.org/projects/security/known-vulnerabilities.html


Solution:
All Mozilla Suite users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.6"
All Mozilla Suite binary users should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.6"


Network Security Threat Level: Medium


Networks Security ID:

Vulnerability Assessment Copyright: (C) 2005 Michel Arboi

Cables, Connectors

HP Z420 Workstation Intel Xeon E5-1607 3.0GHz 16GB RAM 1TB HDD NVS 310
$180.0
HP Z420 Workstation Intel Xeon E5-1607 3.0GHz 16GB RAM 1TB HDD NVS 310 pictureEXC 8GB Samsung PC3-14900R DDR3 1866 2Rx8 Server Memory Ram M393B1G73QH0-CMA
$29.99
EXC 8GB Samsung PC3-14900R DDR3 1866 2Rx8 Server Memory Ram M393B1G73QH0-CMA pictureHPE HP DL380 G9 Gen9 SERVER E5-2698V3 2.3GHZ 384GB 300GB 10K
$8029.0
HPE HP DL380 G9 Gen9 SERVER E5-2698V3 2.3GHZ 384GB 300GB 10K pictureDELL POWEREDGE R730 16 BAY E5-2687WV3 3.1GHZ 16GB 2 X 600GB 15K SAS H730
$4439.0
DELL POWEREDGE R730 16 BAY E5-2687WV3 3.1GHZ 16GB 2 X 600GB 15K SAS H730 picture


Discussions

No Discussions have been posted on this vulnerability.