CVE-2006-3803
CVSS5.1
发布时间 :2006-07-27 15:04:00
修订时间 :2013-08-27 01:18:15
NMCOP    

[原文]Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code by causing the garbage collector to delete a temporary variable while it is still being used during the creation of a new Function object.


[CNNVD]Mozilla Firefox/SeaMonkey/Thunderbird JAVA脚本的碎片收集临时变量漏洞(CNNVD-200607-475)

        Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
        上述产品中存在多个安全漏洞,具体如下:
        JAVA脚本的竞争条件下的碎片收集,允许远程攻击者执行任意代码利用碎片收集恢复历史删除的临时变量,并继续使用当在一个新的功能对象建立之前.

- CVSS (基础分值)

CVSS分值: 5.1 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:mozilla:firefox:1.5Mozilla Firefox 1.5
cpe:/a:mozilla:seamonkey:1.0.2Mozilla SeaMonkey 1.0.2
cpe:/a:mozilla:thunderbird:1.5Mozilla Thunderbird 1.5
cpe:/a:mozilla:seamonkey:1.0.1Mozilla SeaMonkey 1.0.1
cpe:/a:mozilla:firefox:1.5.0.4Mozilla Firefox 1.5.0.4
cpe:/a:mozilla:firefox:1.5.0.1Mozilla Firefox 1.5.0.1
cpe:/a:mozilla:thunderbird:1.5.0.2Mozilla Thunderbird 1.5.0.2
cpe:/a:mozilla:firefox:1.5.0.2Mozilla Firefox 1.5.0.2
cpe:/a:mozilla:firefox:1.5.0.3Mozilla Firefox 1.5.0.3
cpe:/a:mozilla:thunderbird:1.5.0.4Mozilla Thunderbird 1.5.0.4
cpe:/a:mozilla:seamonkey:1.0::dev
cpe:/a:mozilla:seamonkey:1.0Mozilla SeaMonkey 1.0

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:10635Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before ...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3803
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200607-475
(官方数据源) CNNVD

- 其它链接及资源

http://www.us-cert.gov/cas/techalerts/TA06-208A.html
(UNKNOWN)  CERT  TA06-208A
http://www.kb.cert.org/vuls/id/265964
(VENDOR_ADVISORY)  CERT-VN  VU#265964
http://www.securityfocus.com/bid/19181
(PATCH)  BID  19181
http://secunia.com/advisories/21229
(VENDOR_ADVISORY)  SECUNIA  21229
http://secunia.com/advisories/21228
(VENDOR_ADVISORY)  SECUNIA  21228
http://secunia.com/advisories/21216
(VENDOR_ADVISORY)  SECUNIA  21216
http://secunia.com/advisories/19873
(VENDOR_ADVISORY)  SECUNIA  19873
https://issues.rpath.com/browse/RPL-537
(UNKNOWN)  CONFIRM  https://issues.rpath.com/browse/RPL-537
https://issues.rpath.com/browse/RPL-536
(UNKNOWN)  CONFIRM  https://issues.rpath.com/browse/RPL-536
http://xforce.iss.net/xforce/xfdb/27984
(UNKNOWN)  XF  mozilla-javascript-garbage-race-condition(27984)
http://www.vupen.com/english/advisories/2008/0083
(UNKNOWN)  VUPEN  ADV-2008-0083
http://www.vupen.com/english/advisories/2006/3749
(UNKNOWN)  VUPEN  ADV-2006-3749
http://www.vupen.com/english/advisories/2006/3748
(UNKNOWN)  VUPEN  ADV-2006-3748
http://www.vupen.com/english/advisories/2006/2998
(UNKNOWN)  VUPEN  ADV-2006-2998
http://www.ubuntulinux.org/support/documentation/usn/usn-329-1
(UNKNOWN)  UBUNTU  USN-329-1
http://www.ubuntulinux.org/support/documentation/usn/usn-327-1
(UNKNOWN)  UBUNTU  USN-327-1
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  SSRT061181
http://www.securityfocus.com/archive/1/archive/1/446657/100/200/threaded
(UNKNOWN)  HP  HPSBUX02156
http://www.securityfocus.com/archive/1/archive/1/441333/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060727 rPSA-2006-0137-1 firefox
http://www.redhat.com/support/errata/RHSA-2006-0611.html
(UNKNOWN)  REDHAT  RHSA-2006:0611
http://www.redhat.com/support/errata/RHSA-2006-0610.html
(UNKNOWN)  REDHAT  RHSA-2006:0610
http://www.redhat.com/support/errata/RHSA-2006-0608.html
(UNKNOWN)  REDHAT  RHSA-2006:0608
http://www.novell.com/linux/security/advisories/2006_48_seamonkey.html
(UNKNOWN)  SUSE  SUSE-SA:2006:048
http://www.mozilla.org/security/announce/2006/mfsa2006-48.html
(UNKNOWN)  CONFIRM  http://www.mozilla.org/security/announce/2006/mfsa2006-48.html
http://www.gentoo.org/security/en/glsa/glsa-200608-03.xml
(UNKNOWN)  GENTOO  GLSA-200608-03
http://securitytracker.com/id?1016588
(UNKNOWN)  SECTRACK  1016588
http://securitytracker.com/id?1016587
(UNKNOWN)  SECTRACK  1016587
http://securitytracker.com/id?1016586
(UNKNOWN)  SECTRACK  1016586
http://security.gentoo.org/glsa/glsa-200608-04.xml
(UNKNOWN)  GENTOO  GLSA-200608-04
http://security.gentoo.org/glsa/glsa-200608-02.xml
(UNKNOWN)  GENTOO  GLSA-200608-02
http://secunia.com/advisories/21607
(UNKNOWN)  SECUNIA  21607
http://secunia.com/advisories/21532
(UNKNOWN)  SECUNIA  21532
http://secunia.com/advisories/21529
(UNKNOWN)  SECUNIA  21529
http://secunia.com/advisories/21361
(UNKNOWN)  SECUNIA  21361
http://secunia.com/advisories/21358
(UNKNOWN)  SECUNIA  21358
http://secunia.com/advisories/21343
(UNKNOWN)  SECUNIA  21343
http://secunia.com/advisories/21336
(UNKNOWN)  SECUNIA  21336
http://secunia.com/advisories/21275
(UNKNOWN)  SECUNIA  21275
http://secunia.com/advisories/21270
(UNKNOWN)  SECUNIA  21270
http://secunia.com/advisories/21269
(UNKNOWN)  SECUNIA  21269
http://secunia.com/advisories/21262
(UNKNOWN)  SECUNIA  21262
http://secunia.com/advisories/21250
(UNKNOWN)  SECUNIA  21250
http://secunia.com/advisories/21246
(UNKNOWN)  SECUNIA  21246
http://secunia.com/advisories/21243
(UNKNOWN)  SECUNIA  21243
http://rhn.redhat.com/errata/RHSA-2006-0609.html
(UNKNOWN)  REDHAT  RHSA-2006:0609
ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc
(UNKNOWN)  SGI  20060703-01-P
http://www.ubuntu.com/usn/usn-354-1
(UNKNOWN)  UBUNTU  USN-354-1
http://www.ubuntu.com/usn/usn-350-1
(UNKNOWN)  UBUNTU  USN-350-1
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  HPSBUX02153
http://www.securityfocus.com/archive/1/archive/1/446657/100/200/threaded
(UNKNOWN)  HP  SSRT061236
http://www.redhat.com/support/errata/RHSA-2006-0594.html
(UNKNOWN)  REDHAT  RHSA-2006:0594
http://www.mandriva.com/security/advisories?name=MDKSA-2006:146
(UNKNOWN)  MANDRIVA  MDKSA-2006:146
http://www.mandriva.com/security/advisories?name=MDKSA-2006:145
(UNKNOWN)  MANDRIVA  MDKSA-2006:145
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
(UNKNOWN)  MANDRIVA  MDKSA-2006:143
http://secunia.com/advisories/22210
(UNKNOWN)  SECUNIA  22210
http://secunia.com/advisories/22066
(UNKNOWN)  SECUNIA  22066
http://secunia.com/advisories/22065
(UNKNOWN)  SECUNIA  22065
http://secunia.com/advisories/22055
(UNKNOWN)  SECUNIA  22055
http://secunia.com/advisories/21631
(UNKNOWN)  SECUNIA  21631

- 漏洞信息

Mozilla Firefox/SeaMonkey/Thunderbird JAVA脚本的碎片收集临时变量漏洞
中危 资料不足
2006-07-27 00:00:00 2006-08-26 00:00:00
远程  
        Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
        上述产品中存在多个安全漏洞,具体如下:
        JAVA脚本的竞争条件下的碎片收集,允许远程攻击者执行任意代码利用碎片收集恢复历史删除的临时变量,并继续使用当在一个新的功能对象建立之前.

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://lwn.net/Alerts/193397/?format=printable
        http://lwn.net/Alerts/193396/?format=printable
        http://lwn.net/Alerts/193263/?format=printable

- 漏洞信息 (F49350)

Mandriva Linux Security Advisory 2006.143 (PacketStormID:F49350)
2006-08-27 00:00:00
Mandriva  mandriva.com
advisory,vulnerability
linux,mandriva
CVE-2006-2613,CVE-2006-2894,CVE-2006-2775,CVE-2006-2776,CVE-2006-2777,CVE-2006-2778,CVE-2006-2779,CVE-2006-2780,CVE-2006-2782,CVE-2006-2783,CVE-2006-2784,CVE-2006-2785,CVE-2006-2786,CVE-2006-2787,CVE-2006-2788,CVE-2006-3677,CVE-2006-3803,CVE-2006-3804
[点击下载]

Mandriva Linux Security Advisory MDKSA-2006-143 - A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:143
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : mozilla-firefox
 Date    : August 16, 2006
 Affected: 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 A number of security vulnerabilities have been discovered and corrected
 in the latest Mozilla Firefox program.
 
 Previous updates to Firefox were patch fixes to Firefox 1.0.6 that
 brought it in sync with 1.0.8 in terms of security fixes.  In this
 update, Mozilla Firefox 1.5.0.6 is being provided which corrects a
 number of vulnerabilities that were previously unpatched, as well as
 providing new and enhanced features.
 
 The following CVE names have been corrected with this update:
 CVE-2006-2613, CVE-2006-2894, CVE-2006-2775, CVE-2006-2776,
 CVE-2006-2777, CVE-2006-2778, CVE-2006-2779, CVE-2006-2780,
 CVE-2006-2782, CVE-2006-2783, CVE-2006-2784, CVE-2006-2785, 
 CVE-2006-2786, CVE-2006-2787, CVE-2006-2788, CVE-2006-3677,
 CVE-2006-3803, CVE-2006-3804, CVE-2006-3806, CVE-2006-3807,
 CVE-2006-3113, CVE-2006-3801, CVE-2006-3802, CVE-2006-3805,
 CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
 CVE-2006-3812.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2613
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2894
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2777
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2782
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2784
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2785
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2787
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2788
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812
 http://www.mozilla.org/security/announce/2006/mfsa2006-31.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-32.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-33.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-34.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-35.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-36.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-37.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-38.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-39.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-41.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-42.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-43.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-44.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-46.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-47.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-48.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-50.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-51.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-52.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-53.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-54.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-55.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-56.html
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 76ef1a2e7338c08e485ab2c19a1ce691  2006.0/RPMS/devhelp-0.10-7.1.20060mdk.i586.rpm
 d44f02b82df9f404f899ad8bc4bdd6a2  2006.0/RPMS/epiphany-1.8.5-4.1.20060mdk.i586.rpm
 29efc065aeb4a53a105b2c27be816758  2006.0/RPMS/epiphany-devel-1.8.5-4.1.20060mdk.i586.rpm
 caad34c0d4c16a50ec4b05820e6d01db  2006.0/RPMS/galeon-2.0.1-1.1.20060mdk.i586.rpm
 d0e75938f4e129936351f015bd90a37a  2006.0/RPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.noarch.rpm
 652044ff7d9c3170df845011ec696393  2006.0/RPMS/libdevhelp-1_0-0.10-7.1.20060mdk.i586.rpm
 bf6dcf87f409d06b42234dbca387b922  2006.0/RPMS/libdevhelp-1_0-devel-0.10-7.1.20060mdk.i586.rpm
 e9aaff3090a4459b57367f4903b0458a  2006.0/RPMS/libnspr4-1.5.0.6-1.4.20060mdk.i586.rpm
 fa99cbc159722cc0ff9e5710f24ca599  2006.0/RPMS/libnspr4-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d4d45b797ca2f2347c0409d9f956ff25  2006.0/RPMS/libnspr4-static-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 8d33e72703090a911f7fd171ad9dd719  2006.0/RPMS/libnss3-1.5.0.6-1.4.20060mdk.i586.rpm
 23afd287c042c5492c210255554a6893  2006.0/RPMS/libnss3-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 4a188f54230b943ea9c8930eb2e0cfe1  2006.0/RPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.i586.rpm
 5bec4690547fd733ca97cb2933ebe427  2006.0/RPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.i586.rpm
 55836595e5cba3828a9a5a27e5aa1825  2006.0/RPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.i586.rpm
 0faf5ee7022ee0b70915d2c845865cae  2006.0/RPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.i586.rpm
 312a89317692b3bd86060a1995365d86  2006.0/RPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.i586.rpm
 38215dccbee8a169bcbac2af2897c2f7  2006.0/RPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.i586.rpm
 aaba2fa72f8de960a3a757b3010027d3  2006.0/RPMS/mozilla-firefox-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d8d59a55974f6fa20d99fb30f126638f  2006.0/RPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.i586.rpm
 946e6a76c71dbbee3340f1a96ae25a1d  2006.0/RPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.i586.rpm
 9a14c31a41c2bac3942caa3d1fb5daee  2006.0/RPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.i586.rpm
 b5074c27d1cb719bf9f8fabe8aebf628  2006.0/RPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.i586.rpm
 7a225cdfdf0c17c0f4a72ad27907fc07  2006.0/RPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.i586.rpm
 06526a054d108d3c9b5f66313151ecc2  2006.0/RPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.i586.rpm
 8f721bd3914c31e04359def6272db929  2006.0/RPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.i586.rpm
 a704ed726e6db4ba59592563cd2c48b0  2006.0/RPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.i586.rpm
 0ef6729b05e013a364e847e4a1b7b3e3  2006.0/RPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.i586.rpm
 570b19872de676414b399ff970024b78  2006.0/RPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.i586.rpm
 dee38f0bbe3870d3bd8ad02ea968c57a  2006.0/RPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.i586.rpm
 92916e155ec38b5078234728593d72a2  2006.0/RPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.i586.rpm
 c808f2f32fc9e514ffb097eeeb226a96  2006.0/RPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.i586.rpm
 6dda5771d062eae75f8f04b7dab8d6cc  2006.0/RPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.i586.rpm
 c4ac8441170504cc5ec05cf5c8e6e9f9  2006.0/RPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.i586.rpm
 2765008afd4c0ba1d702eda9627a7690  2006.0/RPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.i586.rpm
 15b600977b07651f1c3568f4d7f1f9ac  2006.0/RPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.i586.rpm
 6f1fae6befe608fc841fcc71e15852c0  2006.0/RPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.i586.rpm
 81f412da40ea14bcc23d420d7a5724f9  2006.0/RPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.i586.rpm
 76e0ece3c0b6f507340871a168a57e36  2006.0/RPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.i586.rpm
 6ded58e85ed113718cfb3484ae420bb9  2006.0/RPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.i586.rpm
 c76f6648e88de4a63991eac66c3fba04  2006.0/RPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.i586.rpm
 1c7ab93275bcdcf30ed9ec2ddb4893df  2006.0/RPMS/yelp-2.10.0-6.1.20060mdk.i586.rpm
 60279919aa5f17c2ecd9f64db87cb952  2006.0/SRPMS/devhelp-0.10-7.1.20060mdk.src.rpm
 c446c046409b6697a863868fe5c64222  2006.0/SRPMS/epiphany-1.8.5-4.1.20060mdk.src.rpm
 e726300336f737c8952f664bf1866d6f  2006.0/SRPMS/galeon-2.0.1-1.1.20060mdk.src.rpm
 e9e30596eceb0bc9a03f7880cd7d14ea  2006.0/SRPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.src.rpm
 4168c73cba97276fa4868b4ac2c7eb19  2006.0/SRPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.src.rpm
 6a7df29f5af703d10d7ea1fee160ac00  2006.0/SRPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.src.rpm
 e56e14c28051ec4332cbde8dbee7bb6a  2006.0/SRPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.src.rpm
 1a144c86fd8db39e2801117296e15d2b  2006.0/SRPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.src.rpm
 f4889d2ee6e07c0141b57ab9aaccae64  2006.0/SRPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.src.rpm
 dee0f7bc91c797e880fff19e1cb05a63  2006.0/SRPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.src.rpm
 45724f6ceed66701392bd131feaf1f6d  2006.0/SRPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.src.rpm
 cc680cac7fea3f7f8a48a5daf86db088  2006.0/SRPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.src.rpm
 69b04335c21313262af4253863109cc8  2006.0/SRPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.src.rpm
 2aab89244a535afcbc25271df5d6b33f  2006.0/SRPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.src.rpm
 f1c7f71d5484c5047b1b38fc16888ae3  2006.0/SRPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.src.rpm
 3963e3c3a2c38c41d9d3bc5250b124a6  2006.0/SRPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.src.rpm
 bb54aed17a126a9e8568d49866db99ea  2006.0/SRPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.src.rpm
 2a1b11f2c8944bc1fc0d313d54a903cf  2006.0/SRPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.src.rpm
 783c5b3c0fb9916e07f220110155476d  2006.0/SRPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.src.rpm
 895e315731fa0b453045cc39da4f5358  2006.0/SRPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.src.rpm
 daa0a127d2a1a3641d4e97bfb95f1647  2006.0/SRPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.src.rpm
 0c778b0738b11dfd5d68be48fa6316ed  2006.0/SRPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.src.rpm
 7025d0118cf29e39117bd87c586e84a3  2006.0/SRPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.src.rpm
 5d8b8e869f588c0f5751e9ce7addba45  2006.0/SRPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.src.rpm
 c5148674a8c7dd1f88c5729293f899ba  2006.0/SRPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.src.rpm
 91d490c075473e2443e383201b961cb8  2006.0/SRPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.src.rpm
 622ae4619d151bb1634113e50b30fbac  2006.0/SRPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.src.rpm
 e6d64c14929d299e2fb52e334ae6641a  2006.0/SRPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.src.rpm
 20f64c6dfd6aa1450cba5002d42f53d8  2006.0/SRPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.src.rpm
 b93a6b548bb1cf0f8cc46dec133e81a3  2006.0/SRPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.src.rpm
 f5603b65b3d10fa5083934e08d2d4560  2006.0/SRPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.src.rpm
 c0e978ea92b4a8f3aa75dad5ab7588b9  2006.0/SRPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.src.rpm
 93cb0acaeddb095d13b37aeb0ab4dd49  2006.0/SRPMS/yelp-2.10.0-6.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 d52f4955f15f99137dd9a0b2f360c8b2  x86_64/2006.0/RPMS/devhelp-0.10-7.1.20060mdk.x86_64.rpm
 369457b4a09c07ba18ee5bb18fb2ffa1  x86_64/2006.0/RPMS/epiphany-1.8.5-4.1.20060mdk.x86_64.rpm
 76735684f3ff493770e374a90fd359c7  x86_64/2006.0/RPMS/epiphany-devel-1.8.5-4.1.20060mdk.x86_64.rpm
 5da75ab6624f8c8f0c212ce2299d645f  x86_64/2006.0/RPMS/galeon-2.0.1-1.1.20060mdk.x86_64.rpm
 945059b9456c9ff2ccd40ff4a6d8ae70  x86_64/2006.0/RPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.noarch.rpm
 193f97760bb46e16051ba7b6b968f340  x86_64/2006.0/RPMS/lib64devhelp-1_0-0.10-7.1.20060mdk.x86_64.rpm
 1b67733b0450cd6572c9879c0eb38640  x86_64/2006.0/RPMS/lib64devhelp-1_0-devel-0.10-7.1.20060mdk.x86_64.rpm
 115fcbc6c99bf063cd1768d2b08e9d89  x86_64/2006.0/RPMS/lib64nspr4-1.5.0.6-1.4.20060mdk.x86_64.rpm
 686404fa32e2625f23b19e11c548bbe5  x86_64/2006.0/RPMS/lib64nspr4-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 f0886b330d3f5af566af6cf5572ca671  x86_64/2006.0/RPMS/lib64nspr4-static-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 10e9abdcb3f952c4db35c85fe58ad8ad  x86_64/2006.0/RPMS/lib64nss3-1.5.0.6-1.4.20060mdk.x86_64.rpm
 202bab2742f162d1cbd6d36720e6f7fb  x86_64/2006.0/RPMS/lib64nss3-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 e9aaff3090a4459b57367f4903b0458a  x86_64/2006.0/RPMS/libnspr4-1.5.0.6-1.4.20060mdk.i586.rpm
 fa99cbc159722cc0ff9e5710f24ca599  x86_64/2006.0/RPMS/libnspr4-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d4d45b797ca2f2347c0409d9f956ff25  x86_64/2006.0/RPMS/libnspr4-static-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 8d33e72703090a911f7fd171ad9dd719  x86_64/2006.0/RPMS/libnss3-1.5.0.6-1.4.20060mdk.i586.rpm
 23afd287c042c5492c210255554a6893  x86_64/2006.0/RPMS/libnss3-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 74811077c91dde3bc8c8bae45e5862a7  x86_64/2006.0/RPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.x86_64.rpm
 75711988a67bf3f36fc08823561bb2b7  x86_64/2006.0/RPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.x86_64.rpm
 5bd9ad43769390549ab3c4549c971db7  x86_64/2006.0/RPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.x86_64.rpm
 dfdd808e2ec0866c15db5f1ea6a5b5bd  x86_64/2006.0/RPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.x86_64.rpm
 1fad19f458ce0aa50e86710ed3b7fe04  x86_64/2006.0/RPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.x86_64.rpm
 743e8d4f009ab2d2fc2e8c131244fb57  x86_64/2006.0/RPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.x86_64.rpm
 476ee9a87f650a0ef3523a9619f9f611  x86_64/2006.0/RPMS/mozilla-firefox-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 be48721cbc6e5634b50ce5b6cfe4a951  x86_64/2006.0/RPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.x86_64.rpm
 e56ce18466e20db3189e035329c606ce  x86_64/2006.0/RPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.x86_64.rpm
 489e5940c9ac9573842888ff07436e4c  x86_64/2006.0/RPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.x86_64.rpm
 73d2eb2fc6ec99a1d3eeb94d9ddff36e  x86_64/2006.0/RPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.x86_64.rpm
 acbd3cd5f82b47a6c6cb03ebd6ca25ae  x86_64/2006.0/RPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.x86_64.rpm
 362807f9da1130dd8da606b9ded06311  x86_64/2006.0/RPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.x86_64.rpm
 e48c991fa555d22d1f382baa83dfcae9  x86_64/2006.0/RPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.x86_64.rpm
 0d954f47de6d2cc58e36cd2c9ddae09c  x86_64/2006.0/RPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.x86_64.rpm
 8f615598d04985a0d60a3469ea3044ed  x86_64/2006.0/RPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.x86_64.rpm
 f4810510feb31e6195358c5ddd87252f  x86_64/2006.0/RPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.x86_64.rpm
 537d53b7805ac84009f2ff99e3282b91  x86_64/2006.0/RPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.x86_64.rpm
 afbc9ee04902213758bbf262b732de21  x86_64/2006.0/RPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 dcef8c7676529394e5fbd4168f8e2cd6  x86_64/2006.0/RPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 f4ee0e7ecba430fd3ce5e8ebeda9b5c1  x86_64/2006.0/RPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.x86_64.rpm
 778261355184ca73cbf1aab1ce56644d  x86_64/2006.0/RPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.x86_64.rpm
 10ca4e7f4cf10c380849ced0bf83e08b  x86_64/2006.0/RPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.x86_64.rpm
 427cabc08ec66e1a45bc27e5625f49bb  x86_64/2006.0/RPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.x86_64.rpm
 de4e61d4fce7cd286bb4a3778cb8499f  x86_64/2006.0/RPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 86e9af4c42b59e32d4e5ac0a8d1afe30  x86_64/2006.0/RPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.x86_64.rpm
 126b1e0826330986fbf485eabade949d  x86_64/2006.0/RPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.x86_64.rpm
 d2e6da2db277b7f5dabed3e95d4b818b  x86_64/2006.0/RPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.x86_64.rpm
 a83edee07d2465cf55024ed1b7aa779f  x86_64/2006.0/RPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.x86_64.rpm
 9e33e2a0c3d4a92a0b420c417fcd3469  x86_64/2006.0/RPMS/yelp-2.10.0-6.1.20060mdk.x86_64.rpm
 60279919aa5f17c2ecd9f64db87cb952  x86_64/2006.0/SRPMS/devhelp-0.10-7.1.20060mdk.src.rpm
 c446c046409b6697a863868fe5c64222  x86_64/2006.0/SRPMS/epiphany-1.8.5-4.1.20060mdk.src.rpm
 e726300336f737c8952f664bf1866d6f  x86_64/2006.0/SRPMS/galeon-2.0.1-1.1.20060mdk.src.rpm
 e9e30596eceb0bc9a03f7880cd7d14ea  x86_64/2006.0/SRPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.src.rpm
 4168c73cba97276fa4868b4ac2c7eb19  x86_64/2006.0/SRPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.src.rpm
 6a7df29f5af703d10d7ea1fee160ac00  x86_64/2006.0/SRPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.src.rpm
 e56e14c28051ec4332cbde8dbee7bb6a  x86_64/2006.0/SRPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.src.rpm
 1a144c86fd8db39e2801117296e15d2b  x86_64/2006.0/SRPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.src.rpm
 f4889d2ee6e07c0141b57ab9aaccae64  x86_64/2006.0/SRPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.src.rpm
 dee0f7bc91c797e880fff19e1cb05a63  x86_64/2006.0/SRPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.src.rpm
 45724f6ceed66701392bd131feaf1f6d  x86_64/2006.0/SRPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.src.rpm
 cc680cac7fea3f7f8a48a5daf86db088  x86_64/2006.0/SRPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.src.rpm
 69b04335c21313262af4253863109cc8  x86_64/2006.0/SRPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.src.rpm
 2aab89244a535afcbc25271df5d6b33f  x86_64/2006.0/SRPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.src.rpm
 f1c7f71d5484c5047b1b38fc16888ae3  x86_64/2006.0/SRPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.src.rpm
 3963e3c3a2c38c41d9d3bc5250b124a6  x86_64/2006.0/SRPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.src.rpm
 bb54aed17a126a9e8568d49866db99ea  x86_64/2006.0/SRPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.src.rpm
 2a1b11f2c8944bc1fc0d313d54a903cf  x86_64/2006.0/SRPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.src.rpm
 783c5b3c0fb9916e07f220110155476d  x86_64/2006.0/SRPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.src.rpm
 895e315731fa0b453045cc39da4f5358  x86_64/2006.0/SRPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.src.rpm
 daa0a127d2a1a3641d4e97bfb95f1647  x86_64/2006.0/SRPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.src.rpm
 0c778b0738b11dfd5d68be48fa6316ed  x86_64/2006.0/SRPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.src.rpm
 7025d0118cf29e39117bd87c586e84a3  x86_64/2006.0/SRPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.src.rpm
 5d8b8e869f588c0f5751e9ce7addba45  x86_64/2006.0/SRPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.src.rpm
 c5148674a8c7dd1f88c5729293f899ba  x86_64/2006.0/SRPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.src.rpm
 91d490c075473e2443e383201b961cb8  x86_64/2006.0/SRPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.src.rpm
 622ae4619d151bb1634113e50b30fbac  x86_64/2006.0/SRPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.src.rpm
 e6d64c14929d299e2fb52e334ae6641a  x86_64/2006.0/SRPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.src.rpm
 20f64c6dfd6aa1450cba5002d42f53d8  x86_64/2006.0/SRPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.src.rpm
 b93a6b548bb1cf0f8cc46dec133e81a3  x86_64/2006.0/SRPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.src.rpm
 f5603b65b3d10fa5083934e08d2d4560  x86_64/2006.0/SRPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.src.rpm
 c0e978ea92b4a8f3aa75dad5ab7588b9  x86_64/2006.0/SRPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.src.rpm
 93cb0acaeddb095d13b37aeb0ab4dd49  x86_64/2006.0/SRPMS/yelp-2.10.0-6.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE41l0mqjQ0CJFipgRAu1DAJ90MqoteYoIfAj0Gqim5fxrvOw7BACg0xq5
L8QZWCg0xY3ZRacFzNTgusw=
=gl6u
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F48662)

Ubuntu Security Notice 327-1 (PacketStormID:F48662)
2006-07-28 00:00:00
Ubuntu  security.ubuntu.com
advisory,javascript,vulnerability
linux,ubuntu
CVE-2006-3113,CVE-2006-3677,CVE-2006-3801,CVE-2006-3802,CVE-2006-3803,CVE-2006-3805,CVE-2006-3806,CVE-2006-3807,CVE-2006-3808,CVE-2006-3809,CVE-2006-3810,CVE-2006-3811,CVE-2006-3812
[点击下载]

Ubuntu Security Notice USN-327-1 - A multitude of javascript related vulnerabilities have been patched in Firefox.

=========================================================== 
Ubuntu Security Notice USN-327-1              July 27, 2006
firefox vulnerabilities
CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
CVE-2006-3812
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  firefox                      1.5.dfsg+1.5.0.5-0ubuntu6.06

After a standard system upgrade you need to restart Firefox to effect
the necessary changes.

Please note that Firefox 1.0.8 in Ubuntu 5.10 and Ubuntu 5.04 are also
affected by these problems. Updates for these Ubuntu releases will be
delayed due to upstream dropping support for this Firefox version. We
strongly advise that you disable JavaScript to disable the attack
vectors for most vulnerabilities if you use one of these Ubuntu
versions.

Details follow:

Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious URL. (CVE-2006-3113, CVE-2006-3677, CVE-2006-3801,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3809, CVE-2006-3811, CVE-2006-3812)

cross-site scripting vulnerabilities were found in the
XPCNativeWrapper() function and native DOM method handlers. A
malicious web site could exploit these to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-3802, CVE-2006-3810)

A bug was found in the script handler for automatic proxy
configuration. A malicious proxy could send scripts which could
execute arbitrary code with the user's privileges. (CVE-2006-3808)

Please see 

  http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox

for technical details of these vulnerabilities.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.diff.gz
      Size/MD5:   174602 7be6f5862219ac4cf44f05733f372f2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.dsc
      Size/MD5:     1109 252d6acf45b009008a6bc88166e2632f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5.orig.tar.gz
      Size/MD5: 44067762 749933c002e158576ec15782fc451e43

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    49190 850dd650e7f876dd539e605d9b3026c8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    50078 c1fa4a40187d9c5b58bd049edb00ce54

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5: 47269292 167aadc3f03b4e1b7cb9ed826e672983
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  2796768 b54592d0bd736f6ee12a90987771bc59
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   216136 79fa6c69ffb0dd6037e56d1ba538ff64
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:    82358 e2e026d582a7b5352cee4453cef0fe45
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  9400544 a9d0b804a4374dc636bb79968a2bce5c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   218822 a09476caea7d8d73d6a2f534bd494493
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   161876 0e0e65348dba8167b4891b173baa8f0d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   235746 064fc1434a315f857ee92f60fd49d772
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   757458 bd6a5e28e05a04a5deca731ab29f70e4

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5: 43837610 a7e4a535262f8a5d5cb0ace7ed785237
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  2796700 4509dbf62e3fd2cda7168c20aa65ba4f
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   209546 50e174c1c7290fca51f9e1ee71ebb56c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:    74732 25ba86caeeb1a88da4493875178a3636
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  7916536 40ebfe4330af25c2359f8b25b039ed5e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   218822 6066f59acbce1b4de2dc284b5801efc5
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   146570 c1a5c5cc4371b228093d03d9ed7ad607
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   235754 0e9a1a89f63a9869b875ee6a50547c2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   669556 d537a4771b80e5c06f18b2c5d7e5d384

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5: 48648192 479d29e08ff2b9cef89a6da3285c0aad
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  2796790 60b97738bfc3b8b32914487bb4aba239
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   212982 a396e119a32303afc024d513b997c84e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:    77894 ef7841bb2ab8de0e0c44e59c893b1622
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  9019132 ed3927484eea5fccf84a2840640febf3
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   218826 a2338c3c8064a304deb752bf32a291f8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   159112 7d5d6100727ceb894695b219cec11e43
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   235754 69085beb145222fea07d2d6c19158a2d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   768332 8dc6cc8c54185d57af14bab3bee39f9d

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5: 45235424 f5a07188af5802fffbd3cfdd64b109cf
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  2796756 cb13c7ea0e3b7af2f1e12db1f8dc38a2
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   210488 17f7723b697110c8f132422bc059d447
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:    76340 c38ccb8b71b9c3783a1c9816ecd9cf5d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  8411310 4b3865b2df3924d094e0b18f207bf33d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   218814 a0e67d0d425cea2cd5835e2c2faa930f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   149018 73108368f0ef745188ebd1c48ea10c88
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   235746 695a6122710fb30201daaa239ba6d48d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   681612 896721beb3cdcea12bab98223c0796c2
    

- 漏洞信息 (F48661)

Technical Cyber Security Alert 2006-208A (PacketStormID:F48661)
2006-07-28 00:00:00
US-CERT  cert.org
advisory,remote,web,arbitrary,vulnerability
CVE-2006-3801,CVE-2006-3677,CVE-2006-3113,CVE-2006-3803,CVE-2006-3805,CVE-2006-3804,CVE-2006-3806,CVE-2006-3807,CVE-2006-3811
[点击下载]

Technical Cyber Security Alert TA06-208A - The Mozilla web browser and derived products contain several vulnerabilities, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                        National Cyber Alert System

                 Technical Cyber Security Alert TA06-208A


Mozilla Products Contain Multiple Vulnerabilities

   Original release date: July 27, 2006
   Last revised: --
   Source: US-CERT


Systems Affected

     * Mozilla SeaMonkey
     * Mozilla Firefox
     * Mozilla Thunderbird

   Any products based on Mozilla components, specifically Gecko, may also
   be affected.


Overview

   The Mozilla web browser and derived products contain several
   vulnerabilities, the most serious of which could allow a remote
   attacker to execute arbitrary code on an affected system.


I. Description

   Several vulnerabilities have been reported in the Mozilla web browser
   and derived products. More detailed information is available in the
   individual vulnerability notes, including the following:


   VU#476724 - Mozilla products fail to properly handle frame references 

   Mozilla products fail to properly handle frame or window references.
   This may allow a remote attacker to execute arbitrary code on a
   vulnerable system.
   (CVE-2006-3801)


   VU#670060 - Mozilla fails to properly release JavaScript references 

   Mozilla products fail to properly release memory. This vulnerability
   may allow a remote attacker to execute code on a vulnerable system.
   (CVE-2006-3677)


   VU#239124 - Mozilla fails to properly handle simultaneous XPCOM events
   
   Mozilla products are vulnerable to memory corruption via simultaneous
   XPCOM events. This may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3113)


   VU#265964 - Mozilla products contain a race condition 

   Mozilla products contain a race condition. This vulnerability may
   allow a remote attacker to execute code on a vulnerable system.
   (CVE-2006-3803)


   VU#897540 - Mozilla products VCard attachment buffer overflow 

   Mozilla products fail to properly handle malformed VCard attachments,
   allowing a buffer overflow to occur. This vulnerability may allow a
   remote attacker to execute arbitrary code on a vulnerable system.
   (CVE-2006-3804)


   VU#876420 - Mozilla fails to properly handle garbage collection 

   The Mozilla JavaScript engine fails to properly perform garbage
   collection, which may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3805)


   VU#655892 - Mozilla JavaScript engine contains multiple integer
   overflows 

   The Mozilla JavaScript engine contains multiple integer overflows.
   This vulnerability may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3806)


   VU#687396 - Mozilla products fail to properly validate JavaScript
   constructors 

   Mozilla products fail to properly validate references returned by
   JavaScript constructors. This vulnerability may allow a remote
   attacker to execute arbitrary code on a vulnerable system.
   (CVE-2006-3807)


   VU#527676 - Mozilla contains multiple memory corruption
   vulnerabilities 

   Mozilla products contain multiple vulnerabilities that can cause
   memory corruption. This may allow a remote attacker to execute
   arbitrary code on a vulnerable system.
   (CVE-2006-3811)


II. Impact

   A remote, unauthenticated attacker could execute arbitrary code on a
   vulnerable system. An attacker may also be able to cause the
   vulnerable application to crash.


III. Solution

Upgrade

   Upgrade to Mozilla Firefox 1.5.0.5, Mozilla Thunderbird 1.5.0.5, or
   SeaMonkey 1.0.3.

Disable JavaScript and Java

   These vulnerabilities can be mitigated by disabling JavaScript and
   Java in all affected products. Instructions for disabling Java in
   Firefox can be found in the "Securing Your Web Browser" document.


Appendix A. References

     * US-CERT Vulnerability Notes Related to July Mozilla Security
       Advisories -
       <http://www.kb.cert.org/vuls/byid?searchview&query=firefox_1505>

     * CVE-2006-3081 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801>

     * CVE-2006-3677 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677>

     * CVE-2006-3113 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113>

     * CVE-2006-3803 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803>

     * CVE-2006-3804 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804>

     * CVE-2006-3805 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805>

     * CVE-2006-3806 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806>

     * CVE-2006-3807 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807>

     * CVE-2006-3811 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811>

     * Mozilla Foundation Security Advisories -
       <http://www.mozilla.org/security/announce/>

     * Known Vulnerabilities in Mozilla Products -
       <http://www.mozilla.org/projects/security/known-vulnerabilities.html>

     * Securing Your Web Browser -
       <http://www.us-cert.gov/reading_room/securing_browser/browser_security.html#Mozilla_Firefox>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA06-208A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA06-208A Feedback VU#239124" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2006 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   Jul 27, 2006: Initial release


    
    

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRMkgNexOF3G+ig+rAQIFsAgAoWoMkxxhkzb+xgLVCJF7h4k4EBCgJGWa
BSOiFfL4Gs4vv4lNooDRCIOdxiBfXYL71XsIOT4aWry5852/6kyYnyAiXXYj1Uv0
SbPY2sQSZ5EaG+G9i8HDIy3fpJN4XgH3ng1uzUnJihY19IfndbXicpZE+debIUri
qt9NRD2f5FW5feKo1cBpYxtmxQAEePOa2dJHh7I7cnFGtG3MixHx4kVEyuYUutCX
5tHDsfTIdySNkIdCQ4vhk846bErB/kaHiKMQDfMglllb3GOSc07OQ0CDo2eTPVsA
9DtKkiDP1C4dh1mxco8CWlS6327+EB0KXGGoqDF2+j/rrpsW0oc8nA==
=HwuK
-----END PGP SIGNATURE-----
    

- 漏洞信息

27562
Mozilla Multiple Products JavaScript Garbage Collection Race Condition Arbitrary Code Execution
Loss of Integrity
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-07-25 Unknow
Unknow Unknow

- 解决方案

Upgrade Firefox to version 1.5.0.5, Thunderbird to 1.5.0.5, or Seamonkey to version 1.0.3, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站