U web pregledniku Iceweasel uočeni su sigurnosni propusti koji udaljenim, zlonamjernim napadačima omogućuju otkrivanje osjetljivih informacija, izvršavanje proizvoljnog programskog koda te dobivanje većih privilegija.
Paket:
iceweasel 1.x, iceweasel 3.x, iceweasel 6.x
Operacijski sustavi:
Debian Linux 5.0 (lenny), Debian Linux 6.0 (squeeze)
Otkrivene nedostaci izazvani su pogreškama koje se odnose na korupciju memorije, neodgovarajuće rukovanje datotekama i memorijom, te na propuste u kodu pojedinih programskih funkcija i/ili komponenti.
Posljedica:
Opisane ranjivosti udaljeni napadač može iskoristiti za otkrivanje osjetljivih informacija, izvršavanje proizvoljnog programskog koda te stjecanje većih ovlasti.
Rješenje:
Kao rješenje problema savjetuje se primjena uobičajene nadogradnje web preglednika.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2296-1 Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
http://www.debian.org/security/ Moritz Muehlenhoff
August 17, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : iceweasel
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-0084 CVE-2011-2378 CVE-2011-2981 CVE-2011-2982
CVE-2011-2983 CVE-2011-2984
Several vulnerabilities have been discovered in Iceweasel, a web browser
based on Firefox. The included XULRunner library provides rendering
services for several other applications included in Debian.
CVE-2011-0084
"regenrecht" discovered that incorrect pointer handling in the SVG
processing code could lead to the execution of arbitrary code.
CVE-2011-2378
"regenrecht" discovered that incorrect memory management in DOM
processing could lead to the execution of arbitrary code.
CVE-2011-2981
"moz_bug_r_a_4" discovered a Chrome privilege escalation
vulnerability in the event handler code.
CVE-2011-2982
Gary Kwong, Igor Bukanov, Nils and Bob Clary discovered memory
corruption bugs, which may lead to the execution of arbitrary code.
CVE-2011-2983
"shutdown" discovered an information leak in the handling of
RegExp.input.
CVE-2011-2984
"moz_bug_r_a4" discovered a Chrome privilege escalation vulnerability.
For the oldstable distribution (lenny), this problem has been fixed in
version 1.9.0.19-13 of the xulrunner source package.
For the stable distribution (squeeze), this problem has been fixed in
version 3.5.16-9.
For the unstable distribution (sid), this problem has been fixed in
version 6.0-1
We recommend that you upgrade your iceweasel packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk5MEmoACgkQXm3vHE4uylrxZQCfcB2Rsf6ZPacKAZqurE0ytf43
1ZIAoKnQP0fpqbkWO9jnxECmDhkg5Ejj
=H8se
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
with a subject of "unsubscribe". Trouble? Contact Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Archive: http://lists.debian.org/Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Posljednje sigurnosne preporuke