----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
Mozilla Firefox Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA26095

VERIFY ADVISORY:
http://secunia.com/advisories/26095/

CRITICAL:
Highly critical

IMPACT:
Cross Site Scripting, Spoofing, DoS, System access

WHERE:
>From remote

SOFTWARE:
Mozilla Firefox 2.0.x
http://secunia.com/product/12434/

DESCRIPTION:
Some vulnerabilities have been reported in Mozilla Firefox, which can
be exploited by malicious people to conduct spoofing and cross-site
scripting attacks and potentially to compromise a user's system.

1) Various errors in the browser engine can be exploited to cause
memory corruption and potentially to execute arbitrary code.

2) Various errors in the Javascript engine can be exploited to cause
memory corruption and potentially to execute arbitrary code.

3) An error in the "addEventListener" and "setTimeout" methods can be
exploited to inject script into another site's context, circumventing
the browser's same-origin policy.

4) An error in the cross-domain handling can be exploited to inject
arbitrary HTML and script code in a sub-frame of another web site.

This is related to vulnerability #5 in:
SA21906

5) An unspecified error in the handling of elements outside of
documents allows an attacker to call an event handler and execute
arbitrary code with chrome privileges.

6) An unspecified error in the handling of "XPCNativeWrapper" can
lead to execution of user-supplied code.

SOLUTION:
Update to version 2.0.0.5.

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Bernd Mielke, Boris Zbarsky, David Baron,
Daniel Veditz, Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats
Palmgren, Olli Pettay, Paul Nickerson, and Vladimir Sukhoy.
2) The vendor credits Asaf Romano, Jesse Ruderman, and Igor Bukanov.
3, 5) The vendor credits moz_bug_r_a4
4) Ronen Zilberman and Michal Zalewski
6) The vendor credits shutdown and moz_bug_r_a4.

ORIGINAL ADVISORY:
http://www.mozilla.org/security/announce/2007/mfsa2007-18.html
http://www.mozilla.org/security/announce/2007/mfsa2007-19.html
http://www.mozilla.org/security/announce/2007/mfsa2007-20.html
http://www.mozilla.org/security/announce/2007/mfsa2007-21.html
http://www.mozilla.org/security/announce/2007/mfsa2007-25.html

OTHER REFERENCES:
SA21906:
http://secunia.com/advisories/21906/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------