----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Mozilla Firefox Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA29526

VERIFY ADVISORY:
http://secunia.com/advisories/29526/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Spoofing, Exposure of
sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Mozilla Firefox 2.0.x
http://secunia.com/product/12434/

DESCRIPTION:
Some vulnerabilities and weaknesses have been reported in Mozilla
Firefox, which can be exploited by malicious people to bypass certain
security restrictions, disclose potentially sensitive information,
conduct cross-site scripting and phishing attacks, and potentially
compromise a user's system.

1) An unspecified error in the handling of "XPCNativeWrappers" can
lead to the execution of arbitrary Javascript code with the user's
privileges via "setTimeout()" calls.

This is related to vulnerability #7 in:
SA27311

2) Various errors in the handling of Javascript code can be exploited
to conduct cross-site scripting attacks or execute arbitrary code.

3) Various errors in the layout engine can be exploited to cause a
memory corruption.

4) Various errors in the Javascript engine can be exploited to cause
a memory corruption.

Successful exploitation of these vulnerabilities may allow execution
of arbitrary code.

5) An error within the handling of HTTP "Referer:" headers sent with
requests to URLs containing "Basic Authentication" credentials having
an empty username can be exploited to bypass cross-site request
forgery protections.

6) The problem is that Firefox offers a previously configured private
SSL certificate when establishing connections to webservers requesting
SSL Client Authentication. This can potentially be exploited to
disclose sensitive information via a malicious webserver.

7) An error in the handling of the "jar:" protocol can be exploited
to establish connections to arbitrary ports on the local machine.

This is related to vulnerability #10 in:
SA29239

8) An error when displaying XUL pop-up windows can be exploited to
hide the window's borders and facilitate phishing attacks.

The vulnerabilities are reported in versions prior to 2.0.0.13.

SOLUTION:
Update to version 2.0.0.13.

PROVIDED AND/OR DISCOVERED BY:
1) moz_bug_r_a4
2) moz_bug_r_a4, Boris Zbarsky, and Johnny Stenback
3) Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett, and Mats
Palmgren
4) georgi, tgirmann, and Igor Bukanov
5, 7) Gregory Fleischer
6) Peter Brodersen and Alexander Klink
8) Chris Thomas

ORIGINAL ADVISORY:
http://www.mozilla.org/security/announce/2008/mfsa2008-14.html
http://www.mozilla.org/security/announce/2008/mfsa2008-15.html
http://www.mozilla.org/security/announce/2008/mfsa2008-16.html
http://www.mozilla.org/security/announce/2008/mfsa2008-17.html
http://www.mozilla.org/security/announce/2008/mfsa2008-18.html
http://www.mozilla.org/security/announce/2008/mfsa2008-19.html

OTHER REFERENCES:
SA27311:
http://secunia.com/advisories/27311/

SA29239:
http://secunia.com/advisories/29239/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------