Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Enterprise Watch List (http://www.linux-archive.org/enterprise-watch-list/)
-   -   Critical: firefox security and bug fix update (http://www.linux-archive.org/enterprise-watch-list/496017-critical-firefox-security-bug-fix-update.html)

03-02-2011 12:36 AM

Critical: firefox security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Critical: firefox security and bug fix update
Advisory ID: RHSA-2011:0310-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0310.html
Issue date: 2011-03-01
CVE Names: CVE-2010-1585 CVE-2011-0051 CVE-2011-0053
CVE-2011-0054 CVE-2011-0055 CVE-2011-0056
CVE-2011-0057 CVE-2011-0058 CVE-2011-0059
CVE-2011-0061 CVE-2011-0062
================================================== ===================

1. Summary:

Updated firefox packages that fix several security issues and one bug are
now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Mozilla Firefox is an open source web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.

A flaw was found in the way Firefox sanitized HTML content in extensions.
If an extension loaded or rendered malicious content using the
ParanoidFragmentSink class, it could fail to safely display the content,
causing Firefox to execute arbitrary JavaScript with the privileges of the
user running Firefox. (CVE-2010-1585)

A flaw was found in the way Firefox handled dialog boxes. An attacker could
use this flaw to create a malicious web page that would present a blank
dialog box that has non-functioning buttons. If a user closes the dialog
box window, it could unexpectedly grant the malicious web page elevated
privileges. (CVE-2011-0051)

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-0053, CVE-2011-0055, CVE-2011-0058, CVE-2011-0062)

Several flaws were found in the way Firefox handled malformed JavaScript. A
website containing malicious JavaScript could cause Firefox to execute that
JavaScript with the privileges of the user running Firefox. (CVE-2011-0054,
CVE-2011-0056, CVE-2011-0057)

A flaw was found in the way Firefox handled malformed JPEG images. A
website containing a malicious JPEG image could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-0061)

A flaw was found in the way Firefox handled plug-ins that perform HTTP
requests. If a plug-in performed an HTTP request, and the server sent a 307
redirect response, the plug-in was not notified, and the HTTP request was
forwarded. The forwarded request could contain custom headers, which could
result in a Cross Site Request Forgery attack. (CVE-2011-0059)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 3.6.14. You can find a link to the Mozilla
advisories in the References section of this erratum.

This update also fixes the following bug:

* On Red Hat Enterprise Linux 4 and 5, running the "firefox
- -setDefaultBrowser" command caused warnings such as the following:

libgnomevfs-WARNING **: Deprecated function. User modifications to the
MIME database are no longer supported.

This update disables the "setDefaultBrowser" option. Red Hat Enterprise
Linux 4 users wishing to set a default web browser can use Applications ->
Preferences -> More Preferences -> Preferred Applications. Red Hat
Enterprise Linux 5 users can use System -> Preferences -> Preferred
Applications. (BZ#463131, BZ#665031)

All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.6.14, which corrects these issues. After installing the
update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

463131 - libgnomevfs-WARNING when making firefox as default browser
665031 - firefox -setDefaultBrowser throws warnings
675082 - CVE-2011-0053 Mozilla miscellaneous memory safety hazards (MFSA 2011-01)
675083 - CVE-2011-0062 Mozilla miscellaneous memory safety hazards (MFSA 2011-01)
675087 - CVE-2011-0051 Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02)
675090 - CVE-2011-0055 Mozilla use-after-free error in JSON.stringify (MFSA2011-03)
675091 - CVE-2011-0054 Mozilla Buffer overflow in JavaScript upvarMap (MFSA 2011-04)
675092 - CVE-2011-0056 Mozilla Buffer overflow in JavaScript atom map (MFSA 2011-05)
675093 - CVE-2011-0057 Mozilla use-after-free error using Web Workers (MFSA 2011-06)
675094 - CVE-2010-1585 Mozilla ParanoidFragmentSink allows javascript: URLs in chrome documents (MFSA 2011-08)
675095 - CVE-2011-0061 Mozilla crash caused by corrupted JPEG image (MFSA 2011-09)
675143 - CVE-2011-0058 Mozilla memory corruption during text run construction (MFSA 2011-07)
681369 - CVE-2011-0059 Mozilla CSRF risk with plugins and 307 redirects (MFSA 2011-10)

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-3.6.14-4.el4.src.rpm

i386:
firefox-3.6.14-4.el4.i386.rpm
firefox-debuginfo-3.6.14-4.el4.i386.rpm

ia64:
firefox-3.6.14-4.el4.ia64.rpm
firefox-debuginfo-3.6.14-4.el4.ia64.rpm

ppc:
firefox-3.6.14-4.el4.ppc.rpm
firefox-debuginfo-3.6.14-4.el4.ppc.rpm

s390:
firefox-3.6.14-4.el4.s390.rpm
firefox-debuginfo-3.6.14-4.el4.s390.rpm

s390x:
firefox-3.6.14-4.el4.s390x.rpm
firefox-debuginfo-3.6.14-4.el4.s390x.rpm

x86_64:
firefox-3.6.14-4.el4.x86_64.rpm
firefox-debuginfo-3.6.14-4.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-3.6.14-4.el4.src.rpm

i386:
firefox-3.6.14-4.el4.i386.rpm
firefox-debuginfo-3.6.14-4.el4.i386.rpm

x86_64:
firefox-3.6.14-4.el4.x86_64.rpm
firefox-debuginfo-3.6.14-4.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-3.6.14-4.el4.src.rpm

i386:
firefox-3.6.14-4.el4.i386.rpm
firefox-debuginfo-3.6.14-4.el4.i386.rpm

ia64:
firefox-3.6.14-4.el4.ia64.rpm
firefox-debuginfo-3.6.14-4.el4.ia64.rpm

x86_64:
firefox-3.6.14-4.el4.x86_64.rpm
firefox-debuginfo-3.6.14-4.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-3.6.14-4.el4.src.rpm

i386:
firefox-3.6.14-4.el4.i386.rpm
firefox-debuginfo-3.6.14-4.el4.i386.rpm

ia64:
firefox-3.6.14-4.el4.ia64.rpm
firefox-debuginfo-3.6.14-4.el4.ia64.rpm

x86_64:
firefox-3.6.14-4.el4.x86_64.rpm
firefox-debuginfo-3.6.14-4.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.6.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.6.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm

i386:
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm

x86_64:
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.x86_64.rpm
firefox-3.6.14-4.el5_6.x86_64.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.x86_64.rpm
firefox-debuginfo-3.6.14-4.el5_6.x86_64.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm

i386:
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm

x86_64:
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.6.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.6.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.2.14-4.el5_6.src.rpm

i386:
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm

ia64:
firefox-3.6.14-4.el5_6.ia64.rpm
firefox-3.6.14-4.el5_6.ia64.rpm
firefox-debuginfo-3.6.14-4.el5_6.ia64.rpm
firefox-debuginfo-3.6.14-4.el5_6.ia64.rpm
xulrunner-1.9.2.14-4.el5_6.ia64.rpm
xulrunner-1.9.2.14-4.el5_6.ia64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ia64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ia64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ia64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ia64.rpm

ppc:
firefox-3.6.14-4.el5_6.ppc.rpm
firefox-3.6.14-4.el5_6.ppc.rpm
firefox-debuginfo-3.6.14-4.el5_6.ppc.rpm
firefox-debuginfo-3.6.14-4.el5_6.ppc.rpm
xulrunner-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-1.9.2.14-4.el5_6.ppc64.rpm
xulrunner-1.9.2.14-4.el5_6.ppc64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ppc64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.ppc64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ppc.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ppc64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.ppc64.rpm

s390x:
firefox-3.6.14-4.el5_6.s390.rpm
firefox-3.6.14-4.el5_6.s390.rpm
firefox-3.6.14-4.el5_6.s390x.rpm
firefox-3.6.14-4.el5_6.s390x.rpm
firefox-debuginfo-3.6.14-4.el5_6.s390.rpm
firefox-debuginfo-3.6.14-4.el5_6.s390.rpm
firefox-debuginfo-3.6.14-4.el5_6.s390x.rpm
firefox-debuginfo-3.6.14-4.el5_6.s390x.rpm
xulrunner-1.9.2.14-4.el5_6.s390.rpm
xulrunner-1.9.2.14-4.el5_6.s390.rpm
xulrunner-1.9.2.14-4.el5_6.s390x.rpm
xulrunner-1.9.2.14-4.el5_6.s390x.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.s390.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.s390.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.s390x.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.s390x.rpm
xulrunner-devel-1.9.2.14-4.el5_6.s390.rpm
xulrunner-devel-1.9.2.14-4.el5_6.s390.rpm
xulrunner-devel-1.9.2.14-4.el5_6.s390x.rpm
xulrunner-devel-1.9.2.14-4.el5_6.s390x.rpm

x86_64:
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.i386.rpm
firefox-3.6.14-4.el5_6.x86_64.rpm
firefox-3.6.14-4.el5_6.x86_64.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.i386.rpm
firefox-debuginfo-3.6.14-4.el5_6.x86_64.rpm
firefox-debuginfo-3.6.14-4.el5_6.x86_64.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.i386.rpm
xulrunner-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.i386.rpm
xulrunner-devel-1.9.2.14-4.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.14-4.el5_6.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
firefox-3.6.14-4.el6_0.i686.rpm
firefox-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm

x86_64:
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

x86_64:
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
firefox-3.6.14-4.el6_0.i686.rpm
firefox-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm

ppc64:
firefox-3.6.14-4.el6_0.ppc64.rpm
firefox-3.6.14-4.el6_0.ppc64.rpm
firefox-debuginfo-3.6.14-4.el6_0.ppc64.rpm
firefox-debuginfo-3.6.14-4.el6_0.ppc64.rpm
xulrunner-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-1.9.2.14-3.el6_0.ppc64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc64.rpm

s390x:
firefox-3.6.14-4.el6_0.s390x.rpm
firefox-3.6.14-4.el6_0.s390x.rpm
firefox-debuginfo-3.6.14-4.el6_0.s390x.rpm
firefox-debuginfo-3.6.14-4.el6_0.s390x.rpm
xulrunner-1.9.2.14-3.el6_0.s390.rpm
xulrunner-1.9.2.14-3.el6_0.s390x.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390x.rpm

x86_64:
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm

ppc64:
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.ppc64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-devel-1.9.2.14-3.el6_0.ppc.rpm
xulrunner-devel-1.9.2.14-3.el6_0.ppc64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.ppc64.rpm

s390x:
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390x.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.s390x.rpm
xulrunner-devel-1.9.2.14-3.el6_0.s390.rpm
xulrunner-devel-1.9.2.14-3.el6_0.s390.rpm
xulrunner-devel-1.9.2.14-3.el6_0.s390x.rpm
xulrunner-devel-1.9.2.14-3.el6_0.s390x.rpm

x86_64:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-3.6.14-4.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
firefox-3.6.14-4.el6_0.i686.rpm
firefox-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
firefox-debuginfo-3.6.14-4.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm

x86_64:
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
firefox-debuginfo-3.6.14-4.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.i686.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.14-3.el6_0.src.rpm

i386:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.i686.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-debuginfo-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.i686.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm
xulrunner-devel-1.9.2.14-3.el6_0.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2010-1585.html
https://www.redhat.com/security/data/cve/CVE-2011-0051.html
https://www.redhat.com/security/data/cve/CVE-2011-0053.html
https://www.redhat.com/security/data/cve/CVE-2011-0054.html
https://www.redhat.com/security/data/cve/CVE-2011-0055.html
https://www.redhat.com/security/data/cve/CVE-2011-0056.html
https://www.redhat.com/security/data/cve/CVE-2011-0057.html
https://www.redhat.com/security/data/cve/CVE-2011-0058.html
https://www.redhat.com/security/data/cve/CVE-2011-0059.html
https://www.redhat.com/security/data/cve/CVE-2011-0061.html
https://www.redhat.com/security/data/cve/CVE-2011-0062.html
https://access.redhat.com/security/updates/classification/#critical
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.14

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFNbZ73XlSAg2UNWIIRAmacAJsGS+Q1PWYyoU/xVmoTuvviT7ukSwCfd4Uw
NQkxxJLJi4uxUaXVEDkDFX4=
=9tQb
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

06-21-2011 11:25 PM

Critical: firefox security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Critical: firefox security and bug fix update
Advisory ID: RHSA-2011:0885-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0885.html
Issue date: 2011-06-21
CVE Names: CVE-2011-0083 CVE-2011-0085 CVE-2011-2362
CVE-2011-2363 CVE-2011-2364 CVE-2011-2365
CVE-2011-2371 CVE-2011-2373 CVE-2011-2374
CVE-2011-2375 CVE-2011-2376 CVE-2011-2377
================================================== ===================

1. Summary:

Updated firefox packages that fix several security issues and one bug are
now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Mozilla Firefox is an open source web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.

A flaw was found in the way Firefox handled malformed JPEG images. A
website containing a malicious JPEG image could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-2377)

Multiple dangling pointer flaws were found in Firefox. A web page
containing malicious content could cause Firefox to crash or, potentially,
execute arbitrary code with the privileges of the user running Firefox.
(CVE-2011-0083, CVE-2011-0085, CVE-2011-2363)

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375,
CVE-2011-2376)

An integer overflow flaw was found in the way Firefox handled JavaScript
Array objects. A website containing malicious JavaScript could cause
Firefox to execute that JavaScript with the privileges of the user running
Firefox. (CVE-2011-2371)

A use-after-free flaw was found in the way Firefox handled malformed
JavaScript. A website containing malicious JavaScript could cause Firefox
to execute that JavaScript with the privileges of the user running Firefox.
(CVE-2011-2373)

It was found that Firefox could treat two separate cookies as
interchangeable if both were for the same domain name but one of those
domain names had a trailing "." character. This violates the same-origin
policy and could possibly lead to data being leaked to the wrong domain.
(CVE-2011-2362)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 3.6.18. You can find a link to the Mozilla
advisories in the References section of this erratum.

This update also fixes the following bug:

* With previous versions of Firefox on Red Hat Enterprise Linux 5, the
"background-repeat" CSS (Cascading Style Sheets) property did not work
(such images were not displayed and repeated as expected). (BZ#698313)

All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.6.18, which corrects these issues. After installing the
update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

698313 - "background-repeat" css property isn't rendered well in Firefox 3.6.x
714576 - CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376 Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
714577 - CVE-2011-2373 Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)
714580 - CVE-2011-2371 Mozilla Integer overflow and arbitrary code execution (MFSA 2011-22)
714581 - CVE-2011-0083 CVE-2011-0085 CVE-2011-2363 Mozilla Multiple dangling pointer vulnerabilities (MFSA 2011-23)
714583 - CVE-2011-2362 Mozilla Cookie isolation error (MFSA 2011-24)
714929 - CVE-2011-2377 Mozilla Crash caused by corrupted JPEG image (MFSA 2011-21)

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-3.6.18-2.el4.src.rpm

i386:
firefox-3.6.18-2.el4.i386.rpm
firefox-debuginfo-3.6.18-2.el4.i386.rpm

ia64:
firefox-3.6.18-2.el4.ia64.rpm
firefox-debuginfo-3.6.18-2.el4.ia64.rpm

ppc:
firefox-3.6.18-2.el4.ppc.rpm
firefox-debuginfo-3.6.18-2.el4.ppc.rpm

s390:
firefox-3.6.18-2.el4.s390.rpm
firefox-debuginfo-3.6.18-2.el4.s390.rpm

s390x:
firefox-3.6.18-2.el4.s390x.rpm
firefox-debuginfo-3.6.18-2.el4.s390x.rpm

x86_64:
firefox-3.6.18-2.el4.x86_64.rpm
firefox-debuginfo-3.6.18-2.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-3.6.18-2.el4.src.rpm

i386:
firefox-3.6.18-2.el4.i386.rpm
firefox-debuginfo-3.6.18-2.el4.i386.rpm

x86_64:
firefox-3.6.18-2.el4.x86_64.rpm
firefox-debuginfo-3.6.18-2.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-3.6.18-2.el4.src.rpm

i386:
firefox-3.6.18-2.el4.i386.rpm
firefox-debuginfo-3.6.18-2.el4.i386.rpm

ia64:
firefox-3.6.18-2.el4.ia64.rpm
firefox-debuginfo-3.6.18-2.el4.ia64.rpm

x86_64:
firefox-3.6.18-2.el4.x86_64.rpm
firefox-debuginfo-3.6.18-2.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-3.6.18-2.el4.src.rpm

i386:
firefox-3.6.18-2.el4.i386.rpm
firefox-debuginfo-3.6.18-2.el4.i386.rpm

ia64:
firefox-3.6.18-2.el4.ia64.rpm
firefox-debuginfo-3.6.18-2.el4.ia64.rpm

x86_64:
firefox-3.6.18-2.el4.x86_64.rpm
firefox-debuginfo-3.6.18-2.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.6.18-1.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.18-2.el5_6.src.rpm

i386:
firefox-3.6.18-1.el5_6.i386.rpm
firefox-debuginfo-3.6.18-1.el5_6.i386.rpm
xulrunner-1.9.2.18-2.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm

x86_64:
firefox-3.6.18-1.el5_6.i386.rpm
firefox-3.6.18-1.el5_6.x86_64.rpm
firefox-debuginfo-3.6.18-1.el5_6.i386.rpm
firefox-debuginfo-3.6.18-1.el5_6.x86_64.rpm
xulrunner-1.9.2.18-2.el5_6.i386.rpm
xulrunner-1.9.2.18-2.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.18-2.el5_6.src.rpm

i386:
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm
xulrunner-devel-1.9.2.18-2.el5_6.i386.rpm

x86_64:
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el5_6.i386.rpm
xulrunner-devel-1.9.2.18-2.el5_6.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.6.18-1.el5_6.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.2.18-2.el5_6.src.rpm

i386:
firefox-3.6.18-1.el5_6.i386.rpm
firefox-debuginfo-3.6.18-1.el5_6.i386.rpm
xulrunner-1.9.2.18-2.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm
xulrunner-devel-1.9.2.18-2.el5_6.i386.rpm

ia64:
firefox-3.6.18-1.el5_6.ia64.rpm
firefox-debuginfo-3.6.18-1.el5_6.ia64.rpm
xulrunner-1.9.2.18-2.el5_6.ia64.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.ia64.rpm
xulrunner-devel-1.9.2.18-2.el5_6.ia64.rpm

ppc:
firefox-3.6.18-1.el5_6.ppc.rpm
firefox-debuginfo-3.6.18-1.el5_6.ppc.rpm
xulrunner-1.9.2.18-2.el5_6.ppc.rpm
xulrunner-1.9.2.18-2.el5_6.ppc64.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.ppc.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.ppc64.rpm
xulrunner-devel-1.9.2.18-2.el5_6.ppc.rpm
xulrunner-devel-1.9.2.18-2.el5_6.ppc64.rpm

s390x:
firefox-3.6.18-1.el5_6.s390.rpm
firefox-3.6.18-1.el5_6.s390x.rpm
firefox-debuginfo-3.6.18-1.el5_6.s390.rpm
firefox-debuginfo-3.6.18-1.el5_6.s390x.rpm
xulrunner-1.9.2.18-2.el5_6.s390.rpm
xulrunner-1.9.2.18-2.el5_6.s390x.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.s390.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.s390x.rpm
xulrunner-devel-1.9.2.18-2.el5_6.s390.rpm
xulrunner-devel-1.9.2.18-2.el5_6.s390x.rpm

x86_64:
firefox-3.6.18-1.el5_6.i386.rpm
firefox-3.6.18-1.el5_6.x86_64.rpm
firefox-debuginfo-3.6.18-1.el5_6.i386.rpm
firefox-debuginfo-3.6.18-1.el5_6.x86_64.rpm
xulrunner-1.9.2.18-2.el5_6.i386.rpm
xulrunner-1.9.2.18-2.el5_6.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.i386.rpm
xulrunner-debuginfo-1.9.2.18-2.el5_6.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el5_6.i386.rpm
xulrunner-devel-1.9.2.18-2.el5_6.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-3.6.18-1.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm

x86_64:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-3.6.18-1.el6_1.x86_64.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.x86_64.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-3.6.18-1.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

x86_64:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-3.6.18-1.el6_1.x86_64.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.x86_64.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-3.6.18-1.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm

ppc64:
firefox-3.6.18-1.el6_1.ppc.rpm
firefox-3.6.18-1.el6_1.ppc64.rpm
firefox-debuginfo-3.6.18-1.el6_1.ppc.rpm
firefox-debuginfo-3.6.18-1.el6_1.ppc64.rpm
xulrunner-1.9.2.18-2.el6_1.ppc.rpm
xulrunner-1.9.2.18-2.el6_1.ppc64.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.ppc.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.ppc64.rpm

s390x:
firefox-3.6.18-1.el6_1.s390.rpm
firefox-3.6.18-1.el6_1.s390x.rpm
firefox-debuginfo-3.6.18-1.el6_1.s390.rpm
firefox-debuginfo-3.6.18-1.el6_1.s390x.rpm
xulrunner-1.9.2.18-2.el6_1.s390.rpm
xulrunner-1.9.2.18-2.el6_1.s390x.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.s390.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.s390x.rpm

x86_64:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-3.6.18-1.el6_1.x86_64.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.x86_64.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm

ppc64:
xulrunner-debuginfo-1.9.2.18-2.el6_1.ppc.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.ppc64.rpm
xulrunner-devel-1.9.2.18-2.el6_1.ppc.rpm
xulrunner-devel-1.9.2.18-2.el6_1.ppc64.rpm

s390x:
xulrunner-debuginfo-1.9.2.18-2.el6_1.s390.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.s390x.rpm
xulrunner-devel-1.9.2.18-2.el6_1.s390.rpm
xulrunner-devel-1.9.2.18-2.el6_1.s390x.rpm

x86_64:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-3.6.18-1.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm

x86_64:
firefox-3.6.18-1.el6_1.i686.rpm
firefox-3.6.18-1.el6_1.x86_64.rpm
firefox-debuginfo-3.6.18-1.el6_1.i686.rpm
firefox-debuginfo-3.6.18-1.el6_1.x86_64.rpm
xulrunner-1.9.2.18-2.el6_1.i686.rpm
xulrunner-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.18-2.el6_1.src.rpm

i386:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm

x86_64:
xulrunner-debuginfo-1.9.2.18-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.18-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.18-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.18-2.el6_1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-0083.html
https://www.redhat.com/security/data/cve/CVE-2011-0085.html
https://www.redhat.com/security/data/cve/CVE-2011-2362.html
https://www.redhat.com/security/data/cve/CVE-2011-2363.html
https://www.redhat.com/security/data/cve/CVE-2011-2364.html
https://www.redhat.com/security/data/cve/CVE-2011-2365.html
https://www.redhat.com/security/data/cve/CVE-2011-2371.html
https://www.redhat.com/security/data/cve/CVE-2011-2373.html
https://www.redhat.com/security/data/cve/CVE-2011-2374.html
https://www.redhat.com/security/data/cve/CVE-2011-2375.html
https://www.redhat.com/security/data/cve/CVE-2011-2376.html
https://www.redhat.com/security/data/cve/CVE-2011-2377.html
https://access.redhat.com/security/updates/classification/#critical
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.18

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFOAShFXlSAg2UNWIIRAvF0AJ4hTnl54R+8gFVADG7REL 0jwixKJQCgjJ45
tgLsJItbC7fFzVa/RqSk2X4=
=sptY
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

03-14-2012 06:44 AM

Critical: firefox security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Critical: firefox security and bug fix update
Advisory ID: RHSA-2012:0387-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0387.html
Issue date: 2012-03-14
CVE Names: CVE-2012-0451 CVE-2012-0455 CVE-2012-0456
CVE-2012-0457 CVE-2012-0458 CVE-2012-0459
CVE-2012-0460 CVE-2012-0461 CVE-2012-0462
CVE-2012-0464
================================================== ===================

1. Summary:

Updated firefox packages that fix multiple security issues and three bugs
are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user
running Firefox. (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Two flaws were found in the way Firefox parsed certain Scalable Vector
Graphics (SVG) image files. A web page containing a malicious SVG image
file could cause an information leak, or cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-0456, CVE-2012-0457)

A flaw could allow a malicious site to bypass intended restrictions,
possibly leading to a cross-site scripting (XSS) attack if a user were
tricked into dropping a "javascript:" link onto a frame. (CVE-2012-0455)

It was found that the home page could be set to a "javascript:" link. If a
user were tricked into setting such a home page by dragging a link to the
home button, it could cause Firefox to repeatedly crash, eventually
leading to arbitrary code execution with the privileges of the user
running Firefox. (CVE-2012-0458)

A flaw was found in the way Firefox parsed certain web content containing
"cssText". A web page containing malicious content could cause Firefox to
crash or, potentially, execute arbitrary code with the privileges of the
user running Firefox. (CVE-2012-0459)

It was found that by using the DOM fullscreen API, untrusted content could
bypass the mozRequestFullscreen security protections. A web page containing
malicious web content could exploit this API flaw to cause user interface
spoofing. (CVE-2012-0460)

A flaw was found in the way Firefox handled pages with multiple Content
Security Policy (CSP) headers. This could lead to a cross-site scripting
attack if used in conjunction with a website that has a header injection
flaw. (CVE-2012-0451)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 10.0.3 ESR. You can find a link to the Mozilla
advisories in the References section of this erratum.

This update also fixes the following bugs:

* When using the Traditional Chinese locale (zh-TW), a segmentation fault
sometimes occurred when closing Firefox. (BZ#729632)

* Inputting any text in the Web Console (Tools -> Web Developer ->
Web Console) caused Firefox to crash. (BZ#784048)

* The java-1.6.0-ibm-plugin and java-1.6.0-sun-plugin packages require the
"/usr/lib/mozilla/plugins/" directory on 32-bit systems, and the
"/usr/lib64/mozilla/plugins/" directory on 64-bit systems. These
directories are created by the xulrunner package; however, they were
missing from the xulrunner package provided by the RHEA-2012:0327 update.
Therefore, upgrading to RHEA-2012:0327 removed those directories, causing
dependency errors when attempting to install the java-1.6.0-ibm-plugin or
java-1.6.0-sun-plugin package. With this update, xulrunner once again
creates the plugins directory. This issue did not affect users of Red Hat
Enterprise Linux 6. (BZ#799042)

All Firefox users should upgrade to these updated packages, which contain
Firefox version 10.0.3 ESR, which corrects these issues. After installing
the update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

729632 - Segfault on quit with Chinese locale [ @ gdk_display_close() ]
784048 - Typing into Web Console in Firefox causes crashing - gcc 4.4.3
799042 - not able to install java-plugin
803109 - CVE-2012-0461 CVE-2012-0462 CVE-2012-0464 Mozilla: Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28) (MFSA 2012-19)
803111 - CVE-2012-0460 Mozilla: window.fullScreen writeable by untrusted content (MFSA 2012-18)
803112 - CVE-2012-0459 Mozilla: Crash when accessing keyframe cssText after dynamic modification (MFSA 2012-17)
803113 - CVE-2012-0458 Mozilla: Escalation of privilege with javascript: URL as home page (MFSA 2012-16)
803114 - CVE-2012-0451 Mozilla: XSS with multiple Content Security Policy headers (MFSA 2012-15)
803116 - CVE-2012-0456 CVE-2012-0457 Mozilla: SVG issues found with Address Sanitizer (MFSA 2012-14)
803119 - CVE-2012-0455 Mozilla: XSS with Drag and Drop and javascript: URL (MFSA 2012-13)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-10.0.3-1.el5_8.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-10.0.3-1.el5_8.src.rpm

i386:
firefox-10.0.3-1.el5_8.i386.rpm
firefox-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-10.0.3-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm

x86_64:
firefox-10.0.3-1.el5_8.i386.rpm
firefox-10.0.3-1.el5_8.x86_64.rpm
firefox-debuginfo-10.0.3-1.el5_8.i386.rpm
firefox-debuginfo-10.0.3-1.el5_8.x86_64.rpm
xulrunner-10.0.3-1.el5_8.i386.rpm
xulrunner-10.0.3-1.el5_8.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-10.0.3-1.el5_8.src.rpm

i386:
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-devel-10.0.3-1.el5_8.i386.rpm

x86_64:
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.x86_64.rpm
xulrunner-devel-10.0.3-1.el5_8.i386.rpm
xulrunner-devel-10.0.3-1.el5_8.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-10.0.3-1.el5_8.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-10.0.3-1.el5_8.src.rpm

i386:
firefox-10.0.3-1.el5_8.i386.rpm
firefox-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-10.0.3-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-devel-10.0.3-1.el5_8.i386.rpm

ia64:
firefox-10.0.3-1.el5_8.ia64.rpm
firefox-debuginfo-10.0.3-1.el5_8.ia64.rpm
xulrunner-10.0.3-1.el5_8.ia64.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.ia64.rpm
xulrunner-devel-10.0.3-1.el5_8.ia64.rpm

ppc:
firefox-10.0.3-1.el5_8.ppc.rpm
firefox-debuginfo-10.0.3-1.el5_8.ppc.rpm
xulrunner-10.0.3-1.el5_8.ppc.rpm
xulrunner-10.0.3-1.el5_8.ppc64.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.ppc.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.ppc64.rpm
xulrunner-devel-10.0.3-1.el5_8.ppc.rpm
xulrunner-devel-10.0.3-1.el5_8.ppc64.rpm

s390x:
firefox-10.0.3-1.el5_8.s390.rpm
firefox-10.0.3-1.el5_8.s390x.rpm
firefox-debuginfo-10.0.3-1.el5_8.s390.rpm
firefox-debuginfo-10.0.3-1.el5_8.s390x.rpm
xulrunner-10.0.3-1.el5_8.s390.rpm
xulrunner-10.0.3-1.el5_8.s390x.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.s390.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.s390x.rpm
xulrunner-devel-10.0.3-1.el5_8.s390.rpm
xulrunner-devel-10.0.3-1.el5_8.s390x.rpm

x86_64:
firefox-10.0.3-1.el5_8.i386.rpm
firefox-10.0.3-1.el5_8.x86_64.rpm
firefox-debuginfo-10.0.3-1.el5_8.i386.rpm
firefox-debuginfo-10.0.3-1.el5_8.x86_64.rpm
xulrunner-10.0.3-1.el5_8.i386.rpm
xulrunner-10.0.3-1.el5_8.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.3-1.el5_8.x86_64.rpm
xulrunner-devel-10.0.3-1.el5_8.i386.rpm
xulrunner-devel-10.0.3-1.el5_8.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-10.0.3-1.el6_2.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm

x86_64:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-10.0.3-1.el6_2.x86_64.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm

x86_64:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-10.0.3-1.el6_2.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

x86_64:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-10.0.3-1.el6_2.x86_64.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-10.0.3-1.el6_2.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm

ppc64:
firefox-10.0.3-1.el6_2.ppc.rpm
firefox-10.0.3-1.el6_2.ppc64.rpm
firefox-debuginfo-10.0.3-1.el6_2.ppc.rpm
firefox-debuginfo-10.0.3-1.el6_2.ppc64.rpm
xulrunner-10.0.3-1.el6_2.ppc.rpm
xulrunner-10.0.3-1.el6_2.ppc64.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.ppc.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.ppc64.rpm

s390x:
firefox-10.0.3-1.el6_2.s390.rpm
firefox-10.0.3-1.el6_2.s390x.rpm
firefox-debuginfo-10.0.3-1.el6_2.s390.rpm
firefox-debuginfo-10.0.3-1.el6_2.s390x.rpm
xulrunner-10.0.3-1.el6_2.s390.rpm
xulrunner-10.0.3-1.el6_2.s390x.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.s390.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.s390x.rpm

x86_64:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-10.0.3-1.el6_2.x86_64.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm

ppc64:
xulrunner-debuginfo-10.0.3-1.el6_2.ppc.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.ppc64.rpm
xulrunner-devel-10.0.3-1.el6_2.ppc.rpm
xulrunner-devel-10.0.3-1.el6_2.ppc64.rpm

s390x:
xulrunner-debuginfo-10.0.3-1.el6_2.s390.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.s390x.rpm
xulrunner-devel-10.0.3-1.el6_2.s390.rpm
xulrunner-devel-10.0.3-1.el6_2.s390x.rpm

x86_64:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-10.0.3-1.el6_2.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm

x86_64:
firefox-10.0.3-1.el6_2.i686.rpm
firefox-10.0.3-1.el6_2.x86_64.rpm
firefox-debuginfo-10.0.3-1.el6_2.i686.rpm
firefox-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-10.0.3-1.el6_2.i686.rpm
xulrunner-10.0.3-1.el6_2.x86_64.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-10.0.3-1.el6_2.src.rpm

i386:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm

x86_64:
xulrunner-debuginfo-10.0.3-1.el6_2.i686.rpm
xulrunner-debuginfo-10.0.3-1.el6_2.x86_64.rpm
xulrunner-devel-10.0.3-1.el6_2.i686.rpm
xulrunner-devel-10.0.3-1.el6_2.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-0451.html
https://www.redhat.com/security/data/cve/CVE-2012-0455.html
https://www.redhat.com/security/data/cve/CVE-2012-0456.html
https://www.redhat.com/security/data/cve/CVE-2012-0457.html
https://www.redhat.com/security/data/cve/CVE-2012-0458.html
https://www.redhat.com/security/data/cve/CVE-2012-0459.html
https://www.redhat.com/security/data/cve/CVE-2012-0460.html
https://www.redhat.com/security/data/cve/CVE-2012-0461.html
https://www.redhat.com/security/data/cve/CVE-2012-0462.html
https://www.redhat.com/security/data/cve/CVE-2012-0464.html
https://access.redhat.com/security/updates/classification/#critical
https://rhn.redhat.com/errata/RHEA-2012-0327.html
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPYExEXlSAg2UNWIIRAl3KAJ0UslLdaYWIolwpT6csPk WDjMyTkwCeOHwo
cLK5sMt09dnWnURf1otj1G4=
=f6gE
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

10-09-2012 11:42 PM

Critical: firefox security and bug fix update
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Critical: firefox security and bug fix update
Advisory ID: RHSA-2012:1350-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1350.html
Issue date: 2012-10-09
CVE Names: CVE-2012-1956 CVE-2012-3982 CVE-2012-3986
CVE-2012-3988 CVE-2012-3990 CVE-2012-3991
CVE-2012-3992 CVE-2012-3993 CVE-2012-3994
CVE-2012-3995 CVE-2012-4179 CVE-2012-4180
CVE-2012-4181 CVE-2012-4182 CVE-2012-4183
CVE-2012-4184 CVE-2012-4185 CVE-2012-4186
CVE-2012-4187 CVE-2012-4188
================================================== ===================

1. Summary:

Updated firefox packages that fix several security issues and one bug are
now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Mozilla Firefox is an open source web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2012-3982, CVE-2012-3988, CVE-2012-3990, CVE-2012-3995,
CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183,
CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188)

Two flaws in Firefox could allow a malicious website to bypass intended
restrictions, possibly leading to information disclosure, or Firefox
executing arbitrary code. Note that the information disclosure issue could
possibly be combined with other flaws to achieve arbitrary code execution.
(CVE-2012-3986, CVE-2012-3991)

Multiple flaws were found in the location object implementation in Firefox.
Malicious content could be used to perform cross-site scripting attacks,
script injection, or spoofing attacks. (CVE-2012-1956, CVE-2012-3992,
CVE-2012-3994)

Two flaws were found in the way Chrome Object Wrappers were implemented.
Malicious content could be used to perform cross-site scripting attacks or
cause Firefox to execute arbitrary code. (CVE-2012-3993, CVE-2012-4184)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 10.0.8 ESR. You can find a link to the Mozilla
advisories in the References section of this erratum.

Red Hat would like to thank the Mozilla project for reporting these issues.
Upstream acknowledges Christian Holler, Jesse Ruderman, Soroush Dalili,
miaubiz, Abhishek Arya, Atte Kettunen, Johnny Stenback, Alice White,
moz_bug_r_a4, and Mariusz Mlynski as the original reporters of these
issues.

This update also fixes the following bug:

* In certain environments, storing personal Firefox configuration files
(~/.mozilla/) on an NFS share, such as when your home directory is on a
NFS share, led to Firefox functioning incorrectly, for example, navigation
buttons not working as expected, and bookmarks not saving. This update
adds a new configuration option, storage.nfs_filesystem, that can be used
to resolve this issue.

If you experience this issue:

1) Start Firefox.

2) Type "about:config" (without quotes) into the URL bar and press the
Enter key.

3) If prompted with "This might void your warranty!", click the "I'll be
careful, I promise!" button.

4) Right-click in the Preference Name list. In the menu that opens, select
New -> Boolean.

5) Type "storage.nfs_filesystem" (without quotes) for the preference name
and then click the OK button.

6) Select "true" for the boolean value and then press the OK button.
(BZ#809571, BZ#816234)

All Firefox users should upgrade to these updated packages, which contain
Firefox version 10.0.8 ESR, which corrects these issues. After installing
the update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

851912 - CVE-2012-1956 Mozilla: Location object can be shadowed using Object.defineProperty (MFSA 2012-59)
863614 - CVE-2012-3982 Mozilla: Miscellaneous memory safety hazards (rv:10.0.8) (MFSA 2012-74)
863618 - CVE-2012-3986 Mozilla: Some DOMWindowUtils methods bypass security checks (MFSA 2012-77)
863619 - CVE-2012-3988 Mozilla: DOS and crash with full screen and history navigation (MFSA 2012-79)
863621 - CVE-2012-3991 Mozilla: GetProperty function can bypass security checks (MFSA 2012-81)
863622 - CVE-2012-3994 Mozilla: top object and location property accessible by plugins (MFSA 2012-82)
863623 - CVE-2012-3993 CVE-2012-4184 Mozilla: Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties (MFSA 2012-83)
863624 - CVE-2012-3992 Mozilla: Spoofing and script injection through location.hash (MFSA 2012-84)
863625 - CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4181 CVE-2012-4182 CVE-2012-4183 Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)
863626 - CVE-2012-4185 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)
863628 - CVE-2012-3990 Mozilla: Use-after-free in the IME State Manager (MFSA 2012-87)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-10.0.8-1.el5_8.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-10.0.8-1.el5_8.src.rpm

i386:
firefox-10.0.8-1.el5_8.i386.rpm
firefox-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-10.0.8-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm

x86_64:
firefox-10.0.8-1.el5_8.i386.rpm
firefox-10.0.8-1.el5_8.x86_64.rpm
firefox-debuginfo-10.0.8-1.el5_8.i386.rpm
firefox-debuginfo-10.0.8-1.el5_8.x86_64.rpm
xulrunner-10.0.8-1.el5_8.i386.rpm
xulrunner-10.0.8-1.el5_8.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-10.0.8-1.el5_8.src.rpm

i386:
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-devel-10.0.8-1.el5_8.i386.rpm

x86_64:
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.x86_64.rpm
xulrunner-devel-10.0.8-1.el5_8.i386.rpm
xulrunner-devel-10.0.8-1.el5_8.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-10.0.8-1.el5_8.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-10.0.8-1.el5_8.src.rpm

i386:
firefox-10.0.8-1.el5_8.i386.rpm
firefox-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-10.0.8-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-devel-10.0.8-1.el5_8.i386.rpm

ia64:
firefox-10.0.8-1.el5_8.ia64.rpm
firefox-debuginfo-10.0.8-1.el5_8.ia64.rpm
xulrunner-10.0.8-1.el5_8.ia64.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.ia64.rpm
xulrunner-devel-10.0.8-1.el5_8.ia64.rpm

ppc:
firefox-10.0.8-1.el5_8.ppc.rpm
firefox-debuginfo-10.0.8-1.el5_8.ppc.rpm
xulrunner-10.0.8-1.el5_8.ppc.rpm
xulrunner-10.0.8-1.el5_8.ppc64.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.ppc.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.ppc64.rpm
xulrunner-devel-10.0.8-1.el5_8.ppc.rpm
xulrunner-devel-10.0.8-1.el5_8.ppc64.rpm

s390x:
firefox-10.0.8-1.el5_8.s390.rpm
firefox-10.0.8-1.el5_8.s390x.rpm
firefox-debuginfo-10.0.8-1.el5_8.s390.rpm
firefox-debuginfo-10.0.8-1.el5_8.s390x.rpm
xulrunner-10.0.8-1.el5_8.s390.rpm
xulrunner-10.0.8-1.el5_8.s390x.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.s390.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.s390x.rpm
xulrunner-devel-10.0.8-1.el5_8.s390.rpm
xulrunner-devel-10.0.8-1.el5_8.s390x.rpm

x86_64:
firefox-10.0.8-1.el5_8.i386.rpm
firefox-10.0.8-1.el5_8.x86_64.rpm
firefox-debuginfo-10.0.8-1.el5_8.i386.rpm
firefox-debuginfo-10.0.8-1.el5_8.x86_64.rpm
xulrunner-10.0.8-1.el5_8.i386.rpm
xulrunner-10.0.8-1.el5_8.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.i386.rpm
xulrunner-debuginfo-10.0.8-1.el5_8.x86_64.rpm
xulrunner-devel-10.0.8-1.el5_8.i386.rpm
xulrunner-devel-10.0.8-1.el5_8.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-10.0.8-1.el6_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm

x86_64:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-10.0.8-1.el6_3.x86_64.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm

x86_64:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-10.0.8-1.el6_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

x86_64:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-10.0.8-1.el6_3.x86_64.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-10.0.8-1.el6_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm

ppc64:
firefox-10.0.8-1.el6_3.ppc.rpm
firefox-10.0.8-1.el6_3.ppc64.rpm
firefox-debuginfo-10.0.8-1.el6_3.ppc.rpm
firefox-debuginfo-10.0.8-1.el6_3.ppc64.rpm
xulrunner-10.0.8-1.el6_3.ppc.rpm
xulrunner-10.0.8-1.el6_3.ppc64.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.ppc.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.ppc64.rpm

s390x:
firefox-10.0.8-1.el6_3.s390.rpm
firefox-10.0.8-1.el6_3.s390x.rpm
firefox-debuginfo-10.0.8-1.el6_3.s390.rpm
firefox-debuginfo-10.0.8-1.el6_3.s390x.rpm
xulrunner-10.0.8-1.el6_3.s390.rpm
xulrunner-10.0.8-1.el6_3.s390x.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.s390.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.s390x.rpm

x86_64:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-10.0.8-1.el6_3.x86_64.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm

ppc64:
xulrunner-debuginfo-10.0.8-1.el6_3.ppc.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.ppc64.rpm
xulrunner-devel-10.0.8-1.el6_3.ppc.rpm
xulrunner-devel-10.0.8-1.el6_3.ppc64.rpm

s390x:
xulrunner-debuginfo-10.0.8-1.el6_3.s390.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.s390x.rpm
xulrunner-devel-10.0.8-1.el6_3.s390.rpm
xulrunner-devel-10.0.8-1.el6_3.s390x.rpm

x86_64:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-10.0.8-1.el6_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm

x86_64:
firefox-10.0.8-1.el6_3.i686.rpm
firefox-10.0.8-1.el6_3.x86_64.rpm
firefox-debuginfo-10.0.8-1.el6_3.i686.rpm
firefox-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-10.0.8-1.el6_3.i686.rpm
xulrunner-10.0.8-1.el6_3.x86_64.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-10.0.8-1.el6_3.src.rpm

i386:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm

x86_64:
xulrunner-debuginfo-10.0.8-1.el6_3.i686.rpm
xulrunner-debuginfo-10.0.8-1.el6_3.x86_64.rpm
xulrunner-devel-10.0.8-1.el6_3.i686.rpm
xulrunner-devel-10.0.8-1.el6_3.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2012-1956.html
https://www.redhat.com/security/data/cve/CVE-2012-3982.html
https://www.redhat.com/security/data/cve/CVE-2012-3986.html
https://www.redhat.com/security/data/cve/CVE-2012-3988.html
https://www.redhat.com/security/data/cve/CVE-2012-3990.html
https://www.redhat.com/security/data/cve/CVE-2012-3991.html
https://www.redhat.com/security/data/cve/CVE-2012-3992.html
https://www.redhat.com/security/data/cve/CVE-2012-3993.html
https://www.redhat.com/security/data/cve/CVE-2012-3994.html
https://www.redhat.com/security/data/cve/CVE-2012-3995.html
https://www.redhat.com/security/data/cve/CVE-2012-4179.html
https://www.redhat.com/security/data/cve/CVE-2012-4180.html
https://www.redhat.com/security/data/cve/CVE-2012-4181.html
https://www.redhat.com/security/data/cve/CVE-2012-4182.html
https://www.redhat.com/security/data/cve/CVE-2012-4183.html
https://www.redhat.com/security/data/cve/CVE-2012-4184.html
https://www.redhat.com/security/data/cve/CVE-2012-4185.html
https://www.redhat.com/security/data/cve/CVE-2012-4186.html
https://www.redhat.com/security/data/cve/CVE-2012-4187.html
https://www.redhat.com/security/data/cve/CVE-2012-4188.html
https://access.redhat.com/security/updates/classification/#critical
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFQdLY5XlSAg2UNWIIRAnUqAJ9FqrMrVYnAK3BMSWKCym dzOlzQ5QCfWUID
kHcy4qAvdwVc9y68bU/dleM=
=bsu8
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


All times are GMT. The time now is 12:43 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.