[security-alerts] FW: [SA27725] Mozilla Firefox Multiple Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
>
> TITLE:
> Mozilla Firefox Multiple Vulnerabilities
>
> SECUNIA ADVISORY ID:
> SA27725
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/27725/
>
> CRITICAL:
> Moderately critical
>
> IMPACT:
> Cross Site Scripting, DoS, System access
>
> WHERE:
> From remote
>
> SOFTWARE:
> Mozilla Firefox 2.0.x
> http://secunia.com/product/12434/
>
> DESCRIPTION:
> Some vulnerabilities have been reported in Mozilla Firefox, which can
> be exploited by malicious people to conduct cross-site request forgery
> attacks and potentially to compromise a user's system.
>
> 1) A race condition when setting the "window.location" property can
> be exploited to generate a fake HTTP Referer header, which can be
> used to conduct cross-site request forgery attacks.
>
> 2) Some unspecified errors can be exploited to cause memory
> corruption and potentially allow execution of arbitrary code.
>
> The vulnerabilities are reported in versions prior to 2.0.0.10.
>
> SOLUTION:
> Update to version 2.0.0.10.
> http://www.mozilla.com/firefox/
>
> PROVIDED AND/OR DISCOVERED BY:
> 1) The vendor credits Gregory Fleischer
> 2) Reported by the vendor.
>
> ORIGINAL ADVISORY:
> http://www.mozilla.org/security/announce/2007/mfsa2007-38.html
> http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
>