On Thu, 09 Feb 2006 22:06:09 -0500, William Hooper wrote: > > beartooth wrote: [....] >> I've since gotten a CERT alert, available at >> >> >> http://www.us-cert.gov/cas/techalerts/TA04-261A.html > > Are you sure you have the correct link? That link is for vulnerbilities > that existed in the Pre-1.0 Firefox. They are definitely fixed in 1.0.7. Very strange. Sure enough, the latest date I can find there, at the very bottom, is June 2005; but the alert I took it from only came -- to my direct subscription to CERT alerts -- only came on 2/7/2006; what's more, it gives that as its original release date. So I looked it back up; fortunately, I had kept it. Indeed, that's the wrong URL! My bad. Sorry about that; dunno where I got it. Anyway the new alert includes the following : The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-038A.html> [....] > III. Solution > Upgrade > Upgrade to Mozilla Firefox 1.5.0.1 or SeaMonkey 1.0. > For Mozilla-based products that have no updates available, users are > strongly encouraged to disable JavaScript. It also includes a link to mozilla.org/security/announce, which in turn links to a page which includes the following : Fixed in Firefox 1.5.0.1 MFSA 2006-08 "AnyName" entrainment and access control hazard MFSA 2006-07 Read beyond buffer while parsing XML MFSA 2006-06 Integer overflows in E4X, SVG and Canvas MFSA 2006-05 Localstore.rdf XML injection through XULDocument.persist() MFSA 2006-04 Memory corruption via QueryInterface on Location, Navigator objects MFSA 2006-03 Long document title causes startup denial of Service MFSA 2006-02 Changing postion:relative to static corrupts memory MFSA 2006-01 JavaScript garbage-collection hazards Fixed in Firefox 1.0.7 MFSA 2005-59 Command-line handling on Linux allows shell execution MFSA 2005-58 Firefox 1.0.7 / Mozilla Suite 1.7.12 Vulnerability Fixes MFSA 2005-57 IDN heap overrun using soft-hyphens Fixed in Firefox 1.0.5/1.0.6 MFSA 2005-56 Code execution through shared function objects MFSA 2005-55 XHTML node spoofing MFSA 2005-54 Javascript prompt origin spoofing MFSA 2005-53 Standalone applications can run arbitrary code through the browser MFSA 2005-52 Same origin violation: frame calling top.focus() MFSA 2005-51 The return of frame-injection spoofing MFSA 2005-50 Exploitable crash in InstallVersion.compareTo() MFSA 2005-49 Script injection from Firefox sidebar panel using data: MFSA 2005-48 Same-origin violation with InstallTrigger callback MFSA 2005-47 Code execution via "Set as Wallpaper" MFSA 2005-46 XBL scripts ran even when Javascript disabled MFSA 2005-45 Content-generated event vulnerabilities Note that MFSA 2006-07, which seems to be the subject of the 2/2006 CERT alert (though it's not marked critical at mozilla.org), is listed under Fixed in Firefox 1.5.0.1 *only* My poor command of technicalia deserts me here: is this a new vulnerability, or a newly discovered badness of an old one, or ...? And most important, I still don't see a distinction between M$ mozilla/firefox and linux mozilla/firefox. So are we at risk? Should we be shutting firefox and mozilla down, and keepting them down till 1.5 shows up in a repo?? -- Beartooth Oldfart, Neo-Redneck, Linux Convert FC4; Pine 4.64, Pan 0.14.2.91; Privoxy 3.0.3; Dillo 0.8.5, Opera 8.51, Firefox 1.0.7, Epiphany 1.6.5 Remember I have little idea what I am talking about.
