Skip to navigation

Security Advisory Critical: firefox security update

Advisory: RHSA-2008:0598-4
Type: Security Advisory
Severity: Critical
Issued on: 2008-07-16
Last updated on: 2008-07-16
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.5.z)
Red Hat Enterprise Linux AS (v. 4.6.z)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.5.z)
Red Hat Enterprise Linux ES (v. 4.6.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2008-2785
CVE-2008-2933

Details

An updated firefox package that fixes various security issues is now
available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

An integer overflow flaw was found in the way Firefox displayed certain web
content. A malicious web site could cause Firefox to crash, or execute
arbitrary code with the permissions of the user running Firefox.
(CVE-2008-2785)

A flaw was found in the way Firefox handled certain command line URLs. If
another application passed Firefox a malformed URL, it could result in
Firefox executing local malicious content with chrome privileges.
(CVE-2008-2933)

All firefox users should upgrade to this updated package, which contains
backported patches that correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm
File outdated by:  RHSA-2012:0142
    MD5: 32012102fc623103282ae810e86f0120
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm
File outdated by:  RHSA-2012:0142
    MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 7cff7516dff79d4201001d623e9f9807
 
PPC:
firefox-1.5.0.12-0.21.el4.ppc.rpm
File outdated by:  RHSA-2012:0142
    MD5: 1aff46ea693455d9aac3cb9ee3f8f529
 
s390:
firefox-1.5.0.12-0.21.el4.s390.rpm
File outdated by:  RHSA-2012:0142
    MD5: c4a216827e1de3b784c8d129bd853837
 
s390x:
firefox-1.5.0.12-0.21.el4.s390x.rpm
File outdated by:  RHSA-2012:0142
    MD5: 91af13a761709fa5ce68c8ccfcd843e1
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux AS (v. 4.5.z)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm     MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm     MD5: 7cff7516dff79d4201001d623e9f9807
 
PPC:
firefox-1.5.0.12-0.21.el4.ppc.rpm     MD5: 1aff46ea693455d9aac3cb9ee3f8f529
 
s390:
firefox-1.5.0.12-0.21.el4.s390.rpm     MD5: c4a216827e1de3b784c8d129bd853837
 
s390x:
firefox-1.5.0.12-0.21.el4.s390x.rpm     MD5: 91af13a761709fa5ce68c8ccfcd843e1
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm     MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux AS (v. 4.6.z)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm     MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm     MD5: 7cff7516dff79d4201001d623e9f9807
 
PPC:
firefox-1.5.0.12-0.21.el4.ppc.rpm     MD5: 1aff46ea693455d9aac3cb9ee3f8f529
 
s390:
firefox-1.5.0.12-0.21.el4.s390.rpm     MD5: c4a216827e1de3b784c8d129bd853837
 
s390x:
firefox-1.5.0.12-0.21.el4.s390x.rpm     MD5: 91af13a761709fa5ce68c8ccfcd843e1
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm     MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm
File outdated by:  RHSA-2012:0142
    MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 7cff7516dff79d4201001d623e9f9807
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux ES (v. 4.5.z)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm     MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm     MD5: 7cff7516dff79d4201001d623e9f9807
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm     MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux ES (v. 4.6.z)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm     MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm     MD5: 7cff7516dff79d4201001d623e9f9807
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm     MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
firefox-1.5.0.12-0.21.el4.src.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f248732de77ed2d87924dc0d56d47e6
 
IA-32:
firefox-1.5.0.12-0.21.el4.i386.rpm
File outdated by:  RHSA-2012:0142
    MD5: 32012102fc623103282ae810e86f0120
 
IA-64:
firefox-1.5.0.12-0.21.el4.ia64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 7cff7516dff79d4201001d623e9f9807
 
x86_64:
firefox-1.5.0.12-0.21.el4.x86_64.rpm
File outdated by:  RHSA-2012:0142
    MD5: 6f6c522ed5a6653dacfb5ed753bbc608
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

452204 - CVE-2008-2785 mozilla: CSS reference counter overflow (ZDI-CAN-349)
454697 - CVE-2008-2933 Firefox command line URL launches multi-tabs


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/