Skip to navigation

Security Advisory Critical: xulrunner security update

Advisory: RHSA-2010:0809-1
Type: Security Advisory
Severity: Critical
Issued on: 2010-10-27
Last updated on: 2010-10-27
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2010-3765

Details

Updated xulrunner packages that fix one security issue are now available
for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

XULRunner provides the XUL Runtime environment for applications using the
Gecko layout engine.

A race condition flaw was found in the way XULRunner handled Document
Object Model (DOM) element properties. Malicious HTML content could cause
an application linked against XULRunner (such as Firefox) to crash or,
potentially, execute arbitrary code with the privileges of the user running
the application. (CVE-2010-3765)

For technical details regarding this flaw, refer to the Mozilla security
advisories for Firefox 3.6.12. You can find a link to the Mozilla
advisories in the References section of this erratum.

All XULRunner users should upgrade to these updated packages, which contain
a backported patch to correct this issue. After installing the update,
applications using XULRunner must be restarted for the changes to take
effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
xulrunner-1.9.2.11-4.el5_5.src.rpm
File outdated by:  RHSA-2013:1476
    MD5: 5190f66b8d527f9b6e5cd3df24cad059
SHA-256: 8c9f8395fad9913ff8ae96354800e9714078feaeefd41116d847b4d8105fd1a2
 
IA-32:
xulrunner-devel-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: db9dd5d401dea0ad0feae3b02a8735f0
SHA-256: 52394b71af42e81cb490c1518555914f1ec828be36a781210cdb92e25e314f91
 
x86_64:
xulrunner-devel-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: db9dd5d401dea0ad0feae3b02a8735f0
SHA-256: 52394b71af42e81cb490c1518555914f1ec828be36a781210cdb92e25e314f91
xulrunner-devel-1.9.2.11-4.el5_5.x86_64.rpm
File outdated by:  RHSA-2013:1476
    MD5: 4adb7908eb61ff5f2396aaeaeb00da44
SHA-256: cf5871cf7e452ee91dc974d37e0db8efc485186ff218024017d416d8beacc7a0
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
xulrunner-1.9.2.11-4.el5_5.src.rpm
File outdated by:  RHSA-2013:1476
    MD5: 5190f66b8d527f9b6e5cd3df24cad059
SHA-256: 8c9f8395fad9913ff8ae96354800e9714078feaeefd41116d847b4d8105fd1a2
 
IA-32:
xulrunner-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: 7c1a1c719e8126eaa061a6ce26905ceb
SHA-256: d967e989f263433c039c331b70d8f00a9c37b3d371d9383f29c4c075efb2ff27
xulrunner-devel-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: db9dd5d401dea0ad0feae3b02a8735f0
SHA-256: 52394b71af42e81cb490c1518555914f1ec828be36a781210cdb92e25e314f91
 
IA-64:
xulrunner-1.9.2.11-4.el5_5.ia64.rpm
File outdated by:  RHSA-2013:1476
    MD5: 2a6c9d1e32cfa034998821b078c79766
SHA-256: dc22ce5137c8fcab754e7cfa95266c706d1fae6fb0abae9f1b1809a3ff9b90bb
xulrunner-devel-1.9.2.11-4.el5_5.ia64.rpm
File outdated by:  RHSA-2013:1476
    MD5: 581a920af4f77b814903488835039f8a
SHA-256: 0f798cb101c0fe05afecfb37bfc8bd6afc21c58b34468fd9a9fb01130657cba9
 
PPC:
xulrunner-1.9.2.11-4.el5_5.ppc.rpm
File outdated by:  RHSA-2013:1476
    MD5: bbf18c50344da43ff7c6a0d2a770fc3a
SHA-256: f793221f7e15e34725fe271488ffa5ab9ddc263b75a96895513f35caa638d701
xulrunner-1.9.2.11-4.el5_5.ppc64.rpm
File outdated by:  RHSA-2013:1476
    MD5: 0171453eaf0da0d148cac600c86dcc41
SHA-256: cd12fa3ff847734128ddd9177e2e25f13946c170c6a040cee1c9ce6f2c65ac32
xulrunner-devel-1.9.2.11-4.el5_5.ppc.rpm
File outdated by:  RHSA-2013:1476
    MD5: 3d747f0a686b6c573d92273ba84d8fb0
SHA-256: 2d5baff1731e93914fe3db04f92d2fd8a9369015aab5848b8f7f632e3a90ac64
xulrunner-devel-1.9.2.11-4.el5_5.ppc64.rpm
File outdated by:  RHSA-2013:1476
    MD5: e1625bb33e7cd3c109fd095230a038b0
SHA-256: acfac7db3cb6cf3049218eb02af4e85974bf91b66efa9ec46e1f98b7ef09aca3
 
s390x:
xulrunner-1.9.2.11-4.el5_5.s390.rpm
File outdated by:  RHSA-2013:1476
    MD5: 18e8cc40166cff45c5e974a5f0e11bc2
SHA-256: d102bbdc80b6af3d96b9aca274032d6d20ff6e7d2b106cea2fc09d67fe366e92
xulrunner-1.9.2.11-4.el5_5.s390x.rpm
File outdated by:  RHSA-2013:1476
    MD5: d461ef8799908f8cedb3c719bcc04fa5
SHA-256: c3447801447a59de03238148db695050a39c9d94441c583617277f9dc81f1a7b
xulrunner-devel-1.9.2.11-4.el5_5.s390.rpm
File outdated by:  RHSA-2013:1476
    MD5: c36c387f661fd5184439b7a661205c48
SHA-256: a01466b643eb44f0649a19bfad1aa138f6e4291ddef9192b6791401c61c66c6f
xulrunner-devel-1.9.2.11-4.el5_5.s390x.rpm
File outdated by:  RHSA-2013:1476
    MD5: 8fe01f5ba873ac23b555da0810469208
SHA-256: 00494e68067d6554dac2e20b118df5fd3172b87e314f244375bc5c4d6c30e217
 
x86_64:
xulrunner-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: 7c1a1c719e8126eaa061a6ce26905ceb
SHA-256: d967e989f263433c039c331b70d8f00a9c37b3d371d9383f29c4c075efb2ff27
xulrunner-1.9.2.11-4.el5_5.x86_64.rpm
File outdated by:  RHSA-2013:1476
    MD5: aacf2f4a67fc09953bb190c2bab9e60b
SHA-256: 9723ff33e584c7c2516881c10659edb7df241bbcaf7c40f8e754eebcb7101eef
xulrunner-devel-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: db9dd5d401dea0ad0feae3b02a8735f0
SHA-256: 52394b71af42e81cb490c1518555914f1ec828be36a781210cdb92e25e314f91
xulrunner-devel-1.9.2.11-4.el5_5.x86_64.rpm
File outdated by:  RHSA-2013:1476
    MD5: 4adb7908eb61ff5f2396aaeaeb00da44
SHA-256: cf5871cf7e452ee91dc974d37e0db8efc485186ff218024017d416d8beacc7a0
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
xulrunner-1.9.2.11-4.el5_5.src.rpm
File outdated by:  RHSA-2013:1476
    MD5: 5190f66b8d527f9b6e5cd3df24cad059
SHA-256: 8c9f8395fad9913ff8ae96354800e9714078feaeefd41116d847b4d8105fd1a2
 
IA-32:
xulrunner-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: 7c1a1c719e8126eaa061a6ce26905ceb
SHA-256: d967e989f263433c039c331b70d8f00a9c37b3d371d9383f29c4c075efb2ff27
 
x86_64:
xulrunner-1.9.2.11-4.el5_5.i386.rpm
File outdated by:  RHSA-2013:1476
    MD5: 7c1a1c719e8126eaa061a6ce26905ceb
SHA-256: d967e989f263433c039c331b70d8f00a9c37b3d371d9383f29c4c075efb2ff27
xulrunner-1.9.2.11-4.el5_5.x86_64.rpm
File outdated by:  RHSA-2013:1476
    MD5: aacf2f4a67fc09953bb190c2bab9e60b
SHA-256: 9723ff33e584c7c2516881c10659edb7df241bbcaf7c40f8e754eebcb7101eef
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

646997 - CVE-2010-3765 Firefox race condition flaw (MFSA 2010-73)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/