Note: This is an archival copy of Security Sun Alert 231441 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1018977.1.
Date of Workaround Release
Date of Resolved Release
Multiple Security Vulnerabilities in Solaris 10 Firefox and Thunderbird
Multiple security vulnerabilities in the firefox(1) and thunderbird(1)
applications shipped with Solaris 10 may allow a local or remote
unprivileged user to execute arbitrary code on a remote machine with
the privileges of a local user, cause firefox(1) and thunderbird(1)
applications to crash, or conduct Cross-Site Scripting (XSS) attacks on
sites which allow users to upload pictures, archives, or other files.
The ability to crash the firefox(1) or thunderbird(1) application is a
type of Denial of Service (DoS).
The following Mozilla advisories describe the vulnerabilities:
CVE-2007-5960 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960
CVE-2007-5959 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959
CVE-2007-5947 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947
CVE-2007-5339 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5339
CVE-2007-5340 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340
CERT VU# 715737 at http://www.kb.cert.org/vuls/id/715737
CERT VU#559977 at http://www.kb.cert.org/vuls/id/559977
CERT VU#755513 at http://www.kb.cert.org/vuls/id/755513
The issues described in mfsa2007-37, mfsa2007-38 and mfsa2007-39 affect Firefox only and are fixed in the Firefox patches listed in this Sun Alert.
The following additional issue described in MFSA2007-29 impacts both Firefox and Thunderbird, but is described for Firefox in Sun Alert 201516 (previously 103177), and is described for Thunderbird in this Sun Alert. It is fixed in the Thunderbird patches listed in this Sun Alert.
2. Contributing FactorsThese issues can occur in the following releases:
Note: Firefox and Thunderbird first shipped with Solaris 10 Update 4 (8/07). Firefox is shipped in the SUNWfirefox package and Thunderbird is shipped in the SUNWthunderbird package.
To determine which update release has been installed on a Solaris 10 system, review the /etc/release file:
$ cat /etc/release
3. SymptomsThere are no predictable symptoms that would indicate the described
issues have been exploited.
4. WorkaroundTo work around the issues described in CVE-2007-5947, sites can use a proxy server or application firewall which blocks URIs that contain jar: URIs.
5. ResolutionThis issue is addressed in the following releases:
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
12-Feb-2008: Updated Contributing Factors and Resolution sections, RESOLVED
Solaris 10 Operating System
This solution has no attachment