1. Impact

Multiple security vulnerabilities in the firefox(1) application shipped with
Solaris 10 may allow local or remote unprivileged user to execute arbitrary
code on a remote machine with the privileges of a local user or trick local
users into confirming an unsafe action, such as remote file execution or
gain access to unauthorised data and cause firefox(1) application to crash,
or conduct Cross-Site Scripting (XSS) attacks on sites which allow users to
upload pictures, archives, or other files. The ability to crash the firefox(1)
application is a type of Denial of Service (Dos).

The following Mozilla advisories describe the vulnerabities:

2. Contributing Factors

These issues can occur in the following releases:

SPARC Platform

• Firefox 2.0 for Solaris 10 without patch 125539-04

• OpenSolaris based upon builds snv_88 or earlier

x86 Platform

• Firefox 2.0 for Solaris 10 without patch 125540-04

• OpenSolaris based upon builds snv_88 or earlier

Note: Solaris 8 and Solaris 9 do not ship Firefox and hence are
not affected by these issues.

Note: OpenSolaris distributions may include additional bug fixes above
and beyond the build from which it was derived.
The base build can be derived as follows:

 $uname -a
 SunOS hostname 5.11 snv_86 i86pc i386 i86pc

3. Symptoms

There are no predictable symptoms that would indicate the described issues have
been exploited.

4. Workaround

To work around the issues described in CVE-2008-0412, CVE-2008-0413,
CVE-2008-0415, CVE-2008-0416, CVE-2008-0419, CVE-2008-0420,
CVE-2008-0591, CVE-2008-0593, CVE-2008-1233, CVE-2008-1234,
CVE-2008-1235, CVE-2008-1236, CVE-2008-1237, CVE-2008-1238,
CVE-2007-4879, CVE-2008-1195, CVE-2008-1240, CVE-2008-1241 and
CVE-2008-1380 disable JavaScript by doing the following:

1. Open the "Preferences" dialog from the Edit menu
2. Select the "Content" tab
3. Uncheck the "Enable JavaScript" check box

To work around the issues described in CVE-2008-0417, do not ask
Firefox to save passwords on untrusted sites.

To work around the issues described in CVE-2008-0418, disable
"flat-packaged" add-ons.

5. Resolution

These issues addressed in the following releases:

SPARC Platform

• Solaris 10 with patch 125539-04 or later

• OpenSolaris based upon builds snv_89 or later

x86 Platform

• Solaris 10 with patch 125540-04 or later

• OpenSolaris based upon builds snv_89 or later

This solution has no attachment