Vulnerability Bulletins |
Obtención de acceso en Firefox, Thunderbird y SeaMonkey |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | Comercial Software |
| Affected software |
Firefox 3.6.13 Firefox 3.5.16 Thunderbird 3.1.7 Thunderbird 3.0.11 SeaMonkey 2.0.11 |
Description |
|
|
CVE-2010-3768: Se ha descubierto una vulnerabilidad en Firefox 3.6.13, Firefox 3.5.16, Thunderbird 3.1.7, Thunderbird 3.0.11 y SeaMonkey 2.0.11. La vulnerabilidad reside en la descarga de fuentes del código fuente OS del subrayado en la librería "OpenType sanitizer". Un atacante remoto podría causar un impacto desconocido mediante métodos no especificados. |
|
Solution |
|
|
Actualización de software Mozilla Firefox 3.6.13 Firefox 3.5.16 http://www.mozilla.org/products/firefox/ SeaMonkey 2.0.11 http://www.seamonkey-project.org/ Red Hat (RHSA-2010:0547-1) RHEL Desktop Workstation (v. 5 cliente) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux AS version 4 Red Hat Enterprise Linux Desktop (v. 5 cliente) Red Hat Enterprise Linux Desktop (v. 6) Red Hat Enterprise Linux Desktop Optional (v. 6) Red Hat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux ES version 4 Red Hat Enterprise Linux HPC Node Optional (v. 6) Red Hat Enterprise Linux Server (v. 6) Red Hat Enterprise Linux Server Optional (v. 6) Red Hat Enterprise Linux WS version 4 - Red Hat Enterprise Linux Workstation (v. 6) Red Hat Enterprise Linux Workstation Optional (v. 6) https://rhn.redhat.com/ Thunderbird 3.1,7 http://www.mozilla.org/products/thunderbird/ Thunderbird 3.0.11 http://www.mozilla.org/products/thunderbird/ Red Hat (RHSA-2010:0969-1) Red Hat Enterprise Linux AS versión 4 Red Hat Enterprise Linux Desktop (v. 5 cliente) Red Hat Enterprise Linux Desktop versión 4 Red Hat Enterprise Linux ES version 4 Red Hat Enterprise Linux WS versión 4 https://rhn.redhat.com/ Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2010-3768 |
| BID | |
Other resources |
|
|
Mozilla Foundation Security Advisory (2010-78) http://www.mozilla.org/security/announce/2010/mfsa2010-78.html Red Hat Security Advisory (RHSA- 2010:0811-01) https://rhn.redhat.com/errata/RHSA- 2010:0811-01.html Red Hat Security Advisory (RHSA-2010:0969-01) https://rhn.redhat.com/errata/RHSA-2010-0969.html SUSE Security Advisory (SUSE-SA:2011:003) http://www.novell.com/linux/security/advisories/2011_03_firefox.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2010-12-10 |
| 1.1 | Aviso emitido por Red Hat (RHSA-2010:0966-01) | 2010-12-13 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2010:0969-01) | 2010-12-15 |
| 1.3 | Aviso emitido por Suse (SUSE-SA:2011:003) | 2011-01-10 |