int(5598)

Boletines de Vulnerabilidades


Ejecución de código en Firefox y SeaMonkey

Clasificación de la vulnerabilidad

Propiedad Valor
Nivel de Confianza Oficial
Impacto Obtener acceso
Dificultad Experto
Requerimientos del atacante Acceso remoto sin cuenta a un servicio estandar

Información sobre el sistema

Propiedad Valor
Fabricante afectado Comercial Software
Software afectado Firefox 3.6.13
Firefox 3.5.16
SeaMonkey 2.0.11

Descripción

CVE-2010-3771: Se ha descubierto una vulnerabilidad en Firefox 3.6.13, Firefox 3.5.16 y SeaMonkey 2.0.11. La vulnerabilidad reside un defecto en el campo "about" en documentos web.
Un atacante remoto podría ejecutar código arbitrario mediante la inyección de código en una página sin validar.

Solución



Actualización de software

Mozilla
Firefox 3.6.13
Firefox 3.5.16
http://www.mozilla.org/products/firefox/
SeaMonkey 2.0.11
http://www.seamonkey-project.org/

Actualización de software

Debian (DSA-2132-1)

Debian Linux 5.0
Source

http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19-7.dsc http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19-7.diff.gz http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.19.orig.tar.gz Architecture independent packages: http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.19-7_all.deb alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_alpha.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_alpha.deb amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_amd64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_amd64.deb arm architecture (ARM) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_arm.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_arm.deb armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_armel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_armel.deb hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_hppa.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_hppa.deb i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_i386.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_i386.deb ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_ia64.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_ia64.deb mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_mips.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_mips.deb mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_mipsel.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_mipsel.deb powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_powerpc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_powerpc.deb s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_s390.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_s390.deb sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.19-7_sparc.deb http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.19-7_sparc.deb

Identificadores estándar

Propiedad Valor
CVE CVE-2010-3771
BID

Recursos adicionales

Mozilla Foundation Security Advisory (2010-76)
http://www.mozilla.org/security/announce/2010/mfsa2010-76.html

Debian Security Advisory (DSA-2132-1)
http://lists.debian.org/debian-security-announce/2010/msg00183.html

Histórico de versiones

Versión Comentario Fecha
1.0 Aviso emitido 2010-12-10
1.1 Aviso emitido por Debian (DSA-2132-1) 2010-12-13

Miembros de

Ministerio de Defensa
CNI
CCN
CCN-CERT