Mozilla Browser Cache File Multiple Vulnerabilities
BID:10709
Info
Mozilla Browser Cache File Multiple Vulnerabilities
| Bugtraq ID: | 10709 |
| Class: | Design Error |
| CVE: |
CVE-2004-0760 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 13 2004 12:00AM |
| Updated: | Jul 12 2009 06:16AM |
| Credit: | Discovery is credited to Mind Warper <[email protected]>. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 8 SuSE Linux Enterprise Server 9 SuSE Linux Desktop 1.0 SuSE Linux 8.1 SGI Advanced Linux Environment 3.0 SCO Unixware 7.1.4 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 Redhat Linux 9.0 i386 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Redhat Fedora Core1 Mozilla Firefox 0.9.1 Mozilla Firefox 0.9 rc Mozilla Firefox 0.9 Mozilla Firefox 0.8 Mozilla Firebird 0.7 Mozilla Firebird 0.6.1 Mozilla Firebird 0.5 Mozilla Browser 1.7.1 Mozilla Browser 1.7 rc3 Mozilla Browser 1.7 Mozilla Browser 1.6 Mozilla Browser 1.5 Mozilla Browser 1.4.2 Mozilla Browser 1.4.1 Mozilla Browser 1.4 b Mozilla Browser 1.4 a Mozilla Browser 1.4 Mozilla Browser 1.3.1 Mozilla Browser 1.3 Mozilla Browser 1.2.1 Mozilla Browser 1.2 Beta Mozilla Browser 1.2 Alpha Mozilla Browser 1.2 Mozilla Browser 1.1 Beta Mozilla Browser 1.1 Alpha Mozilla Browser 1.1 Mozilla Browser 1.0.2 Mozilla Browser 1.0.1 Mozilla Browser 1.0 RC2 Mozilla Browser 1.0 RC1 Mozilla Browser 1.0 Mozilla Browser 0.9.48 Mozilla Browser 0.9.35 Mozilla Browser 0.9.9 Mozilla Browser 0.9.8 Mozilla Browser 0.9.7 Mozilla Browser 0.9.6 Mozilla Browser 0.9.5 Mozilla Browser 0.9.4 .1 Mozilla Browser 0.9.4 Mozilla Browser 0.9.3 Mozilla Browser 0.9.2 .1 Mozilla Browser 0.9.2 Mozilla Browser 0.8 Mozilla Browser M16 Mozilla Browser M15 Compaq Tru64 5.1 b PK4 (BL25) Compaq Tru64 5.1 b PK3(BL24) Compaq Tru64 5.1 a PK6(BL24) Avaya Network Routing |
| Not Vulnerable: | |
Discussion
Mozilla Browser Cache File Multiple Vulnerabilities
Mozilla Browser is reported prone to multiple vulnerabilities that could eventually allow for code execution on the local computer.
These vulnerabilities do not represent a significant threat on their own, however, code execution in the context of the user is possible if the two issues are combined.
By combining these issues, an attacker can eventually execute arbitrary HTML or script code in the local zone. The attacker would likely exploit these issues by crafting a malicious Web site containing HTML and script code and entice a user to visit the site. If a user visits the site, the malicious page will be cached in a known directory with a known file name. The attacker may then craft a link to this cached local file and entice a user to follow this link. Due to a flaw in Mozilla that allows cached files to be opened in the local zone as HTML documents the attack may lead to arbitrary code execution in the local zone.
It should be noted that this issue is reported to exist in all versions of Mozilla and Firefox browsers, however, Symantec was not able to reproduce this on Firefox 0.9.2. Furthermore, the directory names may vary with different platforms.
Update: New reports have stated that the Mozilla Browser is not vulnerable to the first issue as it uses random names for cache directories. This issue does however affect Firefox. It is also reported that an attacker does not have to use a file extension for the second vulnerability as long as a NULL byte is placed after the file name. Arbitrary extensions may be applied as well.
Mozilla Browser is reported prone to multiple vulnerabilities that could eventually allow for code execution on the local computer.
These vulnerabilities do not represent a significant threat on their own, however, code execution in the context of the user is possible if the two issues are combined.
By combining these issues, an attacker can eventually execute arbitrary HTML or script code in the local zone. The attacker would likely exploit these issues by crafting a malicious Web site containing HTML and script code and entice a user to visit the site. If a user visits the site, the malicious page will be cached in a known directory with a known file name. The attacker may then craft a link to this cached local file and entice a user to follow this link. Due to a flaw in Mozilla that allows cached files to be opened in the local zone as HTML documents the attack may lead to arbitrary code execution in the local zone.
It should be noted that this issue is reported to exist in all versions of Mozilla and Firefox browsers, however, Symantec was not able to reproduce this on Firefox 0.9.2. Furthermore, the directory names may vary with different platforms.
Update: New reports have stated that the Mozilla Browser is not vulnerable to the first issue as it uses random names for cache directories. This issue does however affect Firefox. It is also reported that an attacker does not have to use a file extension for the second vulnerability as long as a NULL byte is placed after the file name. Arbitrary extensions may be applied as well.
Exploit / POC
Mozilla Browser Cache File Multiple Vulnerabilities
No exploit is required.
The following proof of concept is available:
file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html
No exploit is required.
The following proof of concept is available:
file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html
Solution / Fix
Mozilla Browser Cache File Multiple Vulnerabilities
Solution:
Avaya has released an advisory that acknowledges this vulnerability for Avaya products. Fixes are not currently available; customers are advised to contact the vendor for further details regarding fix availability. Please see the referenced Avaya advisory at the following location for further details:
http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=198527&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()
SCO has released an advisory SCOSA-2005.25 including updated packages to address this issue. Please see the referenced advisory for more information.
RedHat has released advisory RHSA-2004:421-17 and fixes dealing with this issue for Mozilla on RedHat Enterprise Linux platforms. Please see the referenced advisory for further information.
Slackware has released an advisory (SSA:2004-223-01) to address this issue. Please see the referenced advisory for more information.
SGI has made available Patch 10095, correcting this vulnerability for systems running SGI Advanced Linux Environment 3:
Patch 10095 is available from http://support.sgi.com/ and
ftp://patches.sgi.com/support/free/security/patches/ProPack/3/
The individual RPMs from Patch 10095 are available from:
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS
HP has released advisory "HPSBTU01063 SSRT4778 - rev.2 Mozilla Application Suite for HP Tru64 UNIX - Potential Overflows - Denial of Service - Unauthorized access" to address this and other issues. Please see the attached advisory for fix information.
SuSE Linux has released advisory SUSE-SA:2004:036 along with fixes dealing with this issue. Please see the referenced advisory for more information.
Conectiva has released an advisory (CLA-2004:877) to address various issues including this in Mozilla. This advisory contains updated Mozilla packages (1.7.3) for Conectiva Linux 9 and 10. Please see the referenced advisory for more information.
The Fedora Legacy project has released advisory FLSA-2004:2089 along with fixes to address multiple issues in RedHat Fedora Core 1, and RedHat Linux 7.3 and 9.0. Please see the referenced advisory for further information.
Mozilla Browser 0.9.9
Mozilla Browser 1.2.1
Mozilla Browser 1.4
Mozilla Browser 1.4.1
Mozilla Browser 1.6
Mozilla Browser 1.7
Solution:
Avaya has released an advisory that acknowledges this vulnerability for Avaya products. Fixes are not currently available; customers are advised to contact the vendor for further details regarding fix availability. Please see the referenced Avaya advisory at the following location for further details:
http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=198527&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()
SCO has released an advisory SCOSA-2005.25 including updated packages to address this issue. Please see the referenced advisory for more information.
RedHat has released advisory RHSA-2004:421-17 and fixes dealing with this issue for Mozilla on RedHat Enterprise Linux platforms. Please see the referenced advisory for further information.
Slackware has released an advisory (SSA:2004-223-01) to address this issue. Please see the referenced advisory for more information.
SGI has made available Patch 10095, correcting this vulnerability for systems running SGI Advanced Linux Environment 3:
Patch 10095 is available from http://support.sgi.com/ and
ftp://patches.sgi.com/support/free/security/patches/ProPack/3/
The individual RPMs from Patch 10095 are available from:
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS
HP has released advisory "HPSBTU01063 SSRT4778 - rev.2 Mozilla Application Suite for HP Tru64 UNIX - Potential Overflows - Denial of Service - Unauthorized access" to address this and other issues. Please see the attached advisory for fix information.
SuSE Linux has released advisory SUSE-SA:2004:036 along with fixes dealing with this issue. Please see the referenced advisory for more information.
Conectiva has released an advisory (CLA-2004:877) to address various issues including this in Mozilla. This advisory contains updated Mozilla packages (1.7.3) for Conectiva Linux 9 and 10. Please see the referenced advisory for more information.
The Fedora Legacy project has released advisory FLSA-2004:2089 along with fixes to address multiple issues in RedHat Fedora Core 1, and RedHat Linux 7.3 and 9.0. Please see the referenced advisory for further information.
Mozilla Browser 0.9.9
-
RedHat galeon-1.2.13-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/galeon-1.2.13 -0.7.1.legacy.i386.rpm -
RedHat mozilla-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-1.4.3 -0.7.1.legacy.i386.rpm -
RedHat mozilla-chat-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-chat- 1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-devel-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-devel -1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-dom-inspector-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-dom-i nspector-1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-js-debugger-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-js-de bugger-1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-mail-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-mail- 1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-nspr-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-nspr- 1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-nspr-devel-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-nspr- devel-1.4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-nss-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-nss-1 .4.3-0.7.1.legacy.i386.rpm -
RedHat mozilla-nss-devel-1.4.3-0.7.1.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mozilla-nss-d evel-1.4.3-0.7.1.legacy.i386.rpm
Mozilla Browser 1.2.1
-
RedHat galeon-1.2.13-0.9.2.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/galeon-1.2.13-0 .9.2.legacy.i386.rpm -
RedHat mozilla-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-1.4.3-0 .9.1.legacy.i386.rpm -
RedHat mozilla-chat-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-chat-1. 4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-devel-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-devel-1 .4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-dom-inspector-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-dom-ins pector-1.4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-js-debugger-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-js-debu gger-1.4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-mail-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-mail-1. 4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-nspr-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-nspr-1. 4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-nspr-devel-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-nspr-de vel-1.4.3-0.9.1.legacy.i386.rpm -
RedHat mozilla-nss-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-nss-1.4 .3-0.9.1.legacy.i386.rpm -
RedHat mozilla-nss-devel-1.4.3-0.9.1.legacy.i386.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/mozilla-nss-dev el-1.4.3-0.9.1.legacy.i386.rpm
Mozilla Browser 1.4
-
Slackware mozilla-1.4.3-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/m ozilla-1.4.3-i486-1.tgz -
Slackware mozilla-plugins-1.4.3-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/m ozilla-plugins-1.4.3-noarch-1.tgz
Mozilla Browser 1.4.1
-
RedHat epiphany-1.0.4-2.4.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/epiphany-1.0.4- 2.4.legacy.i386.rpm -
RedHat mozilla-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-1.4.3-1 .fc1.1.legacy.i386.rpm -
RedHat mozilla-chat-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-chat-1. 4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-devel-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-devel-1 .4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-dom-inspector-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-dom-ins pector-1.4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-js-debugger-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-js-debu gger-1.4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-mail-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-mail-1. 4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-nspr-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-nspr-1. 4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-nspr-devel-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-nspr-de vel-1.4.3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-nss-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-nss-1.4 .3-1.fc1.1.legacy.i386.rpm -
RedHat mozilla-nss-devel-1.4.3-1.fc1.1.legacy.i386.rpm
RedHat Fedora Core 1
http://download.fedoralegacy.org/fedora/1/updates/i386/mozilla-nss-dev el-1.4.3-1.fc1.1.legacy.i386.rpm
Mozilla Browser 1.6
-
Conectiva libnspr-devel-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libnspr-devel-1.7.3-27852U9 0_4cl.i386.rpm -
Conectiva libnspr-devel-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libnspr-devel-1.7.3-60868U 10_1cl.i386.rpm -
Conectiva libnspr4-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libnspr4-1.7.3-27852U90_4cl .i386.rpm -
Conectiva libnspr4-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libnspr4-1.7.3-60868U10_1c l.i386.rpm -
Conectiva libnss-devel-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libnss-devel-1.7.3-27852U90 _4cl.i386.rpm -
Conectiva libnss-devel-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libnss-devel-1.7.3-60868U1 0_1cl.i386.rpm -
Conectiva libnss3-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libnss3-1.7.3-27852U90_4cl. i386.rpm -
Conectiva libnss3-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libnss3-1.7.3-60868U10_1cl .i386.rpm -
Conectiva mozilla-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-1.7.3-27852U90_4cl. i386.rpm -
Conectiva mozilla-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-1.7.3-60868U10_1cl .i386.rpm -
Conectiva mozilla-base-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-base-1.7.3-27852U90 _4cl.i386.rpm -
Conectiva mozilla-base-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-base-1.7.3-60868U1 0_1cl.i386.rpm -
Conectiva mozilla-devel-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-devel-1.7.3-27852U9 0_4cl.i386.rpm -
Conectiva mozilla-devel-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-devel-1.7.3-60868U 10_1cl.i386.rpm -
Conectiva mozilla-dom-inspector-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-dom-inspector-1.7.3 -27852U90_4cl.i386.rpm -
Conectiva mozilla-dom-inspector-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-dom-inspector-1.7. 3-60868U10_1cl.i386.rpm -
Conectiva mozilla-irc-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-irc-1.7.3-27852U90_ 4cl.i386.rpm -
Conectiva mozilla-irc-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-irc-1.7.3-60868U10 _1cl.i386.rpm -
Conectiva mozilla-js-debugger-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-js-debugger-1.7.3-2 7852U90_4cl.i386.rpm -
Conectiva mozilla-js-debugger-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-js-debugger-1.7.3- 60868U10_1cl.i386.rpm -
Conectiva mozilla-mail-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-mail-1.7.3-27852U90 _4cl.i386.rpm -
Conectiva mozilla-mail-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-mail-1.7.3-60868U1 0_1cl.i386.rpm -
Conectiva mozilla-psm-1.7.3-27852U90_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mozilla-psm-1.7.3-27852U90_ 4cl.i386.rpm -
Conectiva mozilla-psm-1.7.3-60868U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mozilla-psm-1.7.3-60868U10 _1cl.i386.rpm
Mozilla Browser 1.7
-
Slackware epiphany-1.2.7-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ epiphany-1.2.7-i486-1.tgz -
Slackware gaim-0.81-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ gaim-0.81-i486-1.tgz -
Slackware galeon-1.3.17-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ galeon-1.3.17-i486-1.tgz -
Slackware mozilla-1.7.2-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ mozilla-1.7.2-i486-1.tgz -
Slackware mozilla-plugins-1.7.2-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ mozilla-plugins-1.7.2-noarch-1.tgz
References
Mozilla Browser Cache File Multiple Vulnerabilities
References:
References:
- Mozilla Homepage (Mozilla Foundation)
- RHSA-2004:421-17 - Updated mozilla packages fix security issues (RedHat)
- Two Vulnerabilities in Mozilla may lead to remote compromise (Mind Warper