firefox-17.0.3-1.0.1.AXS4, xulrunner-17.0.3-1.0.1.AXS4, libproxy-0.3.0-4.AXS4, yelp-2.28.1-17.AXS4
エラータID: AXSA:2013-196:02
リリース日:
2013/03/19 Tuesday - 13:50
題名:
firefox-17.0.3-1.0.1.AXS4, xulrunner-17.0.3-1.0.1.AXS4, libproxy-0.3.0-4.AXS4, yelp-2.28.1-17.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Mozilla Firefox の nsImageLoadingContent::OnStopContainer 関数には解放後使用が存在し，巧妙に細工された Web スクリプトによって，リモートの攻撃者が任意のコードを実行する脆弱性があります。(CVE-2013-0775)
- Mozilla Firefox には中間者攻撃を行う攻撃者が Web スクリプトを伴う 407 HTTP ステータスコードを提供するプロキシサーバを操作することによって，アドレスバーを偽る脆弱性があります。(CVE-2013-0776)
- Mozilla Firefox の nsOverflowContinuationTracker::Finish 関数には解放後使用が存在し，カスケーディングスタイルシート (CSS) -moz-column-* プロパティを使用する巧妙に細工されたドキュメントによって，リモートの攻撃者が任意のコードを実行したり，サービス拒否 (ヒープメモリの破壊) を引き起こす脆弱性があります。(CVE-2013-0780)
- Mozilla Firefox の nsSaveAsCharset::DoCharsetConversion 関数にはヒープベースのバッファーオーバーフローが存在し，リモートの攻撃者が任意のコードを実行する脆弱性があります。(CVE-2013-0782)
- Mozilla Firefox のブラウザエンジンには複数の詳細不明の脆弱性が存在し，リモートの攻撃者がサービス拒否 (メモリ破壊とアプリケーションのクラッシュ) を引き起こしたり，任意のコードを実行する可能性のある脆弱性があります。(CVE-2013-0783)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2013-0775
Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.
Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.
CVE-2013-0776
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
CVE-2013-0780
Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.
Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.
CVE-2013-0782
Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.
Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2013-0783
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
追加情報:
N/A
ダウンロード:
SRPMS
- firefox-17.0.3-1.0.1.AXS4.src.rpm
MD5: edb41b7e43fccbd2a138da6e57b27dd2
SHA-256: 6933bb7610615cd7692695af280cb88c01e4b899cea61324770873930457f170
Size: 108.00 MB - libproxy-0.3.0-4.AXS4.src.rpm
MD5: 27c09b807326fed6f84222bfe285526d
SHA-256: eddddc87fd386d2327d7974888171d10abdd5eb27432a7f7feac8582feddfbc3
Size: 367.24 kB - xulrunner-17.0.3-1.0.1.AXS4.src.rpm
MD5: 0a663e99a511b4e140f85af347e769d0
SHA-256: d4db47dd52025aa1e9d053e04e723d3ceb02fb6dd5663811a97c7fe2944d0000
Size: 86.25 MB - yelp-2.28.1-17.AXS4.src.rpm
MD5: afd99686509c816914d18f8396707b58
SHA-256: de464891f64f1848d068bd76dc617925b3d87142738bfee4b894aa41948c5f53
Size: 1.13 MB
Asianux Server 4 for x86
- firefox-17.0.3-1.0.1.AXS4.i686.rpm
MD5: a78fd97464e83c121e4cb5b0ed65983c
SHA-256: 8a56c416950f3799c31be027dbdf07e17e944b9be90064275c72acca0f0b600b
Size: 25.40 MB - libproxy-0.3.0-4.AXS4.i686.rpm
MD5: f12ffd003a48320016082addd19dde88
SHA-256: 8100fda285e8becad59cb4c3c4e5cfdcd03b98aba1cabcaa2f25236f32513fc2
Size: 38.08 kB - libproxy-bin-0.3.0-4.AXS4.i686.rpm
MD5: af45a78de86aeafa91fc0eebbec4d562
SHA-256: 3764e458c0050511f0f3bb226d835777601dac89b324034a8db259448c12e54b
Size: 7.66 kB - libproxy-python-0.3.0-4.AXS4.i686.rpm
MD5: ec7c81d22cd9d9b65ff56fcc1fefe6e6
SHA-256: d543309164f2ebb985d1eba6a737b3247e3a8e354cb34e9c7d7359215b7d89cb
Size: 7.92 kB - xulrunner-17.0.3-1.0.1.AXS4.i686.rpm
MD5: 3c6ae4521aeafcfbedbf8e8e86f2e464
SHA-256: 6b32019f14ad15e1220af0a8872a7aec26a41e1ceeb4a580513f21f055543947
Size: 14.07 MB - yelp-2.28.1-17.AXS4.i686.rpm
MD5: ef860c4ec268f18fd6fc4111582b5113
SHA-256: 51445bc32039ee1056f59d3fd779de082c8e777f31389da073e1e519692d2685
Size: 811.73 kB
Asianux Server 4 for x86_64
- firefox-17.0.3-1.0.1.AXS4.x86_64.rpm
MD5: 0ba5dff90bb1f048af7185af8001a298
SHA-256: 1fece1d3584bfbaaf0210c22b2719291a2ef4c5b98c251f3dd87c8421d0bd50c
Size: 25.38 MB - firefox-17.0.3-1.0.1.AXS4.i686.rpm
MD5: a78fd97464e83c121e4cb5b0ed65983c
SHA-256: 8a56c416950f3799c31be027dbdf07e17e944b9be90064275c72acca0f0b600b
Size: 25.40 MB - libproxy-0.3.0-4.AXS4.x86_64.rpm
MD5: 03d7145fdb160df6d50cf142704b560c
SHA-256: f56cfdc76e5a91f6ebebabce057757f1989ea00082d8b43f5611e5c2b6cfa599
Size: 37.65 kB - libproxy-bin-0.3.0-4.AXS4.x86_64.rpm
MD5: 3d980c19aaaa2fa35e53c7900ee080ea
SHA-256: d2d58d84ece1b48bf4cdc95f73e03bcd804557bf0636f0311459b8fa0880ee76
Size: 7.31 kB - libproxy-python-0.3.0-4.AXS4.x86_64.rpm
MD5: 4a26247efaf5f4c6bbf2c43b539f8d9d
SHA-256: 501c20793f2df6b62e03b1833ebc6476d9b07c5bc58f072d5d30f77ddec0c3ca
Size: 7.48 kB - libproxy-0.3.0-4.AXS4.i686.rpm
MD5: f12ffd003a48320016082addd19dde88
SHA-256: 8100fda285e8becad59cb4c3c4e5cfdcd03b98aba1cabcaa2f25236f32513fc2
Size: 38.08 kB - xulrunner-17.0.3-1.0.1.AXS4.x86_64.rpm
MD5: 1dac723803ed3d79a0c51ee5d7c7ad48
SHA-256: 0ed5bc1e226b48194d75f54bd78ca916dd8775d038192f2ddce3e98e1865bfbf
Size: 14.85 MB - xulrunner-17.0.3-1.0.1.AXS4.i686.rpm
MD5: 3c6ae4521aeafcfbedbf8e8e86f2e464
SHA-256: 6b32019f14ad15e1220af0a8872a7aec26a41e1ceeb4a580513f21f055543947
Size: 14.07 MB - yelp-2.28.1-17.AXS4.x86_64.rpm
MD5: 7792dd963d5c06ff898b431f9fc85c78
SHA-256: 8d783925bd813cdb07ab834a74cb1c33c300b3e1ffdbf76e52d40259d4d2843e
Size: 811.66 kB