Rapid7 Vulnerability & Exploit Database

RHSA-2009:1095: firefox security update

Back to Search

RHSA-2009:1095: firefox security update



Mozilla Firefox is an open source Web browser. XULRunner provides the XULRuntime environment for Mozilla Firefox.Several flaws were found in the processing of malformed web content. A webpage containing malicious content could cause Firefox to crash or,potentially, execute arbitrary code as the user running Firefox.(CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1837, CVE-2009-1838,CVE-2009-1841)Multiple flaws were found in the processing of malformed, local filecontent. If a user loaded malicious, local content via the file:// URL, itwas possible for that content to access other local data. (CVE-2009-1835,CVE-2009-1839)A script, privilege elevation flaw was found in the way Firefox loaded XMLUser Interface Language (XUL) scripts. Firefox and certain add-ons couldload malicious content when certain policy checks did not happen.(CVE-2009-1840)A flaw was found in the way Firefox displayed certain Unicode characters inInternational Domain Names (IDN). If an IDN contained invalid characters,they may have been displayed as spaces, making it appear to the user thatthey were visiting a trusted site. (CVE-2009-1834)A flaw was found in the way Firefox handled error responses returned fromproxy servers. If an attacker is able to conduct a man-in-the-middle attackagainst a Firefox instance that is using a proxy server, they may be ableto steal sensitive information from the site the user is visiting.(CVE-2009-1836)For technical details regarding these flaws, refer to the Mozilla securityadvisories for Firefox 3.0.11. You can find a link to the Mozillaadvisories in the References section of this errata.All Firefox users should upgrade to these updated packages, which containFirefox version 3.0.11, which corrects these issues. After installing theupdate, Firefox must be restarted for the changes to take effect.


  • redhat-upgrade-firefox
  • redhat-upgrade-xulrunner
  • redhat-upgrade-xulrunner-devel
  • redhat-upgrade-xulrunner-devel-unstable

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center