The Mozilla Firefox 3.0.12 release fixes various bugs and some critical security issues.

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-34 / CVE-2009-2462 /     CVE-2009-2463 / CVE-2009-2464 / CVE-2009-2465 /     CVE-2009-2466)

  - Security researcher Attila Suszter reported that when a     page contains a Flash object which presents a slow     script dialog, and the page is navigated while the     dialog is still visible to the user, the Flash plugin is     unloaded resulting in a crash due to a call to the     deleted object. This crash could potentially be used by     an attacker to run arbitrary code on a victim's     computer. (MFSA 2009-35 / CVE-2009-2467)

  - oCERT security researcher Will Drewry reported a series     of heap and integer overflow vulnerabilities which     independently affected multiple font glyph rendering     libraries. On Linux platforms libpango was susceptible     to the vulnerabilities while on OS X CoreGraphics was     similarly vulnerable. An attacker could trigger these     overflows by constructing a very large text run for the     browser to display. Such an overflow can result in a     crash which the attacker could potentially use to run     arbitrary code on a victim's computer. The open source     nature of Linux meant that Mozilla was able to work with     the libpango maintainers to implement the correct fix in     version 1.24 of that system library which was     distributed with OS security updates. On Mac OS X     Firefox works around the CoreGraphics flaw by limiting     the length of text runs passed to the system. (MFSA     2009-36 / CVE-2009-1194)

  - Security researcher PenPal reported a crash involving a     SVG element on which a watch function and
    __defineSetter__ function have been set for a particular     property. The crash showed evidence of memory corruption     and could potentially be used by an attacker to run     arbitrary code on a victim's computer. (MFSA 2009-37 /     CVE-2009-2469)

  - Mozilla developer Blake Kaplan reported that setTimeout,     when called with certain object parameters which should     be protected with a XPCNativeWrapper, will fail to keep     the object wrapped when compiling the new function to be     executed. If chrome privileged code were to call     setTimeout using this as an argument, the this object     will lose its wrapper and could be unsafely accessed by     chrome code. An attacker could use such vulnerable code     to run arbitrary JavaScript with chrome privileges.
    (MFSA 2009-39 / CVE-2009-2471)

  - Mozilla security researcher moz_bug_r_a4 reported a     series of vulnerabilities in which objects that normally     receive a XPCCrossOriginWrapper are constructed without     the wrapper. This can lead to cases where JavaScript     from one website may unsafely access properties of such     an object which had been set by a different website. A     malicious website could use this vulnerability to launch     a XSS attack and run arbitrary JavaScript within the     context of another site. (MFSA 2009-40 / CVE-2009-2472)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2009-364:02 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    Fixed bugs:
    CVE-2009-2462     The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and     nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child     list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7)     nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and     (10) nsContentUtils::ComparePosition.
    CVE-2009-2463     Integer overflow in a base64 decoding function in Mozilla Firefox before 3.0.12 and Thunderbird allows     remote attackers to cause a denial of service (memory corruption and application crash) or possibly     execute arbitrary code via unspecified vectors.
    CVE-2009-2464     The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey     2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in     a XUL tree element.
    CVE-2009-2465     Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory     corruption and application crash) or execute arbitrary code via vectors involving double frame     construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and     the nsSubDocumentFrame::Reflow function.
    CVE-2009-2466     The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and     js_LockGCThingRT.
    CVE-2009-2467     Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script     dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object.
    CVE-2009-2469     Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch     function and an __defineSetter__ function, which allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly execute arbitrary code via a crafted document,     related to a certain pointer misinterpretation.
    CVE-2009-2471     The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which     allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related     to XPCNativeWrapper.
    CVE-2009-2472     Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object     construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site     scripting (XSS) attacks via a crafted document, related to a cross origin wrapper bypass.
    See also errata 2009-365-02

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 3.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2009-34 advisory.

  - The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and     js_LockGCThingRT. (CVE-2009-2466)

  - Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory     corruption and application crash) or execute arbitrary code via vectors involving double frame     construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and     the nsSubDocumentFrame::Reflow function. (CVE-2009-2465)

  - The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and     nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child     list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7)     nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and     (10) nsContentUtils::ComparePosition. (CVE-2009-2462)

  - Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in     nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey     before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
    (CVE-2009-2463)

  - The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey     2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in     a XUL tree element. (CVE-2009-2464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 3.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2009-34 advisory.

  - The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and     js_LockGCThingRT. (CVE-2009-2466)

  - Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory     corruption and application crash) or execute arbitrary code via vectors involving double frame     construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and     the nsSubDocumentFrame::Reflow function. (CVE-2009-2465)

  - The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors     related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and     nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child     list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7)     nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and     (10) nsContentUtils::ComparePosition. (CVE-2009-2462)

  - Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in     nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey     before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
    (CVE-2009-2463)

  - The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey     2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in     a XUL tree element. (CVE-2009-2464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1162 advisory.

    firefox:

    [3.0.12-1.0.1.el5_3]
    - Update firstrun and homepage URLs
    - Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html       and removed the corresponding  Red Hat ones
    - Added patch oracle-firefox-branding.patch

    [3.0.12-1]
    - Update to 3.0.12

    xulrunner:

    [1.9.0.12-1.0.1.el5_3]
    - Added xulrunner-oracle-default-prefs.js
    - Removed RedHat corresponding one

    [1.9.0.12-1]
    - Update to 1.9.0.12

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Update to new upstream Firefox version 3.0.12, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.12 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities have been discovered and corrected in Mozilla Firefox 3.0.x :

Several flaws were discovered in the Firefox browser and JavaScript engines, which could allow a malicious website to cause a denial of service or possibly execute arbitrary code with user privileges.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2468, CVE-2009-2471)

Attila Suszter discovered a flaw in the way Firefox processed Flash content, which could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2467)

It was discovered that Firefox did not properly handle some SVG content, which could lead to a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-2469)

A flaw was discovered in the JavaScript engine which could be used to perform cross-site scripting attacks. (CVE-2009-2472)

This update provides the latest Mozilla Firefox 3.0.x to correct these issues.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41357	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1134)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
283932	MiracleLinux 3 : firefox-3.0.12-1.1AXS3 (AXSA:2009-364:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
279147	Mozilla Firefox < 3.0.12	Nessus	MacOS X Local Security Checks	2025/12/18	2025/12/18	high
279229	Mozilla Firefox < 3.0.12	Nessus	Windows	2025/12/18	2025/12/18	high
67893	Oracle Linux 5 : firefox (ELSA-2009-1162)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
40340	RHEL 4 / 5 : firefox (RHSA-2009:1162)	Nessus	Red Hat Local Security Checks	2009/7/22	2021/1/14	critical
40358	Fedora 10 : Miro-2.0.5-2.fc10 / blam-1.8.5-12.fc10 / devhelp-0.22-10.fc10 / epiphany-2.24.3-8.fc10 / etc (2009-7961)	Nessus	Fedora Local Security Checks	2009/7/24	2021/1/11	critical
40438	Mandriva Linux Security Advisory : firefox (MDVSA-2009:182)	Nessus	Mandriva Local Security Checks	2009/7/31	2021/1/6	critical

検出

プラグインの検索

critical

medium

high

high

medium

critical

critical

critical