Specially crafted png files could cause crashes or even execution of arbitrary code in applications using libpng to process such files (CVE-2010-1205, CVE-2010-2249).

The remote host is affected by the vulnerability described in GLSA-201010-01 (Libpng: Multiple vulnerabilities)

    Multiple vulnerabilities were found in libpng:
      The png_decompress_chunk() function in pngrutil.c does not properly         handle certain type of compressed data (CVE-2010-0205)       A buffer overflow in pngread.c when using progressive applications         (CVE-2010-1205)       A memory leak in pngrutil.c when dealing with a certain type of         chunks (CVE-2010-2249)   Impact :

    An attacker could exploit these vulnerabilities to cause programs linked       against the library to crash or execute arbitrary code with the       permissions of the user running the vulnerable program, which could be       the root user.
  Workaround :

    There is no known workaround at this time.

Specially crafted png files could cause crashes or even execution of arbitrary code in applications using libpng to process such files.
(CVE-2010-1205 / CVE-2010-2249)

This update brings Mozilla Firefox to the 3.5.11 security release.

It fixes following security issues :

  - Several memory safety bugs in habe been identified in     the browser engine used in Firefox and other     Mozilla-based products. Some of these bugs show evidence     of memory corruption under certain circumstances, and it     is presumed that with enough effort at least some of     these could be exploited to run arbitrary code. (MFSA     2010-34 / CVE-2010-1211)

  - An error in the DOM attribute cloning routine has been     reported, where under certain circumstances an event     attribute node can be deleted while another object still     contains a reference to it. This reference could     subsequently be accessed, potentially causing the     execution of attacker controlled memory. (MFSA 2010-35 /     CVE-2010-1208)

  - An error in Mozilla's implementation of NodeIterator has     been reported which can be used to create a malicious     NodeFilter to detach nodes from the DOM tree while it is     being traversed. The use of a detached and subsequently     deleted node could result in the execution of attacker     controlled memory. (MFSA 2010-36 / CVE-2010-1209)

  - An error in the code used to store the names and values     of plugin parameter elements has been found. A malicious     page could embed plugin content containing a very large     number of parameter elements which would cause an     overflow in the integer value counting them. This     integer is later used for allocation of a memory buffer     to store the plugin parameters. Under such conditions, a     buffer that is too small would be created and attacker     controlled data could be written past the end of the     buffer, potentially resulting in code execution. (MFSA     2010-37 / CVE-2010-1214)

  - An array class used to store CSS values contains an     integer overflow vulnerability. A 16 bit integer used to     allocate the memory for the array could overflow,     resulting in too small a buffer being created. When the     array is later populated with CSS values, data could be     written past the end of the buffer, potentially     resulting in the execution of attacker controlled     memory. (MFSA 2010-39 / CVE-2010-2752)

  - An integer overflow vulnerability in the implementation     of the XUL <tree> element's selection attribute has been     found. When the size of a new selection is sufficiently     large, the integer used in calculating the length of the     selection can overflow, resulting in a bogus range being     marked as selected. When adjustSelection is then called     on the bogus range, the range is deleted, leaving     dangling references to the ranges. These could be used     by an attacker to call into deleted memory and run     arbitrary code on a victim's computer. (MFSA 2010-40 /     CVE-2010-2753)

  - A buffer overflow in Mozilla graphics code which     consumes image data processed by libpng has been     reported. A malformed PNG file could be created causing     libpng to report an incorrect size of the image. When     the dimensions of such images are underreported, the     Mozilla code displaying the graphic will allocate a     memory buffer to small to contain the image data and     will wind up writing data past the end of the buffer.
    This could result in the execution of     attacker-controlled memory. (MFSA 2010-41 /     CVE-2010-1205)

  - The Web Worker method importScripts can read and parse     resources from other domains even when the content is     not valid JavaScript. This is a violation of the     same-origin policy and could be used by an attacker to     steal information from other sites. (MFSA 2010-42 /     CVE-2010-1213)

  - Two methods for spoofing the content of the location bar     have been reported. The first method works by opening a     new window containing a resource that responds with an     HTTP 204 (no content) and then using the reference to     the new window to insert HTML content into the blank     document. The second location bar spoofing method does     not require that the resource opened in a new window     respond with 204, as long as the opener calls     window.stop() before the document is loaded. In either     case a user could be mislead about the correct location     of the document they are currently viewing. (MFSA     2010-45 / CVE-2010-1206)

  - The location bar can be spoofed to look like a secure     page even though the current document was served via     plaintext. The vulnerability is triggered by a server by     first redirecting a request for a plaintext resource to     another resource behind a valid SSL/TLS certificate. A     second request made to the original plaintext resource     which is responded to not with a redirect, but with     JavaScript calling history.back() and history.forward()     will result in the plaintext resource being displayed     with a valid SSL/TLS badge in the location bar. (MFSA     2010-45 / CVE-2010-2751)

  - Data can be read across domains by injecting bogus CSS     selectors into a target site and then retrieving the     data using JavaScript APIs. If an attacker can inject     opening and closing portions of a CSS selector into     points A and B of a target page, then the region between     the two injection points becomes readable to JavaScript     through, for example, the getComputedStyle() API. (MFSA     2010-46 / CVE-2010-0654)

  - Potentially sensitive URL parameters can be leaked     across domains upon script errors when the script     filename and line number is included in the error     message. (MFSA 2010-47 / CVE-2010-2754)

Updated libpng and libpng10 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A memory corruption flaw was found in the way applications, using the libpng library and its progressive reading method, decoded certain PNG images. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1205)

A denial of service flaw was found in the way applications using the libpng library decoded PNG images that have certain, highly compressed ancillary chunks. An attacker could create a specially crafted PNG image that could cause an application using libpng to consume excessive amounts of memory and CPU time, and possibly crash.
(CVE-2010-0205)

A memory leak flaw was found in the way applications using the libpng library decoded PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that could cause an application using libpng to exhaust all available memory and possibly crash or exit. (CVE-2010-2249)

A sensitive information disclosure flaw was found in the way applications using the libpng library processed 1-bit interlaced PNG images. An attacker could create a specially crafted PNG image that could cause an application using libpng to disclose uninitialized memory. (CVE-2009-2042)

Users of libpng and libpng10 should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libpng or libpng10 must be restarted for the update to take effect.

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A memory corruption flaw was found in the way Thunderbird decoded certain PNG images. An attacker could create a mail message containing a specially crafted PNG image that, when opened, could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-1205)

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-0174, CVE-2010-1200, CVE-2010-1211, CVE-2010-1214, CVE-2010-2753)

An integer overflow flaw was found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-1199)

Several use-after-free flaws were found in Thunderbird. Viewing an HTML mail message containing malicious content could result in Thunderbird executing arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-0175, CVE-2010-0176, CVE-2010-0177)

A flaw was found in the way Thunderbird plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-1198)

A flaw was found in the way Thunderbird handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. Loading remote HTTP content that allows arbitrary uploads and relies on the 'Content-Disposition:
attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A same-origin policy bypass flaw was found in Thunderbird. Remote HTML content could steal private data from different remote HTML content Thunderbird has loaded. (CVE-2010-2754)

All Thunderbird users should upgrade to this updated package, which resolves these issues. All running instances of Thunderbird must be restarted for the update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0547 advisory.

    firefox:

    [3.6.7-2.0.1.el5]
    - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html       and remove the corresponding Red Hat ones

    [3.6.7-2]
    - Update to 3.6.7 beta2

    [3.6.7-1]
    - Update to 3.6.7

    [3.6.4-9]
    - Fixed rhbz#531159 - default browser check

    xulrunner:

    [1.9.2.7-2.0.1.el5]
    - Added xulrunner-oracle-default-prefs.js and removed the corresponding       RedHat one.

    [1.9.2.7-2]
    - Update to build 2

    [1.9.2.7-1]
    - Update to 1.9.2.7

    [1.9.2.4-10]
    - Fix a file dependency issue

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
49192	openSUSE Security Update : libpng-devel (openSUSE-SU-2010:0594-1)	Nessus	SuSE Local Security Checks	2010/9/12	2021/1/14	high
49771	GLSA-201010-01 : Libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2010/10/6	2021/1/6	high
49882	SuSE 10 Security Update : libpng (ZYPP Patch Number 7144)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
50874	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 2780 / 2781)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	high
47741	CentOS 3 / 4 / 5 : libpng / libpng10 (CESA-2010:0534)	Nessus	CentOS Local Security Checks	2010/7/16	2021/1/4	high
47805	CentOS 5 : thunderbird (CESA-2010:0545)	Nessus	CentOS Local Security Checks	2010/7/23	2021/1/4	critical
68068	Oracle Linux 5 : firefox (ELSA-2010-0547)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical

検出

プラグインの検索

high

high

high

high

high

critical

critical