USN-1091-1: Firefox and Xulrunner vulnerabilities

Releases

• Ubuntu 10.10
• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 8.04

Packages

• firefox - safe and easy web browser from Mozilla
• firefox-3.0 - placeholder upgrade package for firefox-3.0 -> firefox
• firefox-3.5 - placeholder upgrade package for firefox-3.5 -> firefox
• xulrunner-1.9.2 - XUL + XPCOM application runner

Details

It was discovered that several invalid HTTPS certificates were issued and
revoked. An attacker could use these to perform a machine-in-the-middle attack.
These were placed on the certificate blocklist to prevent their misuse.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• firefox - 3.6.16+build1+nobinonly-0ubuntu0.9.10.1
• xulrunner-1.9.2 - 1.9.2.16+build1+nobinonly-0ubuntu0.9.10.1

Ubuntu 8.04

• firefox - 3.6.16+build1+nobinonly-0ubuntu0.8.04.1
• xulrunner-1.9.2 - 1.9.2.16+build1+nobinonly-0ubuntu0.8.04.1

Ubuntu 10.10

• firefox - 3.6.16+build1+nobinonly-0ubuntu0.10.10.1
• xulrunner-1.9.2 - 1.9.2.16+build1+nobinonly-0ubuntu0.10.10.1

Ubuntu 10.04

• firefox - 3.6.16+build1+nobinonly-0ubuntu0.10.04.1
• xulrunner-1.9.2 - 1.9.2.16+build1+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox and any
applications which use Xulrunner to make all the necessary changes.

References

• https://launchpad.net/bugs/741528