USN-717-3: Firefox vulnerabilities

Releases

• Ubuntu 6.06

Packages

• firefox -

Details

Kojima Hajime discovered that Firefox did not properly handle an escaped null
character. An attacker may be able to exploit this flaw to bypass script
sanitization. (CVE-2008-5510)

Wladimir Palant discovered that Firefox did not restrict access to cookies in
HTTP response headers. If a user were tricked into opening a malicious web
page, a remote attacker could view sensitive information. (CVE-2009-0357)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 6.06

• firefox - 1.5.dfsg+1.5.0.15~prepatch080614j-0ubuntu1

After a standard system upgrade you need to restart Firefox to effect the
necessary changes.

References

• CVE-2008-5510
• CVE-2009-0357

Related notices

• USN-690-1: abrowser, firefox-3.0, xulrunner-1.9
• USN-690-2: firefox
• USN-701-1: thunderbird
• USN-717-2: firefox
• USN-717-1: abrowser, firefox-3.0, xulrunner-1.9