-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0037
            New versions of Firefox, Thunderbird, and SeaMonkey
                               14 March 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Firefox
                      Thunderbird
                      SeaMonkey
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Cross-site Scripting            -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Provide Misleading Information  -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-0464 CVE-2012-0463 CVE-2012-0462
                      CVE-2012-0461 CVE-2012-0460 CVE-2012-0459
                      CVE-2012-0458 CVE-2012-0457 CVE-2012-0456
                      CVE-2012-0455 CVE-2012-0454 CVE-2012-0451
Member content until: Friday, April 13 2012

OVERVIEW

        Many vulnerabilities have been fixed in Mozilla Firefox and
        Thunderbird and in SeaMonkey.[1,2,3,4,5,6,7,8]


IMPACT

        The vendor has provided the following details about the vulnerabilities:
        
        "Security researchers Blair Strang and Scott Bell of Security Assessment
        found that when a parent window spawns and closes a child window that
        uses the file open dialog, a crash can be induced in shlwapi.dll on
        32-bit Windows 7 systems. This crash may be potentially exploitable." [1]
        
        "Firefox prevents the dropping of javascript: links onto a frame to
        prevent malicious sites from tricking users into performing a cross-site
        scripting (XSS) attacks on themselves. Security researcher Soroush
        Dalili reported a way to bypass this protection." [2]
        
        "Security researcher Atte Kettunen from OUSPG found two issues with
        Firefox's handling of SVG using the Address Sanitizer tool. The first
        issue, critically rated, is a use-after-free in SVG animation that
        could potentially lead to arbitrary code execution. The second issue
        is rated moderate and is an out of bounds read in SVG Filters. This
        could potentially incorporate data from the user's memory, making it
        accessible to the page content." [3]
        
        "Security Researcher Mike Brooks of Sitewatch reported that if multiple
        Content Security Policy (CSP) headers are present on a page, they have
        an additive effect page policy. Using carriage return line feed (CRLF)
        injection, a new CSP rule can be introduced which allows for cross-site
        scripting (XSS) on sites with a separate header injection vulnerability." [4]
        
        "Security researcher Mariusz Mlynski reported that an attacker able to
        convince a potential victim to set a new home page by dragging a link
        to the "home" button can set that user's home page to a javascript:
        URL. Once this is done the attacker's page can cause repeated crashes
        of the browser, eventually getting the script URL loaded in the
        privileged about:sessionrestore context." [5]
        
        "Mozilla community member Daniel Glazman of Disruptive Innovations
        reported a crash when accessing a keyframe's cssText after dynamic
        modification. This crash may be potentially exploitable." [6]
        
        "Mozilla developer Matt Brubeck reported that window.fullScreen is
        writeable by untrusted content now that the DOM fullscreen API is
        enabled. Because window.fullScreen does not include mozRequestFullscreen's
        security protections, it could be used for UI spoofing. This code
        change makes window.fullScreen read only by untrusted content, forcing
        the use of the DOM fullscreen API in normal usage." [7]
        
        "Mozilla developers identified and fixed several memory safety bugs in
        the browser engine used in Firefox and other Mozilla-based products.
        Some of these bugs showed evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at least some of
        these could be exploited to run arbitrary code.
        
        In general these flaws cannot be exploited through email in the
        Thunderbird and SeaMonkey products because scripting is disabled, but
        are potentially a risk in browser or browser-like contexts in those
        products." [8]


MITIGATION

        Users of the affected versions should upgrade to the latest versions:
         - Firefox: 11, 10.0.3, or 3.6.28
         - Thunderbird: 11, 10.0.3, or 3.1.20
         - SeaMonkey: 2.8


REFERENCES

        [1] Mozilla Foundation Security Advisory 2012-12
            http://www.mozilla.org/security/announce/2012/mfsa2012-12.html

        [2] Mozilla Foundation Security Advisory 2012-13
            http://www.mozilla.org/security/announce/2012/mfsa2012-13.html

        [3] Mozilla Foundation Security Advisory 2012-14
            http://www.mozilla.org/security/announce/2012/mfsa2012-14.html

        [4] Mozilla Foundation Security Advisory 2012-15
            http://www.mozilla.org/security/announce/2012/mfsa2012-15.html

        [5] Mozilla Foundation Security Advisory 2012-16
            http://www.mozilla.org/security/announce/2012/mfsa2012-16.html

        [6] Mozilla Foundation Security Advisory 2012-17
            http://www.mozilla.org/security/announce/2012/mfsa2012-17.html

        [7] Mozilla Foundation Security Advisory 2012-18
            http://www.mozilla.org/security/announce/2012/mfsa2012-18.html

        [8] Mozilla Foundation Security Advisory 2012-19
            http://www.mozilla.org/security/announce/2012/mfsa2012-19.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT2ACmu4yVqjM2NGpAQLb4Q/+OuLrIsMFOvBt358LEB6NJVkRdrgCmfnp
FIb2VX2DWv9NygLWq+kCXIsXKSzVrq9w8IfebJ6188SMMKbD7e/0rGbRyzebtUcK
vmBBV7GLwfbo2ndbL1U55tN+2zr5cHCjZpxeZkW8Vl5n+CN/9lBcqTMbEvxMaxSp
FpMXJff3LrrRuhXmYhOE01r1iJOciSTuCSGYJZ8d2pldSYx7/Ig/ABxuVcEhFGy+
Ls97aDpI7Tv188fbfbpjYjQDKuS2Knw92bIIojcAQLKMDVjZq09JHkQ4r8wCTF3j
AU4WjlxWv6rGT5y7m3NI7JIEf6fi27hsmcgLGmm5RUqQoWoy/b5Pl158fkBMYmhG
WQOZYFNcwlegaSoHa2Fg53frtpYQhot0fFryuowCJ3crBTaGaVRO4n5UevpvGZab
IyTHxCBOeWRdH+PRmr62wWlsmX+Y0gn+TsOHhZanu12S1GVF5Y/2YfvYc6VlVDij
/qOd3pAUA0tpj6vCQAN7ey6owwhRcIuNcajP9nRV0Ds/bvg3yG/Ka/OPG7spjmj8
VsDX3jZ59ClJj3t5qnaN9yI4BC00i8GTW3l9Ej8prBQmB2yd85nv49aQUAySZoXx
looQFITktPqF5TW9EipxHOgCY/3u3eLwdwcnqL8nSt6mHAgdq3CXHiuMzKocS5pV
p4ZRe2YVw4M=
=zxDJ
-----END PGP SIGNATURE-----