-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0139
 Two vulnerabilities fixed in Mozilla Firefox, Thunderbird, and SeaMonkey
                              12 October 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Firefox
                      Thunderbird
                      SeaMonkey
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
                      Mobile Device
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Access Confidential Data        -- Remote/Unauthenticated      
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-4193 CVE-2012-4192 CVE-2012-4191
                      CVE-2012-4190  
Member content until: Sunday, November 11 2012

OVERVIEW

        Multiple vulnerabilities have been fixed in Mozilla Firefox, 
        Thunderbird and in SeaMonkey. [1]


IMPACT

        The vendor has provided the following details about the vulnerabilities:
        
        CVE-2012-4190 CVE-2012-4191 "Mozilla developers identified and fixed 
        two top crashing bugs in the browser engine used in Firefox and other 
        Mozilla-based products. These bugs showed evidence of memory corruption 
        under certain circumstances, and we presume that with enough effort at 
        least some of these could be exploited to run arbitrary code.
        
        The first of these bugs, a FreeType issue, is a mobile only issue which 
        happens on custom kernels like Cyanogenmod, not on standard Android 
        installations. The second bug is a websockets crash affecting Firefox 
        16 but not Firefox ESR." MFSA 2012-88 [2]
        
        CVE-2012-4192 CVE-2012-4193 "Mozilla security researcher moz_bug_r_a4 
        reported a regression where security wrappers are unwrapped without 
        doing a security check in defaultValue(). This can allow for improper 
        access access to the Location object. In versions 15 and earlier of 
        affected products, there was also the potential for arbitrary code 
        execution." MFSA 2012-89 [3]


MITIGATION

        Users of the affected versions should upgrade to current versions:
        - Firefox: 16.0.1 or Firefox ESR 10.0.9
        - Thunderbird: 16.0.1 or Thunderbird ESR 10.0.9
        - SeaMonkey: 2.13.1


REFERENCES

        [1] Mozilla Foundation Security Advisories
            https://www.mozilla.org/security/announce/

        [2] Mozilla Foundation Security Advisory 2012-88
            https://www.mozilla.org/security/announce/2012/mfsa2012-88.html

        [3] Mozilla Foundation Security Advisory 2012-89
            https://www.mozilla.org/security/announce/2012/mfsa2012-89.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUHexMe4yVqjM2NGpAQLiuBAAsOWXfNb6/WQr3cx4hGFjSx69BKo/GDhW
8fuxs92JeZPaorkImSTJPo5bKHliYe85glAvUinw+s26zw5rlSnaUNn5EasKM0We
LROZplVliPoF+IylX6TIsUS0rRDjF4JeewfJ9F2tCBYYpKsyrgeEFQgzErWBpppx
aUytZzyKu/fC2pAo1u0QS+gxwYEInq75HYS61Imq/O3sc4R+WLivI5uN8l1LkYpE
jbzhHrjT3kSECggD9Q0HqSZNSL+kMuNGjCt3hdjNqtCgLBOymoSiSFzHVT2PWPfN
oTNpBeVG0bW6r1QGJHd0TEsnWo1jB/dBK3FoVNELRRFZ/PEYrGUAvEmjIeoGcXCD
JA1gX7bGayCLX0RXGy3qXiivHU7avyJQfV8FZccWemHd1Bv2MDw/YxsCwCtHkVWw
PFXBAjE29bWlhfodpnrKGRZTfp3COb9anFKkRpAiJerW3iV9MlbiQAWbkM88GS1I
v3p+baUvcnJddAhQpkYP57Sh8woqAM2mAKgpzlPDcENBOnA0esOBjIEoAW332yMK
2p51dJjrWiSz6Eyreryt+2f+1Rg7t/BCCXcbvES/HXsiB9wxLFiGxGTt5Rr4nYj1
sI6k44mpnzy1ja4AryN+F0ao1MjmVou4m7OLlJFJwFIyFlrJF+CaZjHlF2J6KR3E
/objlayaL2c=
=/2gN
-----END PGP SIGNATURE-----