Debian Security Advisory

DSA-866-1 mozilla -- several vulnerabilities

Date Reported:
20 Oct 2005
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 327366, Bug 329778.
In Mitre's CVE dictionary: CVE-2005-2871, CVE-2005-2701, CVE-2005-2702, CVE-2005-2703, CVE-2005-2704, CVE-2005-2705, CVE-2005-2706, CVE-2005-2707, CVE-2005-2968.
More information:

Several security-related problems have been discovered in Mozilla and derived programs. The Common Vulnerabilities and Exposures project identifies the following problems:

  • CAN-2005-2871

    Tom Ferris discovered a bug in the IDN hostname handling of Mozilla that allows remote attackers to cause a denial of service and possibly execute arbitrary code via a hostname with dashes.

  • CAN-2005-2701

    A buffer overflow allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

  • CAN-2005-2702

    Mats Palmgren discovered a buffer overflow in the Unicode string parser that allows a specially crafted Unicode sequence to overflow a buffer and cause arbitrary code to be executed.

  • CAN-2005-2703

    Remote attackers could spoof HTTP headers of XML HTTP requests via XMLHttpRequest and possibly use the client to exploit vulnerabilities in servers or proxies.

  • CAN-2005-2704

    Remote attackers could spoof DOM objects via an XBL control that implements an internal XPCOM interface.

  • CAN-2005-2705

    Georgi Guninski discovered an integer overflow in the JavaScript engine that might allow remote attackers to execute arbitrary code.

  • CAN-2005-2706

    Remote attackers could execute Javascript code with chrome privileges via an about: page such as about:mozilla.

  • CAN-2005-2707

    Remote attackers could spawn windows without user interface components such as the address and status bar that could be used to conduct spoofing or phishing attacks.

  • CAN-2005-2968

    Peter Zelezny discovered that shell metacharacters are not properly escaped when they are passed to a shell script and allow the execution of arbitrary commands, e.g. when a malicious URL is automatically copied from another program into Mozilla as default browser.

For the stable distribution (sarge) these problems have been fixed in version 1.7.8-1sarge3.

For the unstable distribution (sid) these problems have been fixed in version 1.7.12-1.

We recommend that you upgrade your mozilla package.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Intel IA-32:
Intel IA-64:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.