Package: mozilla-firefox Version: 1.0.7-1 Severity: critical Tags: security Justification: root security hole
To reproduce this bug: su root and then load firefox from the term. Then launch firefox from another unrelated and normal user terminal. The newly launched firefox reads root's profile and gets root's rights. I normally have no rights to save anything in /usr/share with my user account. I used firefox as root to go and grab an icon for xfce4 that I could save in /usr/share/pixmaps. After that the download tab was the only remaining part of root's firefox. I loaded firefox (normal user account) and it didn't not show my normal homepage. I tried to save google's logo in /usr/share/pixmaps. It worked!!! -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.14 Locale: LANG=C, LC_CTYPE=fr_FR (charmap=ANSI_X3.4-1968) (ignored: LC_ALL set to POSIX) Versions of packages mozilla-firefox depends on: ii debianutils 2.15.1 Miscellaneous utilities specific t ii fontconfig 2.3.2-1 generic font configuration library ii libatk1.0-0 1.10.3-1 The ATK accessibility toolkit ii libc6 2.3.5-6 GNU C Library: Shared libraries an ii libfontconfig1 2.3.2-1 generic font configuration library ii libfreetype6 2.1.7-2.4 FreeType 2 font engine, shared lib ii libgcc1 1:4.0.2-2 GCC support library ii libglib2.0-0 2.8.3-1 The GLib library of C routines ii libgtk2.0-0 2.6.10-1 The GTK+ graphical user interface ii libidl0 0.8.5-1 library for parsing CORBA IDL file ii libjpeg62 6b-10 The Independent JPEG Group's JPEG ii libkrb53 1.3.6-5 MIT Kerberos runtime libraries ii libpango1.0-0 1.8.2-3 Layout and rendering of internatio ii libpng12-0 1.2.8rel-5 PNG library - runtime ii libstdc++6 4.0.2-2 The GNU Standard C++ Library v3 ii libx11-6 6.8.2.dfsg.1-7 X Window System protocol client li ii libxext6 6.8.2.dfsg.1-7 X Window System miscellaneous exte ii libxft2 2.1.7-1 FreeType-based font drawing librar ii libxinerama1 6.8.2.dfsg.1-7 X Window System multi-head display ii libxp6 6.8.2.dfsg.1-7 X Window System printing extension ii libxt6 6.8.2.dfsg.1-7 X Toolkit Intrinsics ii psmisc 21.8-1 Utilities that use the proc filesy ii xlibs 6.8.2.dfsg.1-7 X Window System client libraries m ii zlib1g 1:1.2.3-4 compression library - runtime mozilla-firefox recommends no packages. -- no debconf information -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
