Dla odmiany dostarczanie starszej wersji firefoksa wiąże się z tym:
----- Forwarded message from Gaël Delalleau <[EMAIL PROTECTED]> ----- [...] Overview -------- Firefox Preview Release, Thunderbird 0.8, and Mozilla 1.7.3 are available for download at www.mozilla.org since Sept 13 and 14. These releases fix 7 critical security issues, detailed on the "Known Vulnerabilities in Mozilla" page: http://www.mozilla.org/projects/security/known-vulnerabilities.html Three of these issues are rated at maximum level "Severity: Critical" and "Risk: High": * Non-ascii hostname heap overrun (reported by Mats Palmgren, Gaël Delalleau) A link with a non-ascii hostname can cause a heap buffer overrun that could potentially be exploited to run arbitrary code. * BMP integer overflow (reported by Gaël Delalleau) Extremely wide BMP images trigger an integer overflow, leading to heap overruns that are potentially exploitable to run arbitrary code. * Buffer overflow when displaying VCard (reported by Georgi Guninski) A stack buffer overrun in VCard display routines could be exploited to run arbitrary code supplied by the attacker. Technical information about the security bugs I reported -------------------------------------------------------- These are some links to my original source code audit reports. I audited parts of the Mozilla 1.7.2 C++ source code tree during my free time, in an attempt to promote and participate to the Mozilla Security Bug Bounty Program. * Arbitrary code execution while parsing a malformed .BMP image http://www.zencomsec.com/advisories/mozilla-1.7.2-BMP.txt * Out of bounds writes in the POP3 protocol handler allows for arbitrary code execution http://www.zencomsec.com/advisories/mozilla-1.7.2-POP3.txt * Non-ascii hostname heap overrun http://www.zencomsec.com/advisories/mozilla-1.7.2-UTF8link.txt [...] ----- End forwarded message ----- -- Jakub Bogusz http://cyber.cs.net.pl/~qboosh/ _______________________________________________ pld-devel-pl mailing list [EMAIL PROTECTED] http://lists.pld-linux.org/mailman/listinfo/pld-devel-pl
