CERTA-2006-AVI-156

Vulnerability from certfr_avis - Published: - Updated:

None

Description

Plusieurs vulnérabilités sont présentes dans Mozilla Firefox. Elles permettent à un utilisateur distant mal intentionné :

  • d'exécuter du code arbitraire ;
  • de provoquer un déni de service ;
  • de contourner la politique de sécurité du système ;
  • de porter atteinte à la confidentialité des données ;
  • de réaliser des attaques de type Cross-Site Scripting.

Solution

La version 1.5.0.2 de Mozilla Firefox corrige le problème :

http://www.mozilla.com/firefox/

Mozilla Firefox versions 1.5.0.1 et antérieures.

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eMozilla Firefox versions 1.5.0.1 et  ant\u00e9rieures.\u003c/p\u003e",
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans Mozilla Firefox. Elles\npermettent \u00e0 un utilisateur distant mal intentionn\u00e9 :\n\n-   d\u0027ex\u00e9cuter du code arbitraire ;\n-   de provoquer un d\u00e9ni de service ;\n-   de contourner la politique de s\u00e9curit\u00e9 du syst\u00e8me ;\n-   de porter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es ;\n-   de r\u00e9aliser des attaques de type Cross-Site Scripting.\n\n## Solution\n\nLa version 1.5.0.2 de Mozilla Firefox corrige le probl\u00e8me :\n\n    http://www.mozilla.com/firefox/\n",
  "cves": [
    {
      "name": "CVE-2006-1739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1739"
    },
    {
      "name": "CVE-2006-1530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1530"
    },
    {
      "name": "CVE-2006-1729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1729"
    },
    {
      "name": "CVE-2006-1734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1734"
    },
    {
      "name": "CVE-2006-1730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1730"
    },
    {
      "name": "CVE-2006-1737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1737"
    },
    {
      "name": "CVE-2006-1728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1728"
    },
    {
      "name": "CVE-2006-1732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1732"
    },
    {
      "name": "CVE-2006-1531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1531"
    },
    {
      "name": "CVE-2006-1736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1736"
    },
    {
      "name": "CVE-2006-1740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1740"
    },
    {
      "name": "CVE-2006-1738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1738"
    },
    {
      "name": "CVE-2006-1742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1742"
    },
    {
      "name": "CVE-2006-1726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1726"
    },
    {
      "name": "CVE-2006-1725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1725"
    },
    {
      "name": "CVE-2006-1733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1733"
    },
    {
      "name": "CVE-2006-1727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1727"
    },
    {
      "name": "CVE-2006-1723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1723"
    },
    {
      "name": "CVE-2006-1735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1735"
    },
    {
      "name": "CVE-2006-0749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0749"
    },
    {
      "name": "CVE-2006-1529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1529"
    },
    {
      "name": "CVE-2006-1741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1741"
    },
    {
      "name": "CVE-2006-1731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1731"
    },
    {
      "name": "CVE-2006-1724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1724"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0328 du 14 avril 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0328.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-271 du 19 avril 2006 :",
      "url": "http://www.ubuntu.com/usn/usn-271-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:075 du 24 avril    2006 :",
      "url": "http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:075"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD du 16 avril 2006 :",
      "url": "http://www.vuxml.org/freebsd/pkg-linux-mozilla.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla du 13 avril 2006 :",
      "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox1.5.0.2"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200604-12 du 23 avril 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0330 du 21 avril 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0330.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:078 du 25 avril    2006 :",
      "url": "http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:078"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:076 du 25 avril    2006 :",
      "url": "http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:076"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0329 du 18 avril 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0329.html"
    }
  ],
  "reference": "CERTA-2006-AVI-156",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-04-18T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 RedHat, FreeBSD et Ubuntu.",
      "revision_date": "2006-04-20T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Gentoo.",
      "revision_date": "2006-04-24T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Mandriva et RadHat.",
      "revision_date": "2006-04-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Attaque de type cross-site scripting"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": null,
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Firefox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Firefox du 13 avril 2006",
      "url": null
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.