September 12, 2005 16:00 GMT
[REVISED 13 Sep 2005]
[REVISED 23 Sep 2005]
[REVISED 03 Oct 2005]
[REVISED 04 Oct 2005]
[REVISED 06 Oct 2005]
[REVISED 13 Oct 2005]
[REVISED 20 Oct 2005]
[REVISED 09 Nov 2005]

PROBLEM:	Firefox and Mozilla do not properly handle certain international domain names. Firefox is a popular open source web browser. Mozilla is an open source web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.
PLATFORM:	Firefox versions prior to 1.0.7 Mozilla Suite versions prior to 1.7.12 Thunderbird versions prior to 1.0.7 Red Hat Desktop (v. 3 and v. 4) Red Hat Enterprise Linux AS, ES, WS (v. 2.1, v. 3, v. 4) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor Debian Linux/GNU version 3.1 (sarge) SGI Advanced Linux Environment 3, ProPack 3 HP-UX B.11.00, B.11.11, B.11.22, B.11.23 running Mozilla 1.7.11 and previous
DAMAGE:	If an attacker is successful in persuading a user to visit a malicious web site, they may be able to take control of the user’s machine.
SOLUTION:	Apply the security updates.
VULNERABILITY ASSESSMENT:	The risk is HIGH. A remote attacker could create a specially crafted HTML file, that could cause a denial of service or possibly execute arbitrary code.

LINKS:
CIAC BULLETIN:	http://www.ciac.org/ciac/bulletins/p-303.shtml
ORIGINAL BULLETIN:	https://rhn.redhat.com/errata/RHSA-2005-768.html
ADDITIONAL LINKS:	Red Hat Security Advisory RHSA-2005-769 https://rhn.redhat.com/errata/RHSA-2005-769.html Mozilla Information Document https://addons.mozilla.org/messages/307259.html Mozilla Security Advisory MFSA 2005-57 http://www.mozilla.org/security/announce/mfsa2005-57.html Debian Security Advisory DSA-837-1 http://www.debian.org/security/2005/dsa-837 SGI Security Update #47, Document #20050902-01-U ftp://patches.sgi.com/support/free/security/advisories/20050902-01-U.asc Visit Hewlett-Packard Subscription Service for: HPSBUX01231 / SSRT051041 Rev. 0 HPSBUX01133 / SSRT5940 Rev. 2 HPSBUX01231 / SSRT051041 Rev. 1 HPSBUX01231 / SSRT051041 Rev. 2 Red Hat Security Advisory RHSA-2005:791-8 https://rhn.redhat.com/errata/RHSA-2005-791.html
	Debian Security Advisory DSA-868-1 http://www.debian.org/security/2005/dsa-868
	Debian Security Advisory DSA-866-1 http://www.debian.org/security/2005/dsa-866
CVE/CAN:	http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2871

REVISION HISTORY:
09/13/2005 - added link to Mozilla's document "What Firefox and Mozilla users
             should know about the IDN buffer overflow security issue" that
             provides update options (patch or workaround) addressing this 
             vulnerability.
09/23/2005 - revised to include a link to Mozilla Security Advisory MFSA 2005-57.
10/03/2005 - added a link to Debian Security Advisory DSA-837 that provides 
             updated mozilla-firefox packages. Also SGI provides patches 
             available in SGI Security Update #47, Patch 10218 for SGI ProPack 3
             Service Pack 6.
10/04/2005 - revised to include a reference to HP's newly released HPSBUX01231 /
             SSRT051041 that provides patches for HP-UX B.11.00, B.11.11,
             B.11.22,  B.11.23 running Mozilla 1.7.11 and previous.  This patch
             addresses the vulnerability noted below and detailed in Mozilla's 
             MFSA 2005-57.
             Also, this bulletin is revised to include a reference to HPSBUX01133 /
             SSRT5940 Rev. 2, that provides a workaround for users running 
             Mozilla 1.7.8 and previous.
10/06/2005 - added link to Red Hat Security Advisory RHSA-2005:791 that provides 
             Red Hat 4 patches for Thunderbird, a standalone mail and newsgroup 
             client, that is also vulnerable to the issues described in this Bulletin.
10/13/2005 - revised to include a reference to HP's newly released HPSBUX01231 /
             SSRT051041 rev. 1 that provides patches for preliminary Mozilla 1.7.12 
             availability.
10/20/2005 - added a link to Debian Security Advisories DSA-868-1 and DSA-866-1 
             for Debian GNU/Linux 3.1 alias sarge.
11/09/2005 - revised to include a reference to HP's newly released HPSBUX01231 /
             SSRT051041 rev. 2 that states Mozilla for HP-UX version 1.7.12.01 is now 
             available.
			 
			 

[***** Start Red Hat Hat Advisory RHSA-2005:768-8 *****]

Critical: firefox security update

Details

Solution

Updated packages

Bugs fixed (see bugzilla for more information)

References

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/

[***** End Red Hat Hat Advisory RHSA-2005:768-8 *****]

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org