[ MDVSA-2010:213 ] xulrunner

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:213
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : xulrunner
 Date    : October 28, 2010
 Affected: 2009.0, 2010.0, 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in xulrunner:
 
 Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.14
 and 3.6.x through 3.6.11, when JavaScript is enabled, allows remote
 attackers to execute arbitrary code via unknown vectors, as exploited
 in the wild in October 2010 by the Belmoo malware (CVE-2010-3765).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3765
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 7101153acd66111da72df4d8582b68a0  
2009.0/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2009.0.i586.rpm
 bb7724ae83aa51dcff03577e159fd463  
2009.0/i586/libxulrunner-devel-1.9.2.11-0.2mdv2009.0.i586.rpm
 d42fccf9cc40ba8d18b140f0a02fabd0  
2009.0/i586/xulrunner-1.9.2.11-0.2mdv2009.0.i586.rpm 
 466b75ef822c9bfd2cb3dc76eef6da53  
2009.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 5d5d4987963b7acaaab20c8e9c24787b  
2009.0/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2009.0.x86_64.rpm
 c570198c0797ad3b6059f6ed21b74016  
2009.0/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2009.0.x86_64.rpm
 53ce3c82744822bdf7d1b1d7378d420a  
2009.0/x86_64/xulrunner-1.9.2.11-0.2mdv2009.0.x86_64.rpm 
 466b75ef822c9bfd2cb3dc76eef6da53  
2009.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 525e94891b81e7773f98c21fdbd32567  
2010.0/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2010.0.i586.rpm
 dfa0583ea59506e1b6b5a751edf2bae2  
2010.0/i586/libxulrunner-devel-1.9.2.11-0.2mdv2010.0.i586.rpm
 1c76b4131e88bf4f8bed182bd785915c  
2010.0/i586/xulrunner-1.9.2.11-0.2mdv2010.0.i586.rpm 
 018afadac0f3edd3d42c3149d0523332  
2010.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 ce448c21759284c754923f77313b16c1  
2010.0/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2010.0.x86_64.rpm
 f4287d26a1f1fe5864b72b7691494d67  
2010.0/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2010.0.x86_64.rpm
 61c8d46cab1c9f0567af9d3e1ad05002  
2010.0/x86_64/xulrunner-1.9.2.11-0.2mdv2010.0.x86_64.rpm 
 018afadac0f3edd3d42c3149d0523332  
2010.0/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 a026e31f79811179200cb96e258b1832  
2010.1/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdv2010.1.i586.rpm
 403a9bc17217470b8780a93d582c0abc  
2010.1/i586/libxulrunner-devel-1.9.2.11-0.2mdv2010.1.i586.rpm
 c85c056f1ce7c5520b60ffccbee41f7d  
2010.1/i586/xulrunner-1.9.2.11-0.2mdv2010.1.i586.rpm 
 a6f746d7949da935ba5237d0f9f9f0aa  
2010.1/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.1.src.rpm

 Mandriva Linux 2010.1/X86_64:
 0200b2510106c17d479858ed50de1889  
2010.1/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdv2010.1.x86_64.rpm
 f9ae126654f6d8326b9d59bb2e6861a7  
2010.1/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdv2010.1.x86_64.rpm
 9057a6d7bb740ffac5b56ac41ac75b18  
2010.1/x86_64/xulrunner-1.9.2.11-0.2mdv2010.1.x86_64.rpm 
 a6f746d7949da935ba5237d0f9f9f0aa  
2010.1/SRPMS/xulrunner-1.9.2.11-0.2mdv2010.1.src.rpm

 Mandriva Enterprise Server 5:
 345cb1ed93d63d143dbb4d5e578f5ef5  
mes5/i586/libxulrunner1.9.2.11-1.9.2.11-0.2mdvmes5.1.i586.rpm
 dbe75eb7ea67d131f166a8a015597810  
mes5/i586/libxulrunner-devel-1.9.2.11-0.2mdvmes5.1.i586.rpm
 f9ffe89fdc1fda5e18300b64dd3292de  
mes5/i586/xulrunner-1.9.2.11-0.2mdvmes5.1.i586.rpm 
 1f35554e93457f361788226226736561  
mes5/SRPMS/xulrunner-1.9.2.11-0.2mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 200429fa806a1886648736ebfb8d4b5c  
mes5/x86_64/lib64xulrunner1.9.2.11-1.9.2.11-0.2mdvmes5.1.x86_64.rpm
 a8561066847eefe19c030dfc5be1398e  
mes5/x86_64/lib64xulrunner-devel-1.9.2.11-0.2mdvmes5.1.x86_64.rpm
 d038e33c018054a3d87fb05491542186  
mes5/x86_64/xulrunner-1.9.2.11-0.2mdvmes5.1.x86_64.rpm 
 1f35554e93457f361788226226736561  
mes5/SRPMS/xulrunner-1.9.2.11-0.2mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFMyUnfmqjQ0CJFipgRAhriAJ9kIYyrHAuVgWvXk8na3nROWEaeNQCfZN+1
6V005lDu4wEvbruVt4OC/e8=
=Gwvm
-----END PGP SIGNATURE-----