Bug 530157 (CVE-2009-3374)

Summary: CVE-2009-3374 Firefox chrome privilege escalation in XPCVariant::VariantDataToJS()
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: mjc, security-response-team, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=critical,source=mozilla,reported=20091021,public=20091027,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-11-17 18:32:26 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Josh Bressers 2009-10-21 14:06:15 EDT
Mozilla security researcher moz_bug_r_a4 reported that the XPCOM utility
XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before
returning them to chrome callers. This could result in chrome privileged
code calling methods on an object which had previously been created or
modified by web content, potentially executing malicious JavaScript code
with chrome privileges.
Comment 1 errata-xmlrpc 2009-10-27 18:59:09 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1530 https://rhn.redhat.com/errata/RHSA-2009-1530.html
Comment 2 Fedora Update System 2009-10-28 22:57:50 EDT
blam-1.8.5-15.fc11, chmsee-1.0.1-12.fc11, epiphany-2.26.3-5.fc11, epiphany-extensions-2.26.1-7.fc11, evolution-rss-0.1.4-5.fc11, firefox-3.5.4-1.fc11, galeon-2.0.7-17.fc11, gnome-python2-extras-2.25.3-8.fc11, gnome-web-photo-0.7-7.fc11, google-gadgets-0.11.1-2.fc11, hulahop-0.4.9-9.fc11, kazehakase-0.5.8-2.fc11.1, Miro-2.5.2-5.fc11, monodevelop-2.0-6.fc11, mozvoikko-0.9.7-0.8.rc1.fc11, pcmanx-gtk2-0.3.8-9.fc11, ruby-gnome2-0.19.3-3.fc11, seahorse-plugins-2.26.2-7.fc11, xulrunner-1.9.1.4-1.fc11, yelp-2.26.0-8.fc11, eclipse-3.4.2-17.fc11, perl-Gtk2-MozEmbed-0.08-6.fc11.6 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2009-11-04 07:29:38 EST
blam-1.8.5-15.fc10, epiphany-2.24.3-11.fc10, epiphany-extensions-2.24.3-6.fc10, evolution-rss-0.1.4-5.fc10, firefox-3.0.15-1.fc10, galeon-2.0.7-15.fc10, gecko-sharp2-0.13-13.fc10, gnome-python2-extras-2.19.1-35.fc10, gnome-web-photo-0.3-23.fc10, google-gadgets-0.10.5-11.fc10, kazehakase-0.5.6-4.fc10.7, Miro-2.0.5-5.fc10, mozvoikko-0.9.5-15.fc10, mugshot-1.2.2-14.fc10, pcmanx-gtk2-0.3.8-14.fc10, perl-Gtk2-MozEmbed-0.08-6.fc10.6, ruby-gnome2-0.19.3-3.fc10, xulrunner-1.9.0.15-1.fc10, yelp-2.24.0-14.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.