Sender: |
|
Date: |
Fri, 8 Apr 2011 17:35:12 -0500 |
Reply-To: |
|
Content-Transfer-Encoding: |
7bit |
Subject: |
|
From: |
|
Content-Type: |
text/plain; charset=ISO-8859-1; format=flowed |
MIME-Version: |
1.0 |
Organization: |
FNAL/CD/REX/SAG |
Comments: |
|
Parts/Attachments: |
|
|
Synopsis: Moderate: spice-xpi security update
Issue date: 2011-04-07
CVE Names: CVE-2011-0012
CVE-2011-1179
An uninitialized pointer use flaw was found in the SPICE Firefox plug-in.
If a user were tricked into visiting a malicious web page with Firefox
while the SPICE plug-in was enabled, it could cause Firefox to crash or,
possibly, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-1179)
It was found that the SPICE Firefox plug-in used a predictable name for one
of its log files. A local attacker could use this flaw to conduct a
symbolic link attack, allowing them to overwrite arbitrary files accessible
to the user running Firefox. (CVE-2011-0012)
SL 5.x
SRPMS:
spice-xpi-2.2-2.3.el5_6.1.src.rpm
i386:
spice-xpi-2.2-2.3.el5_6.1.i386.rpm
x86_64:
spice-xpi-2.2-2.3.el5_6.1.x86_64.rpm
SL 6.x
SRPMS:
spice-xpi-2.4-1.el6_0.2.src.rpm
i386:
spice-xpi-2.4-1.el6_0.2.i686.rpm
x86_64:
spice-xpi-2.4-1.el6_0.2.x86_64.rpm
- Scientific Linux Development Team
|
|
|