Synopsis:	Critical: firefox security update
Issue date:	2010-09-07
CVE Names:	CVE-2010-2760 CVE-2010-2762 CVE-2010-2764
                   CVE-2010-2765 CVE-2010-2766 CVE-2010-2767
                   CVE-2010-2768 CVE-2010-2769 CVE-2010-3166
                   CVE-2010-3167 CVE-2010-3168 CVE-2010-3169

Several flaws were found in the processing of malformed web content. A 
web page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user 
running Firefox. (CVE-2010-3169, CVE-2010-2762)

Several use-after-free and dangling pointer flaws were found in Firefox. 
A web page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user 
running Firefox. (CVE-2010-2760, CVE-2010-2766, CVE-2010-2767, 
CVE-2010-3167, CVE-2010-3168)

Multiple buffer overflow flaws were found in Firefox. A web page 
containing malicious content could cause Firefox to crash or, 
potentially, execute arbitrary code with the privileges of the user 
running Firefox. (CVE-2010-2765, CVE-2010-3166)

Multiple cross-site scripting (XSS) flaws were found in Firefox. A web 
page containing malicious content could cause Firefox to run JavaScript 
code with the permissions of a different website. (CVE-2010-2768, 
CVE-2010-2769)

A flaw was found in the Firefox XMLHttpRequest object. A remote site 
could use this flaw to gather information about servers on an internal 
private network. (CVE-2010-2764)

Note: After installing this update, Firefox will fail to connect (with
HTTPS) to a server using the SSL DHE (Diffie-Hellman Ephemeral) key
exchange if the server's ephemeral key is too small. Connecting to such
servers is a security risk as an ephemeral key that is too small makes 
the SSL connection vulnerable to attack.

If you encounter the condition where Firefox fails to connect to a
server that has an ephemeral key that is too small, you can try
connecting using a cipher suite with a different key exchange algorithm
by disabling all DHE cipher suites in Firefox:

1) Type about:config in the URL bar and press the Enter key.
2) In the Filter search bar, type ssl3.dhe
3) For all preferences now presented, double-click the true value to
change the value to false.
4) This change would affect connections to all HTTPS servers.

After installing the update, Firefox must be restarted for the changes 
to take effect.

SL 4.x

      SRPMS:
firefox-3.6.9-1.el4.src.rpm
nspr-4.8.6-1.el4.src.rpm
nss-3.12.7-1.el4.src.rpm
      i386:
firefox-3.6.9-1.el4.i386.rpm
nspr-4.8.6-1.el4.i386.rpm
nspr-devel-4.8.6-1.el4.i386.rpm
nss-3.12.7-1.el4.i386.rpm
nss-devel-3.12.7-1.el4.i386.rpm
nss-tools-3.12.7-1.el4.i386.rpm

      x86_64:
firefox-3.6.9-1.el4.i386.rpm
firefox-3.6.9-1.el4.x86_64.rpm
nspr-4.8.6-1.el4.i386.rpm
nspr-4.8.6-1.el4.x86_64.rpm
nspr-devel-4.8.6-1.el4.x86_64.rpm
nss-3.12.7-1.el4.i386.rpm
nss-3.12.7-1.el4.x86_64.rpm
nss-devel-3.12.7-1.el4.x86_64.rpm
nss-tools-3.12.7-1.el4.x86_64.rpm

SL 5.x

      SRPMS:
firefox-3.6.9-2.el5.src.rpm
nspr-4.8.6-1.el5.src.rpm
nss-3.12.7-2.el5.src.rpm
xulrunner-1.9.2.9-1.el5.src.rpm
      i386:
firefox-3.6.9-2.el5.i386.rpm
nspr-4.8.6-1.el5.i386.rpm
nspr-devel-4.8.6-1.el5.i386.rpm
nss-3.12.7-2.el5.i386.rpm
nss-devel-3.12.7-2.el5.i386.rpm
nss-pkcs11-devel-3.12.7-2.el5.i386.rpm
nss-tools-3.12.7-2.el5.i386.rpm
xulrunner-1.9.2.9-1.el5.i386.rpm
xulrunner-devel-1.9.2.9-1.el5.i386.rpm

      x86_64:
firefox-3.6.9-2.el5.i386.rpm
firefox-3.6.9-2.el5.x86_64.rpm
nspr-4.8.6-1.el5.i386.rpm
nspr-4.8.6-1.el5.x86_64.rpm
nspr-devel-4.8.6-1.el5.i386.rpm
nspr-devel-4.8.6-1.el5.x86_64.rpm
nss-3.12.7-2.el5.i386.rpm
nss-3.12.7-2.el5.x86_64.rpm
nss-devel-3.12.7-2.el5.i386.rpm
nss-devel-3.12.7-2.el5.x86_64.rpm
nss-pkcs11-devel-3.12.7-2.el5.i386.rpm
nss-pkcs11-devel-3.12.7-2.el5.x86_64.rpm
nss-tools-3.12.7-2.el5.x86_64.rpm
xulrunner-1.9.2.9-1.el5.i386.rpm
xulrunner-1.9.2.9-1.el5.x86_64.rpm
xulrunner-devel-1.9.2.9-1.el5.i386.rpm
xulrunner-devel-1.9.2.9-1.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson