A security vulnerability in the Solaris Kerberos (see kerberos(5)) credential cache management may allow a local unprivileged user to access Kerberized mount points without authorization.

Sun acknowledges with thanks, Anton Lundin for bringing this issue to our attention.

Permalink |

A buffer overflow security vulnerability in the Solaris Simple Authentication and Security Layer (SASL) library (see libsasl(3LIB)) routine sasl_encode64(3SASL) may allow local or remote unprivileged users to crash applications which use this function.

Solaris LDAP client (ldap(1)), sendmail(1M) and Solaris iSCSI implementation are examples of applications which use the vulnerable library.

This vulnerability is also described in the following documents:

CERT Vulnerability Note VU#238019 at:

• http://www.kb.cert.org/vuls/id/238019

CVE CVE-2009-0688 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0688
  

Permalink |

Multiple security vulnerabilities with varying impacts affect Firefox (see firefox(1)) versions prior to 3.5b4 as shipped with OpenSolaris. These vulnerabilities may allow an unprivileged remote user to execute arbitrary code on the system where Firefox is being run, cause a Denial of Service (DoS) crash to the Firefox application, gain unauthorized access to sensitive data, execute arbitrary scripting code within a user's browsing session via Cross-Site Scripting (XSS) exploits to read or modify data from other web sites, obtain sensitive data from the user or information stored in cookies, or to perform Cross-Site Request Forgery (CSRF) attacks.

Additional vulnerabilities may allow a remote user to mislead a Firefox user into incorrectly trusting a site by providing a URL in the location bar which may appear to be another URL, or to bypass various security policies that are active in the browser to perform unauthorized activities such as reading local files or initiating network connections.

The following URL provides additional details about the vulnerabilities addressed in Firefox versions prior to 3.5b4.
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html

The Mozilla advisories that describe the vulnerabilities are as follows:

MFSA2009-14   MFSA2009-16   MFSA2009-17   MFSA2009-18   MFSA2009-19
MFSA2009-20   MFSA2009-21   MFSA2009-22   MFSA2009-25   MFSA2009-27
MFSA2009-28   MFSA2009-29   MFSA2009-30   MFSA2009-31   MFSA2009-32
MFSA2009-36

The CVE identifiers that pertain to this security issue are as follows:

Permalink |

Permalink |