Firefox 13.0.1 Update
UPDATE: Thanks to Toni, we got specific details about Firefox 13.0.1 on Ubuntu, including fixes for several security issues: http://www.ubuntu.com/usn/usn-1463-3/. When I published the original ISC post, the Ubuntu Firefox 13.0.1 package was not available yet, although the official one for Windows obviously was (even a few days before). Interesting...
A new version of Firefox, 13.0.1, was released today. Although the official release notes say that various security issues have been fixed in this version, by looking at the official security advisories for Firefox I couldn't find any new advisories specifically for 13.0.1, as all them (from MFSA 2012-34 to 2012-40) were fixed in version 13.0 (although unfortunately, the official release notes for Firefox 13.0 do not include the security fixes reference). We already announced these a couple of weeks ago.
In any case, be sure you get the update (via the automatic method or manually) and that it is properly applied (it includes a few functional fixes).
If you have more specific security details regarding 13.0.1 (if any), please share them through our contact page.
----
Raul Siles
Founder and Senior Security Analyst with Taddong
www.taddong.com
CVE-2012-0217 (from MS12-042) applies to other environments too
A week ago we covered MS12-042 ("Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)") on the monthly Microsoft patch update cycle. This Microsoft advisory includes two vulnerabilities: CVE-2012-0217 and CVE-2012-1515 (VMware related).
Unfortunately, the official CVE-2012-0217 only makes references to Microsoft Windows OS, but other environments are also affected by this local privilege escalation vulnerability associated to 64-bit Intel processors. From the US-CERT note: "Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape." In particular, it affects FreeBSD or Xen (RedHat, SUSE, etc).
More details at "Vulnerability Note VU#649219: SYSRET 64-bit operating system privilege escalation vulnerability on Intel CPU hardware".
----
Raul Siles
Founder and Senior Security Analyst with Taddong
www.taddong.com
Comments