Issued:: 2012-02-16
Updated:: 2012-02-16

RHSA-2012:0142 - Critical: firefox security update

Synopsis

Critical: firefox security update

Type/Severity

Security Advisory Critical

Topic

An updated firefox package that fixes one security issue is now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

Mozilla Firefox is an open source web browser.

A heap-based buffer overflow flaw was found in the way Firefox handled PNG (Portable Network Graphics) images. A web page containing a malicious PNG image could cause Firefox to crash or, possibly, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3026)

All Firefox users should upgrade to this updated package, which corrects this issue. After installing the update, Firefox must be restarted for the changes to take effect.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/kb/docs/DOC-11259

Affected Products

Product	Version	Arch
Red Hat Enterprise Linux for Power, big endian	4	ppc
Red Hat Enterprise Linux for IBM z Systems	4	s390x
Red Hat Enterprise Linux for IBM z Systems	4	s390
Red Hat Enterprise Linux Workstation	4	x86_64
Red Hat Enterprise Linux Workstation	4	ia64
Red Hat Enterprise Linux Workstation	4	i386
Red Hat Enterprise Linux Server	4	x86_64
Red Hat Enterprise Linux Server	4	ia64
Red Hat Enterprise Linux Server	4	i386
Red Hat Enterprise Linux Desktop	4	x86_64
Red Hat Enterprise Linux Desktop	4	i386

Updated Packages

firefox-3.6.26-3.el4.s390.rpm
firefox-3.6.26-3.el4.s390x.rpm
firefox-3.6.26-3.el4.ppc.rpm
firefox-3.6.26-3.el4.x86_64.rpm
firefox-3.6.26-3.el4.src.rpm
firefox-3.6.26-3.el4.ia64.rpm
firefox-3.6.26-3.el4.i386.rpm

Fixes

This content is not included.BZ - 790737

CVEs

CVE-2011-3026

References

https://access.redhat.com/security/updates/classification/#critical

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.