Mozilla Security Patch On Critical Vulnerability

Mozilla has released a new update to address a critical vulnerability present in their products.

Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Critical Unpatched Vulnerability In Adobe Shockwave Player

There has been found a critical vulnerability in Adobe Shockwave Player. The vulnerability (CVE-2010-3653) could cause a crash and potentially allow an attacker to take control of the vulnerable system. Details about the vulnerability have been disclosed publicly but Adobe states that they are not aware of any attacks exploiting the vulnerability at the moment.

Adobe's security advisory can be read here. Also, Secunia has an advisory available.

Google Patches Vulnerabilities In Chrome

Google has released a new version of their Chrome web browser. Version 7.0.517.43 fixes ten vulnerabilities (two affecting Linux only) of which one is categorized as critical, five as high, two as medium and two as low.

More information in Google Chrome Releases blog.

Mozilla Updates

Mozilla has released security bulletins related to found issues in some of their products. Five of the fixed vulnerabilities are categorized as critical, two as high, one as moderate and one as low.

Critical:
MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)
MFSA 2010-65 Buffer overflow and memory corruption using document.write
MFSA 2010-66 Use-after-free error in nsBarProp
MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter
MFSA 2010-71 Unsafe library loading vulnerabilities

High:
MFSA 2010-68 XSS in gopher parser when parsing hrefs
MFSA 2010-69 Cross-site information disclosure via modal calls

Moderate:
MFSA 2010-70 SSL wildcard certificate matching IP addresses

Low:
MFSA 2010-72 Insecure Diffie-Hellman key exchange


Fresh versions can be obtained via inbuilt updater or by downloading from the product site:
Firefox
Thunderbird
SeaMonkey

Security Updates For RealPlayer

RealNetworks has released updated version of their RealPlayer. New version contains fixes to seven vulnerabilities:

CVE-2010-2998
RealPlayer Malformed IVR Pointer Index Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.0.1 and prior.

CVE-2010-3747
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3750
RealPlayer RJMDSections Remote Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-2578
RealPlayer QCP parsing heap-based buffer overflow vulnerability.
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3751
RealPlayer ActiveX Control Multiple Protocol Handlers Remote Code Execution Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior.

CVE-2010-3748
RealPlayer RichFX Component Stack Overflow Vulnerability
Affected software: Windows RealPlayer SP 1.1.4 and prior; RealPlayer Enterprise 2.1.2 and prior.

CVE-2010-3749
RealPlayer Browser Extension RecordClip Parameter Injection Vulnerability
Affected software: Windows RealPlayer SP 1.1 and prior.


Users of affected versions are advised to update their RealPlayer to the latest one available. More information can be read from related security advisory.

Opera Updated

Opera Software has released an update for their Opera web browser. Version 10.63 contains fixes to five security vulnerabilities.

critical:
* Fixed an issue with reloads and redirects that could allow spoofing and cross-site scripting; advisory.

moderate:
* Fixed an issue that allowed cross-domain checks to be bypassed, allowing limited data theft using CSS, as reported by Isaac Dawson; advisory.
* Fixed an issue that allowed private video streams to be intercepted, as reported by Nirankush Panchbhai of Microsoft Vulnerability Research; advisory.
* Fixed an issue that caused JavaScript to run in the wrong security context after manual interaction; advisory.

low:
* Fixed an issue where manipulating the window could be used to spoof the page address; advisory.

Opera users are strongly recommended to update to 10.63 version. New version can be downloaded here.

Changelog of Windows version

Java Security Update Available

Oracle has released update for Java SE and Java for Business. The update fixes 29 security vulnerabilities of which 28 may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Affected versions are:
- Java SE:
• JDK and JRE 6 Update 21 and earlier for Windows, Solaris, and Linux
• JDK 5.0 Update 25 and earlier for Solaris
• SDK 1.4.2_27 and earlier for Solaris

- Java for Business:
• JDK and JRE 6 Update 21 and earlier for Windows, Solaris and Linux
• JDK and JRE 5.0 Update 25 and earlier for Windows, Solaris and Linux
• SDK and JRE 1.4.2_27 and earlier for Windows, Solaris and Linux

More information about the update can be read from Java critical patch update document.

Java users are recommended to update their versions to the latest one available.