Debian Security Advisory

DSA-1951-1 firefox-sage -- insufficient input sanitising

Date Reported:

15 Dec 2009

Affected Packages:

firefox-sage

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 559267.
In Mitre's CVE dictionary: CVE-2009-4102.

More information:

It was discovered that firefox-sage, a lightweight RSS and Atom feed reader for Firefox, does not sanitise the RSS feed information correctly, which makes it prone to a cross-site scripting and a cross-domain scripting attack.

For the oldstable distribution (etch), this problem has been fixed in version 1.3.6-4etch1.

For the stable distribution (lenny), this problem has been fixed in version 1.4.2-0.1+lenny1.

For the testing distribution (squeeze) and the unstable distribution (sid), this problem has been fixed in version 1.4.3-3.

We recommend that you upgrade your firefox-sage packages.

Fixed in:

Debian GNU/Linux 4.0 (etch)

Source:: http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.3.6-4etch1.dsc; http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.3.6.orig.tar.gz; http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.3.6-4etch1.diff.gz
Architecture-independent component:: http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.3.6-4etch1_all.deb

Debian GNU/Linux 5.0 (lenny)

Source:: http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.4.2-0.1+lenny1.diff.gz; http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.4.2.orig.tar.gz; http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.4.2-0.1+lenny1.dsc
Architecture-independent component:: http://security.debian.org/pool/updates/main/f/firefox-sage/firefox-sage_1.4.2-0.1+lenny1_all.deb

MD5 checksums of the listed files are available in the original advisory.