Debian Security Advisory DSA 2313-1 (iceweasel)

The remote host is missing an update to iceweasel announced via advisory DSA 2313-1.

Several vulnerabilities have been found in Iceweasel, a web browser based on Firefox: CVE-2011-2372 Mariusz Mlynski discovered that websites could open a download dialog - which has open as the default action -, while a user presses the ENTER key. CVE-2011-2995 Benjamin Smedberg, Bob Clary and Jesse Ruderman discovered crashes in the rendering engine, which could lead to the execution of arbitrary code. CVE-2011-2998 Mark Kaplan discovered an integer underflow in the javascript engine, which could lead to the execution of arbitrary code. CVE-2011-2999 Boris Zbarsky discovered that incorrect handling of the window.location object could lead to bypasses of the same-origin policy. CVE-2011-3000 Ian Graham discovered that multiple Location headers might lead to CRLF injection. For the oldstable distribution (lenny), this problem has been fixed in version 1.9.0.19-14 of the xulrunner source package. This update also marks the compromised DigiNotar root certs as revoked rather then untrusted. For the stable distribution (squeeze), this problem has been fixed inversion 3.5.16-10. This update also marks the compromised DigiNotar root certs as revoked rather then untrusted. For the unstable distribution (sid), this problem has been fixed in version 7.0-1.

We recommend that you upgrade your iceweasel packages.