Mozilla Firefox Security Advisory (MFSA2011-47) - Linux

This host is missing a security update for Mozilla Firefox.

Potential XSS against sites using Shift-JIS Yosuke Hasegawa reported that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. When encountering an invalid pair Mozilla would turn the entire two-byte sequence into a single unknown character rather than an unknown character followed by a valid single-byte character. On some sites attackers may have been able to end their input with the first byte of a two byte sequence, when that input was later put into a page context it might cause the following delimiter (such as a double-quote) to be consumed, breaking the format of the page. Depending on the page this could potentially be used to steal data or inject script into the page.

Firefox version(s) below 3.6.24 and below 8.

Checks if a vulnerable package version is present on the target host.

The vendor has released an update. Please see the reference(s) for more information.