Vulnerabilities > CVE-2006-0293 - Unspecified vulnerability in Mozilla Firefox 1.5
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 |
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1044.NASL description Several security related problems have been discovered in Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-4134 Web pages with extremely long titles cause subsequent launches of the browser to appear to last seen 2020-06-01 modified 2020-06-02 plugin id 22586 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22586 title Debian DSA-1044-1 : mozilla-firefox - several vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-1044. The text # itself is copyright (C) Software in the Public Interest, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(22586); script_version("1.28"); script_cvs_date("Date: 2019/08/02 13:32:19"); script_cve_id("CVE-2005-4134", "CVE-2006-0292", "CVE-2006-0293", "CVE-2006-0296", "CVE-2006-0748", "CVE-2006-0749", "CVE-2006-1727", "CVE-2006-1728", "CVE-2006-1729", "CVE-2006-1730", "CVE-2006-1731", "CVE-2006-1732", "CVE-2006-1733", "CVE-2006-1734", "CVE-2006-1735", "CVE-2006-1736", "CVE-2006-1737", "CVE-2006-1738", "CVE-2006-1739", "CVE-2006-1740", "CVE-2006-1741", "CVE-2006-1742", "CVE-2006-1790"); script_bugtraq_id(15773, 16476, 17516); script_xref(name:"CERT", value:"179014"); script_xref(name:"CERT", value:"252324"); script_xref(name:"CERT", value:"329500"); script_xref(name:"CERT", value:"488774"); script_xref(name:"CERT", value:"492382"); script_xref(name:"CERT", value:"592425"); script_xref(name:"CERT", value:"736934"); script_xref(name:"CERT", value:"813230"); script_xref(name:"CERT", value:"842094"); script_xref(name:"CERT", value:"932734"); script_xref(name:"CERT", value:"935556"); script_xref(name:"DSA", value:"1044"); script_name(english:"Debian DSA-1044-1 : mozilla-firefox - several vulnerabilities"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Several security related problems have been discovered in Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-4134 Web pages with extremely long titles cause subsequent launches of the browser to appear to 'hang' for up to a few minutes, or even crash if the computer has insufficient memory. [MFSA-2006-03] - CVE-2006-0292 The JavaScript interpreter does not properly dereference objects, which allows remote attackers to cause a denial of service or execute arbitrary code. [MFSA-2006-01] - CVE-2006-0293 The function allocation code allows attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-01] - CVE-2006-0296 XULDocument.persist() did not validate the attribute name, allowing an attacker to inject arbitrary XML and JavaScript code into localstore.rdf that would be read and acted upon during startup. [MFSA-2006-05] - CVE-2006-0748 An anonymous researcher for TippingPoint and the Zero Day Initiative reported that an invalid and nonsensical ordering of table-related tags can be exploited to execute arbitrary code. [MFSA-2006-27] - CVE-2006-0749 A particular sequence of HTML tags can cause memory corruption that can be exploited to execute arbitrary code. [MFSA-2006-18] - CVE-2006-1727 Georgi Guninski reported two variants of using scripts in an XBL control to gain chrome privileges when the page is viewed under 'Print Preview'. [MFSA-2006-25] - CVE-2006-1728 'shutdown' discovered that the crypto.generateCRMFRequest method can be used to run arbitrary code with the privilege of the user running the browser, which could enable an attacker to install malware. [MFSA-2006-24] - CVE-2006-1729 Claus Jorgensen reported that a text input box can be pre-filled with a filename and then turned into a file-upload control, allowing a malicious website to steal any local file whose name they can guess. [MFSA-2006-23] - CVE-2006-1730 An anonymous researcher for TippingPoint and the Zero Day Initiative discovered an integer overflow triggered by the CSS letter-spacing property, which could be exploited to execute arbitrary code. [MFSA-2006-22] - CVE-2006-1731 'moz_bug_r_a4' discovered that some internal functions return prototypes instead of objects, which allows remote attackers to conduct cross-site scripting attacks. [MFSA-2006-19] - CVE-2006-1732 'shutdown' discovered that it is possible to bypass same-origin protections, allowing a malicious site to inject script into content from another site, which could allow the malicious page to steal information such as cookies or passwords from the other site, or perform transactions on the user's behalf if the user were already logged in. [MFSA-2006-17] - CVE-2006-1733 'moz_bug_r_a4' discovered that the compilation scope of privileged built-in XBL bindings is not fully protected from web content and can still be executed which could be used to execute arbitrary JavaScript, which could allow an attacker to install malware such as viruses and password sniffers. [MFSA-2006-16] - CVE-2006-1734 'shutdown' discovered that it is possible to access an internal function object which could then be used to run arbitrary JavaScript code with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-15] - CVE-2006-1735 It is possible to create JavaScript functions that would get compiled with the wrong privileges, allowing an attacker to run code of their choice with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-14] - CVE-2006-1736 It is possible to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable. [MFSA-2006-13] - CVE-2006-1737 An integer overflow allows remote attackers to cause a denial of service and possibly execute arbitrary bytecode via JavaScript with a large regular expression. [MFSA-2006-11] - CVE-2006-1738 An unspecified vulnerability allows remote attackers to cause a denial of service. [MFSA-2006-11] - CVE-2006-1739 Certain Cascading Style Sheets (CSS) can cause an out-of-bounds array write and buffer overflow that could lead to a denial of service and the possible execution of arbitrary code. [MFSA-2006-11] - CVE-2006-1740 It is possible for remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site. [MFSA-2006-12] - CVE-2006-1741 'shutdown' discovered that it is possible to inject arbitrary JavaScript code into a page on another site using a modal alert to suspend an event handler while a new page is being loaded. This could be used to steal confidential information. [MFSA-2006-09] - CVE-2006-1742 Igor Bukanov discovered that the JavaScript engine does not properly handle temporary variables, which might allow remote attackers to trigger operations on freed memory and cause memory corruption. [MFSA-2006-10] - CVE-2006-1790 A regression fix that could lead to memory corruption allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-11]" ); script_set_attribute( attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=363935" ); script_set_attribute( attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=362656" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2005-4134" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-0292" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-0293" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-0296" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-0748" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-0749" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1727" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1728" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1729" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1730" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1731" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1732" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1733" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1734" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1735" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1736" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1737" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1738" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1739" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1740" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1741" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1742" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2006-1790" ); script_set_attribute( attribute:"see_also", value:"http://www.debian.org/security/2006/dsa-1044" ); script_set_attribute( attribute:"solution", value: "Upgrade the Mozilla Firefox packages. For the stable distribution (sarge) these problems have been fixed in version 1.0.4-2sarge6." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Firefox location.QueryInterface() Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(20, 79, 119, 189, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mozilla-firefox"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1"); script_set_attribute(attribute:"patch_publication_date", value:"2006/04/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/10/14"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/12/07"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"3.1", prefix:"mozilla-firefox", reference:"1.0.4-2sarge6")) flag++; if (deb_check(release:"3.1", prefix:"mozilla-firefox-dom-inspector", reference:"1.0.4-2sarge6")) flag++; if (deb_check(release:"3.1", prefix:"mozilla-firefox-gnome-support", reference:"1.0.4-2sarge6")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-271-1.NASL description Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory. (CVE-2005-4134) Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file last seen 2020-06-01 modified 2020-06-02 plugin id 21270 published 2006-04-21 reporter Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21270 title Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-271-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(21270); script_version("1.19"); script_cvs_date("Date: 2019/08/02 13:33:00"); script_cve_id("CVE-2005-4134", "CVE-2006-0292", "CVE-2006-0293", "CVE-2006-0296", "CVE-2006-0749", "CVE-2006-1727", "CVE-2006-1728", "CVE-2006-1729", "CVE-2006-1730", "CVE-2006-1731", "CVE-2006-1732", "CVE-2006-1733", "CVE-2006-1734", "CVE-2006-1735", "CVE-2006-1736", "CVE-2006-1737", "CVE-2006-1738", "CVE-2006-1739", "CVE-2006-1740", "CVE-2006-1741", "CVE-2006-1742", "CVE-2006-1790"); script_xref(name:"USN", value:"271-1"); script_name(english:"Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory. (CVE-2005-4134) Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file 'localstore.rdf', which is read and evaluated at startup. This could include JavaScript commands that would be run with the user's privileges. (CVE-2006-0296) Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious website could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0749) Georgi Guninski discovered that embedded XBL scripts of websites could escalate their (normally reduced) privileges to get full privileges of the user if that page is viewed with 'Print Preview'. (CVE-2006-1727) The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges. (CVE-2006-1728) Claus Jorgensen and Jesse Ruderman discovered that a text input box could be pre-filled with a filename and then turned into a file-upload control with the contents intact. A malicious website could exploit this to read any local file the user has read privileges for. (CVE-2006-1729) An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious website could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730) The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious website could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages. (CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack. The privileged built-in XBL bindings were not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. A malicious website could exploit this to run arbitrary JavaScript code with the user's privileges. (CVE-2006-1733) It was possible to use the Object.watch() method to access an internal function object (the 'clone parent'). A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1734) By calling the XBL.method.eval() method in a special way it was possible to create JavaScript functions that would get compiled with the wrong privileges. A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1735) Michael Krax discovered that by layering a transparent image link to an executable on top of a visible (and presumably desirable) image a malicious site could fool the user to right-click and choose 'Save image as...' from the context menu, which would download the executable instead of the image. (CVE-2006-1736) Several crashes have been fixed which could be triggered by websites and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) If the user has turned on the 'Entering secure site' modal warning dialog, it was possible to spoof the browser's secure-site indicators (the lock icon and the gold URL field background) by first loading the target secure site in a pop-up window, then changing its location to a different site, which retained the displayed secure-browsing indicators from the original site. (CVE-2006-1740). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_cwe_id(20, 79, 119, 189, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-dom-inspector"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox-gnome-support"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox-dom-inspector"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:mozilla-firefox-gnome-support"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:4.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.10"); script_set_attribute(attribute:"patch_publication_date", value:"2006/04/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/04/21"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/12/07"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! ereg(pattern:"^(4\.10|5\.04|5\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 4.10 / 5.04 / 5.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"4.10", pkgname:"mozilla-firefox", pkgver:"1.0.8-0ubuntu4.10")) flag++; if (ubuntu_check(osver:"4.10", pkgname:"mozilla-firefox-dom-inspector", pkgver:"1.0.8-0ubuntu4.10")) flag++; if (ubuntu_check(osver:"5.04", pkgname:"mozilla-firefox", pkgver:"1.0.8-0ubuntu5.04")) flag++; if (ubuntu_check(osver:"5.04", pkgname:"mozilla-firefox-dev", pkgver:"1.0.8-0ubuntu5.04")) flag++; if (ubuntu_check(osver:"5.04", pkgname:"mozilla-firefox-dom-inspector", pkgver:"1.0.8-0ubuntu5.04")) flag++; if (ubuntu_check(osver:"5.04", pkgname:"mozilla-firefox-gnome-support", pkgver:"1.0.8-0ubuntu5.04")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"firefox", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"firefox-dev", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"firefox-dom-inspector", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"firefox-gnome-support", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"mozilla-firefox", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (ubuntu_check(osver:"5.10", pkgname:"mozilla-firefox-dev", pkgver:"1.0.8-0ubuntu5.10")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / firefox-dev / firefox-dom-inspector / etc"); }
NASL family Solaris Local Security Checks NASL id SOLARIS9_120671.NASL description Mozilla 1.7 for Solaris 8 and 9. Date this patch was last updated by Sun : Aug/29/08 last seen 2020-06-01 modified 2020-06-02 plugin id 24403 published 2007-02-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24403 title Solaris 9 (sparc) : 120671-08 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(24403); script_version("1.26"); script_cvs_date("Date: 2019/10/25 13:36:25"); script_cve_id("CVE-2005-4134", "CVE-2006-0292", "CVE-2006-0293", "CVE-2006-0294", "CVE-2006-0295", "CVE-2006-0296", "CVE-2006-0297", "CVE-2006-0298", "CVE-2006-0299", "CVE-2006-0748", "CVE-2006-0749", "CVE-2006-0884", "CVE-2006-1529", "CVE-2006-1530", "CVE-2006-1531", "CVE-2006-1723", "CVE-2006-1724", "CVE-2006-1725", "CVE-2006-1726", "CVE-2006-1727", "CVE-2006-1728", "CVE-2006-1729", "CVE-2006-1730", "CVE-2006-1731", "CVE-2006-1732", "CVE-2006-1733", "CVE-2006-1734", "CVE-2006-1735", "CVE-2006-1736", "CVE-2006-1737", "CVE-2006-1738", "CVE-2006-1739", "CVE-2006-1740", "CVE-2006-1741", "CVE-2006-1742", "CVE-2006-1790", "CVE-2006-2779", "CVE-2006-2780", "CVE-2006-5463", "CVE-2006-6498", "CVE-2006-6499"); script_name(english:"Solaris 9 (sparc) : 120671-08"); script_summary(english:"Check for patch 120671-08"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 120671-08" ); script_set_attribute( attribute:"description", value: "Mozilla 1.7 for Solaris 8 and 9. Date this patch was last updated by Sun : Aug/29/08" ); script_set_attribute( attribute:"see_also", value:"https://getupdates.oracle.com/readme/120671-08" ); script_set_attribute( attribute:"solution", value:"You should install this patch for your system to be up-to-date." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Firefox location.QueryInterface() Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(20, 79, 94, 119, 189, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2008/08/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/02/18"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("solaris.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"120671-08", obsoleted_by:"", package:"SUNWmoznav", version:"1.7,REV=10.2005.12.08") < 0) flag++; if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"120671-08", obsoleted_by:"", package:"SUNWmozmail", version:"1.7,REV=10.2005.12.08") < 0) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:solaris_get_report()); else security_hole(0); exit(0); } audit(AUDIT_HOST_NOT, "affected");
NASL family Windows NASL id SEAMONKEY_10.NASL description The remote Windows host is using SeaMonkey, an alternative web browser and application suite. The installed version of SeaMonkey contains various security issues, some of which can be exploited to execute arbitrary code on the affected host subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 20863 published 2006-02-05 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20863 title SeaMonkey < 1.0 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(20863); script_version("1.18"); script_cve_id("CVE-2005-4134", "CVE-2006-0292", "CVE-2006-0293", "CVE-2006-0294", "CVE-2006-0295", "CVE-2006-0296", "CVE-2006-0297", "CVE-2006-0298", "CVE-2006-0299", "CVE-2006-0749", "CVE-2006-1731", "CVE-2006-1732", "CVE-2006-1733", "CVE-2006-1734", "CVE-2006-1735", "CVE-2006-1736", "CVE-2006-1739", "CVE-2006-1740", "CVE-2006-1741", "CVE-2006-1742"); script_bugtraq_id(16476); script_name(english:"SeaMonkey < 1.0 Multiple Vulnerabilities"); script_summary(english:"Checks for SeaMonkey < 1.0"); script_set_attribute(attribute:"synopsis", value: "A web browser on the remote host is prone to multiple flaws." ); script_set_attribute(attribute:"description", value: "The remote Windows host is using SeaMonkey, an alternative web browser and application suite. The installed version of SeaMonkey contains various security issues, some of which can be exploited to execute arbitrary code on the affected host subject to the user's privileges." ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-01/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-02/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-03/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-04/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-06/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-07/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-08/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-09/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-10/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-11/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-12/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-13/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-14/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-15/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-16/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-17/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-18/" ); script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2006-19/" ); script_set_attribute(attribute:"solution", value: "Upgrade to SeaMonkey 1.0 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Firefox location.QueryInterface() Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(20, 79, 119, 264, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2006/02/05"); script_set_attribute(attribute:"patch_publication_date", value: "2006/02/02"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/07"); script_cvs_date("Date: 2018/07/27 18:38:15"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:seamonkey"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc."); script_dependencies("mozilla_org_installed.nasl"); script_require_keys("SeaMonkey/Version"); exit(0); } include("misc_func.inc"); ver = read_version_in_kb("SeaMonkey/Version"); if (isnull(ver)) exit(0); if ( ver[0] < 1 || (ver[0] == 1 && ver[1] == 0 && ver[4] =~ "^[ab]$") ) security_hole(get_kb_item("SMB/transport"));
NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_120672.NASL description Mozilla 1.7_x86 for Solaris 8 and 9. Date this patch was last updated by Sun : Sep/02/08 last seen 2020-06-01 modified 2020-06-02 plugin id 23773 published 2006-12-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23773 title Solaris 9 (x86) : 120672-08 NASL family Solaris Local Security Checks NASL id SOLARIS8_X86_120672.NASL description Mozilla 1.7_x86 for Solaris 8 and 9. Date this patch was last updated by Sun : Sep/02/08 last seen 2020-06-01 modified 2020-06-02 plugin id 23772 published 2006-12-06 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23772 title Solaris 8 (x86) : 120672-08 NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200604-18.NASL description The remote host is affected by the vulnerability described in GLSA-200604-18 (Mozilla Suite: Multiple vulnerabilities) Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact : A remote attacker could craft malicious web pages or emails that would leverage these issues to inject and execute arbitrary script code with elevated privileges, steal local files, cookies or other information from web pages or emails, and spoof content. Some of these vulnerabilities might even be exploited to execute arbitrary code with the rights of the user running the client. Workaround : There are no known workarounds for all the issues at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 21315 published 2006-05-03 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21315 title GLSA-200604-18 : Mozilla Suite: Multiple vulnerabilities NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_119116.NASL description Mozilla 1.7_x86 patch. Date this patch was last updated by Sun : Aug/05/09 This plugin has been deprecated and either replaced with individual 119116 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22987 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22987 title Solaris 10 (x86) : 119116-35 (deprecated) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2006-078.NASL description A number of vulnerabilities have been discovered in the Mozilla Thunderbird email client that could allow a remote attacker to craft malicious web emails that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, or other information. As well, some of these vulnerabilities can be exploited to execute arbitrary code with the privileges of the user running the program. As well, two crasher bugs have been fixed as well. The updated packages have been patched to fix these problems. last seen 2020-06-01 modified 2020-06-02 plugin id 21284 published 2006-04-26 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21284 title Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:078) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1051.NASL description Several security related problems have been discovered in Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-2353 The last seen 2020-06-01 modified 2020-06-02 plugin id 22593 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22593 title Debian DSA-1051-1 : mozilla-thunderbird - several vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-275-1.NASL description Web pages with extremely long titles caused subsequent launches of Mozilla browser to hang for up to a few minutes, or caused Mozilla to crash on computers with insufficient memory. (CVE-2005-4134) Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file last seen 2020-06-01 modified 2020-06-02 plugin id 21301 published 2006-04-28 reporter Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21301 title Ubuntu 4.10 / 5.04 / 5.10 : mozilla vulnerabilities (USN-275-1) NASL family Windows NASL id MOZILLA_FIREFOX_1501.NASL description The remote Windows host is using Firefox, an alternative web browser. The installed version of Firefox contains various security issues, some of which can be exploited to execute arbitrary code on the affected host subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 20842 published 2006-02-04 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20842 title Firefox < 1.5.0.1 Multiple Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-276-1.NASL description Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious mail with embedded JavaScript could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file last seen 2020-06-01 modified 2020-06-02 plugin id 21321 published 2006-05-03 reporter Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21321 title Ubuntu 5.04 / 5.10 : mozilla-thunderbird vulnerabilities (USN-276-1) NASL family Solaris Local Security Checks NASL id SOLARIS8_120671.NASL description Mozilla 1.7 for Solaris 8 and 9. Date this patch was last updated by Sun : Aug/29/08 last seen 2020-06-01 modified 2020-06-02 plugin id 24395 published 2007-02-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24395 title Solaris 8 (sparc) : 120671-08 NASL family Solaris Local Security Checks NASL id SOLARIS10_119115.NASL description Mozilla 1.7 patch. Date this patch was last updated by Sun : Sep/13/14 This plugin has been deprecated and either replaced with individual 119115 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22954 published 2006-11-06 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22954 title Solaris 10 (sparc) : 119115-36 (deprecated) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1046.NASL description Several security related problems have been discovered in Mozilla. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-2353 The last seen 2020-06-01 modified 2020-06-02 plugin id 22588 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22588 title Debian DSA-1046-1 : mozilla - several vulnerabilities
Oval
accepted | 2009-11-09T04:00:05.333-05:00 | ||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||
description | The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects. | ||||||||||||||||||||||||||||
family | windows | ||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:1494 | ||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||
submitted | 2006-02-07T06:13:00.000-04:00 | ||||||||||||||||||||||||||||
title | Mozilla JavaScript Garbage-Collection Hazards in jsfun.c | ||||||||||||||||||||||||||||
version | 5 |
Saint
bid | 16476 |
description | Mozilla Firefox QueryInterface method memory corruption |
id | web_client_firefox |
osvdb | 22893 |
title | firefox_queryinterface |
type | client |
References
- http://secunia.com/advisories/18700
- http://secunia.com/advisories/18704
- http://secunia.com/advisories/19862
- http://secunia.com/advisories/19863
- http://secunia.com/advisories/19902
- http://secunia.com/advisories/19941
- http://secunia.com/advisories/21622
- http://secunia.com/advisories/22065
- http://securitytracker.com/id?1015570
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1
- http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm
- http://www.debian.org/security/2006/dsa-1044
- http://www.debian.org/security/2006/dsa-1046
- http://www.debian.org/security/2006/dsa-1051
- http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml
- http://www.mozilla.org/security/announce/2006/mfsa2006-01.html
- http://www.securityfocus.com/archive/1/438730/100/0/threaded
- http://www.securityfocus.com/archive/1/446657/100/200/threaded
- http://www.securityfocus.com/bid/16476
- http://www.vupen.com/english/advisories/2006/0413
- http://www.vupen.com/english/advisories/2006/3391
- http://www.vupen.com/english/advisories/2006/3749
- https://bugzilla.mozilla.org/show_bug.cgi?id=322045
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24430
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42654
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1494