Vulnerabilities > CVE-2006-6504 - Code Injection vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Nessus
NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2006-0758.NASL description From Red Hat Security Advisory 2006:0758 : Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67430 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67430 title Oracle Linux 4 : firefox (ELSA-2006-0758) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2006:0758 and # Oracle Linux Security Advisory ELSA-2006-0758 respectively. # include("compat.inc"); if (description) { script_id(67430); script_version("1.12"); script_cvs_date("Date: 2019/10/25 13:36:06"); script_cve_id("CVE-2006-6497", "CVE-2006-6498", "CVE-2006-6501", "CVE-2006-6502", "CVE-2006-6503", "CVE-2006-6504"); script_bugtraq_id(21668, 59855, 59858, 59859, 59860, 59861, 59862, 59863, 59864, 59865, 59868, 60765, 60766, 60773, 60774, 60776, 60777, 60778, 60783, 60784, 60787); script_xref(name:"RHSA", value:"2006:0758"); script_name(english:"Oracle Linux 4 : firefox (ELSA-2006-0758)"); script_summary(english:"Checks rpm output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Oracle Linux host is missing a security update." ); script_set_attribute( attribute:"description", value: "From Red Hat Security Advisory 2006:0758 : Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues." ); script_set_attribute( attribute:"see_also", value:"https://oss.oracle.com/pipermail/el-errata/2006-December/000035.html" ); script_set_attribute( attribute:"solution", value:"Update the affected firefox package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"metasploit_name", value:'Firefox onreadystatechange Event DocumentViewerImpl Use After Free'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(94); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:firefox"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/19"); script_set_attribute(attribute:"patch_publication_date", value:"2006/12/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Oracle Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux"); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux"); os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 4", "Oracle Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu); flag = 0; if (rpm_check(release:"EL4", cpu:"i386", reference:"firefox-1.5.0.9-0.1.el4.1")) flag++; if (rpm_check(release:"EL4", cpu:"x86_64", reference:"firefox-1.5.0.9-0.1.el4.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox"); }NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2006-0759.NASL description Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way SeaMonkey renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way SeaMonkey Mail parses the Content-Type mail header. A malicious mail message could cause the SeaMonkey Mail client to crash or possibly execute arbitrary code as the user running SeaMonkey Mail. (CVE-2006-6505) Users of SeaMonkey are advised to upgrade to these erratum packages, which contain SeaMonkey version 1.0.7 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23961 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23961 title RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2006:0759) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2006:0759. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(23961); script_version ("1.26"); script_cvs_date("Date: 2019/10/25 13:36:12"); script_cve_id("CVE-2006-6497", "CVE-2006-6498", "CVE-2006-6501", "CVE-2006-6502", "CVE-2006-6503", "CVE-2006-6504", "CVE-2006-6505"); script_bugtraq_id(21668); script_xref(name:"RHSA", value:"2006:0759"); script_name(english:"RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2006:0759)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way SeaMonkey renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way SeaMonkey Mail parses the Content-Type mail header. A malicious mail message could cause the SeaMonkey Mail client to crash or possibly execute arbitrary code as the user running SeaMonkey Mail. (CVE-2006-6505) Users of SeaMonkey are advised to upgrade to these erratum packages, which contain SeaMonkey version 1.0.7 that corrects these issues." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6497" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6498" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6501" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6502" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6503" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6504" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2006-6505" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2006:0759" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(94); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:devhelp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:devhelp-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-chat"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-dom-inspector"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-js-debugger"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-mail"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-nspr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-nspr-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-nss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:seamonkey-nss-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/19"); script_set_attribute(attribute:"patch_publication_date", value:"2006/12/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/12/30"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^(2\.1|3|4)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1 / 3.x / 4.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2006:0759"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-chat-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-devel-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-dom-inspector-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-js-debugger-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-mail-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-nspr-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-nspr-devel-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-nss-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"seamonkey-nss-devel-1.0.7-0.1.el2")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-chat-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-devel-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-dom-inspector-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-js-debugger-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-mail-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-nspr-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-nspr-devel-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-nss-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"seamonkey-nss-devel-1.0.7-0.1.el3")) flag++; if (rpm_check(release:"RHEL4", cpu:"i386", reference:"devhelp-0.10-0.6.el4")) flag++; if (rpm_check(release:"RHEL4", cpu:"x86_64", reference:"devhelp-0.10-0.6.el4")) flag++; if (rpm_check(release:"RHEL4", cpu:"i386", reference:"devhelp-devel-0.10-0.6.el4")) flag++; if (rpm_check(release:"RHEL4", cpu:"x86_64", reference:"devhelp-devel-0.10-0.6.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-chat-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-devel-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-dom-inspector-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-js-debugger-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-mail-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-nspr-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-nspr-devel-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-nss-1.0.7-0.1.el4")) flag++; if (rpm_check(release:"RHEL4", reference:"seamonkey-nss-devel-1.0.7-0.1.el4")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "devhelp / devhelp-devel / seamonkey / seamonkey-chat / etc"); } }NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2006-0760.NASL description Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23944 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23944 title CentOS 4 : Thunderbird (CESA-2006:0760) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2006:0760 and # CentOS Errata and Security Advisory 2006:0760 respectively. # include("compat.inc"); if (description) { script_id(23944); script_version("1.18"); script_cvs_date("Date: 2019/10/25 13:36:03"); script_cve_id("CVE-2006-6497", "CVE-2006-6498", "CVE-2006-6501", "CVE-2006-6502", "CVE-2006-6503", "CVE-2006-6504", "CVE-2006-6505"); script_bugtraq_id(21668); script_xref(name:"RHSA", value:"2006:0760"); script_name(english:"CentOS 4 : Thunderbird (CESA-2006:0760)"); script_summary(english:"Checks rpm output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing a security update." ); script_set_attribute( attribute:"description", value: "Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues." ); # https://lists.centos.org/pipermail/centos-announce/2006-December/013449.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?4ec11201" ); # https://lists.centos.org/pipermail/centos-announce/2006-December/013451.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?d04c578e" ); # https://lists.centos.org/pipermail/centos-announce/2006-December/013454.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?82f7c04b" ); script_set_attribute( attribute:"solution", value:"Update the affected thunderbird package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(94); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:thunderbird"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/19"); script_set_attribute(attribute:"patch_publication_date", value:"2006/12/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/12/30"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 4.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-4", reference:"thunderbird-1.5.0.9-0.1.el4.centos4")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird"); }NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-398-4.NASL description USN-398-2 fixed vulnerabilities in Firefox 1.5. However, when auto-filling saved-password login forms without a username field, Firefox would crash. This update fixes the problem. We apologize for the inconvenience. Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious web page containing JavaScript or SVG. (CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502, CVE-2006-6504) Various flaws have been reported that allow an attacker to bypass Firefox last seen 2020-06-01 modified 2020-06-02 plugin id 27986 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27986 title Ubuntu 5.10 / 6.06 LTS : firefox regression (USN-398-4) NASL family Fedora Local Security Checks NASL id FEDORA_2006-1492.NASL description Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24080 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24080 title Fedora Core 6 : devhelp-0.12-9.fc6 / epiphany-2.16.2-1.fc6 / firefox-1.5.0.9-1.fc6 / etc (2006-1492) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2006-0758.NASL description Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23942 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23942 title CentOS 4 : Firefox (CESA-2006:0758) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200701-04.NASL description The remote host is affected by the vulnerability described in GLSA-200701-04 (SeaMonkey: Multiple vulnerabilities) An anonymous researcher found evidence of memory corruption in the way SeaMonkey handles certain types of SVG comment DOM nodes. Georgi Guninski and David Bienvenu discovered buffer overflows in the processing of long last seen 2020-06-01 modified 2020-06-02 plugin id 24008 published 2007-01-11 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24008 title GLSA-200701-04 : SeaMonkey: Multiple vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200701-02.NASL description The remote host is affected by the vulnerability described in GLSA-200701-02 (Mozilla Firefox: Multiple vulnerabilities) An anonymous researcher found evidence of memory corruption in the way Mozilla Firefox handles certain types of SVG comment DOM nodes. Additionally, Frederik Reiss discovered a heap-based buffer overflow in the conversion of a CSS cursor. Other issues with memory corruption were also fixed. Mozilla Firefox also contains less severe vulnerabilities involving JavaScript and Java. Impact : An attacker could entice a user to view a specially crafted web page that will trigger one of the vulnerabilities, possibly leading to the execution of arbitrary code. It is also possible for an attacker to perform cross-site scripting attacks, leading to the exposure of sensitive information, like user credentials. Workaround : There are no known workarounds for all the issues at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 23991 published 2007-01-08 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23991 title GLSA-200701-02 : Mozilla Firefox: Multiple vulnerabilities NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2006-0759.NASL description Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way SeaMonkey renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way SeaMonkey Mail parses the Content-Type mail header. A malicious mail message could cause the SeaMonkey Mail client to crash or possibly execute arbitrary code as the user running SeaMonkey Mail. (CVE-2006-6505) Users of SeaMonkey are advised to upgrade to these erratum packages, which contain SeaMonkey version 1.0.7 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23943 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23943 title CentOS 3 / 4 : seamonkey (CESA-2006:0759) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLATHUNDERBIRD-2421.NASL description This security update brings Mozilla Thunderbird to version 1.5.0.9. http://www.mozilla.org/projects/security/known-vulnerabilities.html It includes fixes to the following security problems: CVE-2006-6497/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the JavaScript engine. CVE-2006-6499/MFSA2006-68: Crashes regarding floating point usage were fixed. CVE-2006-6500/MFSA2006-69: This issue only affects Windows systems, Linux is not affected. CVE-2006-6501/MFSA2006-70: A privilege escalation using a watch point was fixed. CVE-2006-6502/MFSA2006-71: A LiveConnect crash finalizing JS objects was fixed. CVE-2006-6503/MFSA2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed. CVE-2006-6504/MFSA2006-73: A Mozilla SVG Processing Remote Code Execution was fixed. CVE-2006-6505/MFSA2006-74: Some Mail header processing heap overflows were fixed. CVE-2006-6506/MFSA2006-75: The RSS Feed-preview referrer leak was fixed. CVE-2006-6507/MFSA2006-76: A XSS problem using outer window last seen 2020-06-01 modified 2020-06-02 plugin id 27128 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27128 title openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-2421) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-398-1.NASL description Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious web page containing JavaScript or SVG. (CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502, CVE-2006-6504) Various flaws have been reported that allow an attacker to bypass Firefox last seen 2020-06-01 modified 2020-06-02 plugin id 27984 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27984 title Ubuntu 6.10 : firefox vulnerabilities (USN-398-1) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-2423.NASL description This update brings MozillaFirefox to the security update release 1.5.0.9, including the following security fixes. http://www.mozilla.org/projects/security/known-vulnerabilities.html - Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498 / MFSA 2006-68: Crashes with evidence of memory corruption were fixed in the JavaScript engine. CVE-2006-6499 / MFSA 2006-68: Crashes regarding floating point usage were fixed. CVE-2006-6500 / MFSA 2006-69: This issue only affects Windows systems, Linux is not affected. CVE-2006-6501 / MFSA 2006-70: A privilege escalation using a watch point was fixed. CVE-2006-6502 / MFSA 2006-71: A LiveConnect crash finalizing JS objects was fixed. CVE-2006-6503 / MFSA 2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed. CVE-2006-6504 / MFSA 2006-73: A Mozilla SVG Processing Remote Code Execution was fixed. CVE-2006-6505 / MFSA 2006-74: Some Mail header processing heap overflows were fixed. CVE-2006-6506 / MFSA 2006-75: The RSS Feed-preview referrer leak was fixed. CVE-2006-6507 / MFSA 2006-76: A XSS problem using outer window last seen 2020-06-01 modified 2020-06-02 plugin id 29358 published 2007-12-13 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29358 title SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 2423) NASL family Fedora Local Security Checks NASL id FEDORA_2006-1491.NASL description Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24079 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24079 title Fedora Core 6 : thunderbird-1.5.0.9-2.fc6 (2006-1491) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2006-0758.NASL description Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23960 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23960 title RHEL 4 : firefox (RHSA-2006:0758) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2006-0760.NASL description Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 23962 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/23962 title RHEL 4 : thunderbird (RHSA-2006:0760) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-400-1.NASL description Georgi Guninski and David Bienvenu discovered that long Content-Type and RFC2047-encoded headers we vulnerable to heap overflows. By tricking the user into opening a specially crafted email, an attacker could execute arbitrary code with user privileges. (CVE-2006-6506) Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges or bypass internal XSS protections by tricking the user into opening a malicious email containing JavaScript. Please note that JavaScript is disabled by default for emails, and it is not recommended to enable it. (CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27988 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27988 title Ubuntu 5.10 / 6.06 LTS / 6.10 : mozilla-thunderbird vulnerabilities (USN-400-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2006-0760.NASL description From Red Hat Security Advisory 2006:0760 : Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67432 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67432 title Oracle Linux 4 : thunderbird (ELSA-2006-0760) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-398-2.NASL description USN-398-1 fixed vulnerabilities in Firefox 2.0. This update provides the corresponding updates for Firefox 1.5. Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious web page containing JavaScript or SVG. (CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502, CVE-2006-6504) Various flaws have been reported that allow an attacker to bypass Firefox last seen 2020-06-01 modified 2020-06-02 plugin id 27985 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27985 title Ubuntu 5.10 / 6.06 LTS : firefox vulnerabilities (USN-398-2) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-010.NASL description A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.9. This update provides the latest Firefox to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24626 published 2007-02-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24626 title Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:010) NASL family Fedora Local Security Checks NASL id FEDORA_2006-004.NASL description Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; this issue is not exploitable without enabling JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505) Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24027 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24027 title Fedora Core 5 : thunderbird-1.5.0.9-2.fc5 (2006-004) NASL family Windows NASL id SEAMONKEY_107.NASL description The installed version of SeaMonkey contains various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 23928 published 2006-12-20 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23928 title SeaMonkey < 1.0.7 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_SEAMONKEY-2432.NASL description This security update brings Mozilla SeaMonkey to version 1.0.7. http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details. It includes fixes to the following security problems: CVE-2006-6497/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the JavaScript engine. CVE-2006-6499/MFSA2006-68: Crashes regarding floating point usage were fixed. CVE-2006-6500/MFSA2006-69: This issue only affects Windows systems, Linux is not affected. CVE-2006-6501/MFSA2006-70: A privilege escalation using a watch point was fixed. CVE-2006-6502/MFSA2006-71: A LiveConnect crash finalizing JS objects was fixed. CVE-2006-6503/MFSA2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed. CVE-2006-6504/MFSA2006-73: A Mozilla SVG Processing Remote Code Execution was fixed. CVE-2006-6505/MFSA2006-74: Some Mail header processing heap overflows were fixed. CVE-2006-6506/MFSA2006-75: The RSS Feed-preview referrer leak was fixed. CVE-2006-6507/MFSA2006-76: A XSS problem using outer window last seen 2020-06-01 modified 2020-06-02 plugin id 27438 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27438 title openSUSE 10 Security Update : seamonkey (seamonkey-2432) NASL family Fedora Local Security Checks NASL id FEDORA_2006-1499.NASL description Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497) Users of Firefox are advised to upgrade to this package, which contains Firefox version 1.5.0.9 and corrects these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24081 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24081 title Fedora Core 5 : firefox-1.5.0.9-1.fc5 (2006-1499) NASL family Windows NASL id MOZILLA_FIREFOX_1509.NASL description The installed version of Firefox is affected by various security issues, some of which could lead to execution of arbitrary code on the affected host subject to the user last seen 2020-06-01 modified 2020-06-02 plugin id 23930 published 2006-12-20 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23930 title Firefox < 1.5.0.9 / 2.0.0.1 Multiple Vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2006-0759.NASL description From Red Hat Security Advisory 2006:0759 : Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504) Several flaws were found in the way SeaMonkey renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-6497) A heap based buffer overflow flaw was found in the way SeaMonkey Mail parses the Content-Type mail header. A malicious mail message could cause the SeaMonkey Mail client to crash or possibly execute arbitrary code as the user running SeaMonkey Mail. (CVE-2006-6505) Users of SeaMonkey are advised to upgrade to these erratum packages, which contain SeaMonkey version 1.0.7 that corrects these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67431 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67431 title Oracle Linux 4 : seamonkey (ELSA-2006-0759) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-2418.NASL description This update brings MozillaFirefox to the security update release 1.5.0.9 (2.0.0.1 for openSUSE 10.2) and includes the following security fixes : http://www.mozilla.org/projects/security/known-vulnerabilities.html CVE-2006-6497/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the JavaScript engine. CVE-2006-6499/MFSA2006-68: Crashes regarding floating point usage were fixed. CVE-2006-6500/MFSA2006-69: This issue only affects Windows systems, Linux is not affected. CVE-2006-6501/MFSA2006-70: A privilege escalation using a watch point was fixed. CVE-2006-6502/MFSA2006-71: A LiveConnect crash finalizing JS objects was fixed. CVE-2006-6503/MFSA2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed. CVE-2006-6504/MFSA2006-73: A Mozilla SVG Processing Remote Code Execution was fixed. CVE-2006-6505/MFSA2006-74: Some Mail header processing heap overflows were fixed. CVE-2006-6506/MFSA2006-75: The RSS Feed-preview referrer leak was fixed. CVE-2006-6507/MFSA2006-76: A XSS problem using outer window last seen 2020-06-01 modified 2020-06-02 plugin id 27117 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27117 title openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-2418) NASL family Windows NASL id MOZILLA_THUNDERBIRD_1509.NASL description The remote version of Mozilla Thunderbird suffers from various security issues, at least one of which could lead to execution of arbitrary code on the affected host. last seen 2020-06-01 modified 2020-06-02 plugin id 23929 published 2006-12-20 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23929 title Mozilla Thunderbird < 1.5.0.9 Multiple Vulnerabilities
Oval
| accepted | 2013-04-29T04:11:19.099-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:11077 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption. | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- http://www.mozilla.org/security/announce/2006/mfsa2006-73.html
- http://www.zerodayinitiative.com/advisories/ZDI-06-051.html
- http://rhn.redhat.com/errata/RHSA-2006-0758.html
- http://rhn.redhat.com/errata/RHSA-2006-0759.html
- http://rhn.redhat.com/errata/RHSA-2006-0760.html
- http://securitytracker.com/id?1017417
- http://securitytracker.com/id?1017418
- http://secunia.com/advisories/23433
- http://secunia.com/advisories/23439
- http://secunia.com/advisories/23440
- https://issues.rpath.com/browse/RPL-883
- http://www.us-cert.gov/cas/techalerts/TA06-354A.html
- http://www.kb.cert.org/vuls/id/928956
- http://www.securityfocus.com/bid/21668
- http://secunia.com/advisories/23282
- http://secunia.com/advisories/23422
- http://secunia.com/advisories/23468
- ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc
- http://secunia.com/advisories/23514
- http://www.novell.com/linux/security/advisories/2006_80_mozilla.html
- http://www.ubuntu.com/usn/usn-398-1
- http://secunia.com/advisories/23589
- http://fedoranews.org/cms/node/2297
- http://fedoranews.org/cms/node/2338
- http://security.gentoo.org/glsa/glsa-200701-02.xml
- http://www.ubuntu.com/usn/usn-398-2
- http://secunia.com/advisories/23601
- http://secunia.com/advisories/23545
- http://secunia.com/advisories/23614
- http://secunia.com/advisories/23618
- http://www.gentoo.org/security/en/glsa/glsa-200701-04.xml
- http://secunia.com/advisories/23692
- http://www.novell.com/linux/security/advisories/2007_06_mozilla.html
- http://secunia.com/advisories/23672
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:010
- http://www.vupen.com/english/advisories/2008/0083
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- http://www.vupen.com/english/advisories/2006/5068
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11077
- http://www.securityfocus.com/archive/1/455728/100/200/threaded
- http://www.securityfocus.com/archive/1/455145/100/0/threaded
- http://www.securityfocus.com/archive/1/454939/100/0/threaded