Vulnerabilities > CVE-2007-5959 - Remote Unspecified Memory Corruption vulnerability in Mozilla Firefox

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
mozilla
critical
nessus

Summary

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.

Vulnerable Configurations

Part Description Count
Application
Mozilla
66

Nessus

  • NASL familyWindows
    NASL idSEAMONKEY_117.NASL
    descriptionThe installed version of SeaMonkey is affected by various security issues : - Three bugs that can result in crashes with traces of memory corruption - A cross-site scripting vulnerability involving support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id28374
    published2007-12-02
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28374
    titleSeaMonkey < 1.1.7 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(28374);
      script_version("1.15");
    
      script_cve_id("CVE-2007-5947", "CVE-2007-5959", "CVE-2007-5960");
      script_bugtraq_id(26385, 26589, 26593);
    
      script_name(english:"SeaMonkey < 1.1.7 Multiple Vulnerabilities");
      script_summary(english:"Checks version of SeaMonkey");
    
     script_set_attribute(attribute:"synopsis", value:
    "A web browser on the remote host is affected by multiple
    vulnerabilities." );
     script_set_attribute(attribute:"description", value:
    "The installed version of SeaMonkey is affected by various security
    issues :
    
      - Three bugs that can result in crashes with traces 
        of memory corruption
    
      - A cross-site scripting vulnerability involving
        support for the 'jar:' URI scheme
    
      - A timing issue when setting the 'window.location' 
        property that could be leveraged to conduct
        cross-site request forgery attacks." );
     script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2007-37/" );
     script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2007-38/" );
     script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2007-39/" );
     script_set_attribute(attribute:"solution", value:
    "Upgrade to SeaMonkey 1.1.7 or later." );
     script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
     script_cwe_id(22, 79);
     script_set_attribute(attribute:"plugin_publication_date", value: "2007/12/02");
     script_set_attribute(attribute:"vuln_publication_date", value: "2007/11/09");
     script_cvs_date("Date: 2018/07/27 18:38:15");
    script_set_attribute(attribute:"plugin_type", value:"local");
    script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:seamonkey");
    script_end_attributes();
    
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
     
      script_copyright(english:"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.");
     
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("SeaMonkey/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/SeaMonkey/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "SeaMonkey");
    
    mozilla_check_version(installs:installs, product:'seamonkey', fix:'1.1.7', severity:SECURITY_HOLE);
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLAFIREFOX-4758.NASL
    descriptionThis update brings Mozilla Firefox to security update version 2.0.0.10 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id28369
    published2007-11-30
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28369
    titleopenSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-4758)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1425.NASL
    descriptionSeveral remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5947 Jesse Ruderman and Petko D. Petkov discovered that the URI handler for JAR archives allows cross-site scripting. - CVE-2007-5959 Several crashes in the layout engine were discovered, which might allow the execution of arbitrary code. - CVE-2007-5960 Gregory Fleischer discovered a race condition in the handling of the
    last seen2020-06-01
    modified2020-06-02
    plugin id29260
    published2007-12-11
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29260
    titleDebian DSA-1425-1 : xulrunner - several vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2007-1084.NASL
    descriptionUpdated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. (CVE-2007-5947) Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5959) A race condition existed when SeaMonkey set the
    last seen2020-06-01
    modified2020-06-02
    plugin id36661
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36661
    titleCentOS 3 / 4 : seamonkey (CESA-2007:1084)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1424.NASL
    descriptionSeveral remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5947 Jesse Ruderman and Petko D. Petkov discovered that the URI handler for JAR archives allows cross-site scripting. - CVE-2007-5959 Several crashes in the layout engine were discovered, which might allow the execution of arbitrary code. - CVE-2007-5960 Gregory Fleischer discovered a race condition in the handling of the
    last seen2020-06-01
    modified2020-06-02
    plugin id29259
    published2007-12-11
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29259
    titleDebian DSA-1424-1 : iceweasel - several vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-546-1.NASL
    descriptionIt was discovered that Firefox incorrectly associated redirected sites as the origin of
    last seen2020-06-01
    modified2020-06-02
    plugin id28358
    published2007-11-29
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28358
    titleUbuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-546-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200712-21.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200712-21 (Mozilla Firefox, SeaMonkey: Multiple vulnerabilities) Jesse Ruderman and Petko D. Petkov reported that the jar protocol handler in Mozilla Firefox and SeaMonkey does not properly check MIME types (CVE-2007-5947). Gregory Fleischer reported that the window.location property can be used to generate a fake HTTP Referer (CVE-2007-5960). Multiple memory errors have also been reported (CVE-2007-5959). Impact : A remote attacker could possibly exploit these vulnerabilities to execute arbitrary code in the context of the browser and conduct Cross-Site-Scripting or Cross-Site Request Forgery attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id29818
    published2007-12-31
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29818
    titleGLSA-200712-21 : Mozilla Firefox, SeaMonkey: Multiple vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2007-1083.NASL
    descriptionUpdated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. A cross-site scripting flaw was found in the way Thunderbird handled the jar: URI scheme. It may be possible for a malicious HTML mail message to leverage this flaw, and conduct a cross-site scripting attack against a user running Thunderbird. (CVE-2007-5947) Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2007-5959) A race condition existed when Thunderbird set the
    last seen2020-06-01
    modified2020-06-02
    plugin id29750
    published2007-12-24
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29750
    titleCentOS 4 / 5 : thunderbird (CESA-2007:1083)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2007-1084.NASL
    descriptionFrom Red Hat Security Advisory 2007:1084 : Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. (CVE-2007-5947) Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5959) A race condition existed when SeaMonkey set the
    last seen2020-06-01
    modified2020-06-02
    plugin id67617
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67617
    titleOracle Linux 3 : seamonkey (ELSA-2007-1084)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-546-2.NASL
    descriptionUSN-546-1 fixed vulnerabilities in Firefox. The upstream update included a faulty patch which caused the drawImage method of the canvas element to fail. This update fixes the problem. We apologize for the inconvenience. It was discovered that Firefox incorrectly associated redirected sites as the origin of
    last seen2020-06-01
    modified2020-06-02
    plugin id29236
    published2007-12-07
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29236
    titleUbuntu 6.10 / 7.04 / 7.10 : firefox regression (USN-546-2)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_EPIPHANY-4870.NASL
    descriptionThis update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id29915
    published2008-01-10
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29915
    titleopenSUSE 10 Security Update : epiphany (epiphany-4870)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_20010.NASL
    descriptionThe installed version of Firefox is affected by various security issues : - Three bugs that can result in crashes with traces of memory corruption - A cross-site scripting vulnerability involving support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id28329
    published2007-11-27
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28329
    titleFirefox < 2.0.0.10 Multiple Vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2007-1082.NASL
    descriptionFrom Red Hat Security Advisory 2007:1082 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id67615
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67615
    titleOracle Linux 4 / 5 : firefox (ELSA-2007-1082)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2007-1082.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id37591
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37591
    titleCentOS 4 : firefox (CESA-2007:1082)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20071126_FIREFOX_ON_SL5_X.NASL
    descriptionA cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id60314
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60314
    titleScientific Linux Security Update : firefox on SL5.x, SL4.x i386/x86_64
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-3952.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Fedora 7. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id28345
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28345
    titleFedora 7 : Miro-1.0-2.fc7 / blam-1.8.3-10.fc7 / chmsee-1.0.0-1.27.fc7 / devhelp-0.13-12.fc7 / etc (2007-3952)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20071219_THUNDERBIRD_ON_SL5_X.NASL
    descriptionA cross-site scripting flaw was found in the way Thunderbird handled the jar: URI scheme. It may be possible for a malicious HTML mail message to leverage this flaw, and conduct a cross-site scripting attack against a user running Thunderbird. (CVE-2007-5947) Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2007-5959) A race condition existed when Thunderbird set the
    last seen2020-06-01
    modified2020-06-02
    plugin id60338
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60338
    titleScientific Linux Security Update : thunderbird on SL5.x, SL4.x i386/x86_64
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SEAMONKEY-4794.NASL
    descriptionThis update brings Mozilla SeaMonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5.
    last seen2020-06-01
    modified2020-06-02
    plugin id29695
    published2007-12-13
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29695
    titleopenSUSE 10 Security Update : seamonkey (seamonkey-4794)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2007-246.NASL
    descriptionA number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.11. This update provides the latest Firefox to correct these issues. As well, it provides Firefox 2.0.0.11 for older products.
    last seen2020-06-01
    modified2020-06-02
    plugin id29718
    published2007-12-17
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29718
    titleMandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:246)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-756.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Fedora Core 6. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id29197
    published2007-12-04
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29197
    titleFedora Core 6 : firefox-1.5.0.12-7.fc6 (2007-756)
  • NASL familyWindows
    NASL idNETSCAPE_BROWSER_9004.NASL
    descriptionThe installed version of Netscape is affected by various security issues : - Three bugs that can result in crashes with traces of memory corruption - A cross-site scripting vulnerability involving support for the
    last seen2020-06-01
    modified2020-06-02
    plugin id28377
    published2007-12-03
    reporterThis script is Copyright (C) 2007-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28377
    titleNetscape Browser < 9.0.0.4 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLAFIREFOX-4757.NASL
    descriptionThis update brings Mozilla Firefox to security update version 2.0.0.10 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. - The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2007-38 / CVE-2007-5959) - Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. (MFSA 2007-39 / CVE-2007-5960)
    last seen2020-06-01
    modified2020-06-02
    plugin id29363
    published2007-12-13
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29363
    titleSuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 4757)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2007-331-01.NASL
    descriptionNew mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id28335
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28335
    titleSlackware 10.2 / 11.0 / 12.0 / current : firefox (SSA:2007-331-01)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2007-333-01.NASL
    descriptionNew seamonkey packages are available for Slackware 11.0, 12.0, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id28362
    published2007-11-30
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28362
    titleSlackware 11.0 / 12.0 / current : seamonkey (SSA:2007-333-01)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2007-1083.NASL
    descriptionFrom Red Hat Security Advisory 2007:1083 : Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. A cross-site scripting flaw was found in the way Thunderbird handled the jar: URI scheme. It may be possible for a malicious HTML mail message to leverage this flaw, and conduct a cross-site scripting attack against a user running Thunderbird. (CVE-2007-5947) Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2007-5959) A race condition existed when Thunderbird set the
    last seen2020-06-01
    modified2020-06-02
    plugin id67616
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67616
    titleOracle Linux 4 : thunderbird (ELSA-2007-1083)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_F1F6F6DA9D2F11DC9114001C2514716C.NASL
    descriptionMozilla Foundation reports : The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
    last seen2020-06-01
    modified2020-06-02
    plugin id28351
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28351
    titleFreeBSD : firefox -- multiple remote unspecified memory corruption vulnerabilities (f1f6f6da-9d2f-11dc-9114-001c2514716c)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2007-1082.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id28353
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28353
    titleRHEL 4 / 5 : firefox (RHSA-2007:1082)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SEAMONKEY-4795.NASL
    descriptionThis update fixed various security problems in Mozilla SeaMonkey. Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks.
    last seen2020-06-01
    modified2020-06-02
    plugin id29888
    published2008-01-08
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29888
    titleopenSUSE 10 Security Update : seamonkey (seamonkey-4795)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-3962.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Fedora 8. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the
    last seen2020-06-01
    modified2020-06-02
    plugin id28347
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/28347
    titleFedora 8 : Miro-1.0-2.fc8 / blam-1.8.3-12.fc8 / chmsee-1.0.0-1.27.fc8 / devhelp-0.16.1-4.fc8 / etc (2007-3962)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-4098.NASL
    description - Sun Dec 2 2007 Kai Engert <kengert at redhat.com> - 1.1.7-1 - SeaMonkey 1.1.7 - Mon Nov 5 2007 Kai Engert <kengert at redhat.com> - 1.1.6-1 - SeaMonkey 1.1.6 - Fri Oct 19 2007 Kai Engert <kengert at redhat.com> - 1.1.5-2 - SeaMonkey 1.1.5 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id29266
    published2007-12-11
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29266
    titleFedora 8 : seamonkey-1.1.7-1.fc8 (2007-4098)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20071126_SEAMONKEY_ON_SL4_X.NASL
    descriptionA cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. (CVE-2007-5947) Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5959) A race condition existed when SeaMonkey set the
    last seen2020-06-01
    modified2020-06-02
    plugin id60315
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60315
    titleScientific Linux Security Update : seamonkey on SL4.x, SL3.x i386/x86_64
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2007-1084.NASL
    descriptionUpdated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. (CVE-2007-5947) Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5959) A race condition existed when SeaMonkey set the
    last seen2020-06-01
    modified2020-06-02
    plugin id28354
    published2007-11-29
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28354
    titleRHEL 2.1 / 3 / 4 : seamonkey (RHSA-2007:1084)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2007-1083.NASL
    descriptionUpdated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. A cross-site scripting flaw was found in the way Thunderbird handled the jar: URI scheme. It may be possible for a malicious HTML mail message to leverage this flaw, and conduct a cross-site scripting attack against a user running Thunderbird. (CVE-2007-5947) Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2007-5959) A race condition existed when Thunderbird set the
    last seen2020-06-01
    modified2020-06-02
    plugin id29773
    published2007-12-24
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29773
    titleRHEL 4 / 5 : thunderbird (RHSA-2007:1083)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2007-4106.NASL
    description - Sun Dec 2 2007 Kai Engert <kengert at redhat.com> - 1.1.7-1 - SeaMonkey 1.1.7 - Mon Nov 5 2007 Kai Engert <kengert at redhat.com> - 1.1.6-1 - SeaMonkey 1.1.6 - Fri Oct 19 2007 Kai Engert <kengert at redhat.com> - 1.1.5-1 - SeaMonkey 1.1.5 - Fri Jul 27 2007 Martin Stransky <stransky at redhat.com> - 1.1.3-2 - added pango patches - Fri Jul 20 2007 Kai Engert <kengert at redhat.com> - 1.1.3-1 - SeaMonkey 1.1.3 - Thu May 31 2007 Kai Engert <kengert at redhat.com> 1.1.2-1 - SeaMonkey 1.1.2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id29267
    published2007-12-11
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29267
    titleFedora 7 : seamonkey-1.1.7-1.fc7 (2007-4106)

Oval

accepted2013-04-29T04:10:45.827-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptionMultiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.
familyunix
idoval:org.mitre.oval:def:11014
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleMultiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.
version27

Redhat

advisories
  • rhsa
    idRHSA-2007:1082
  • rhsa
    idRHSA-2007:1083
  • rhsa
    idRHSA-2007:1084
rpms
  • firefox-0:1.5.0.12-0.8.el4
  • firefox-0:1.5.0.12-7.el5
  • firefox-debuginfo-0:1.5.0.12-0.8.el4
  • firefox-debuginfo-0:1.5.0.12-7.el5
  • thunderbird-0:1.5.0.12-7.el4
  • thunderbird-0:1.5.0.12-7.el5
  • thunderbird-debuginfo-0:1.5.0.12-7.el4
  • thunderbird-debuginfo-0:1.5.0.12-7.el5
  • seamonkey-0:1.0.9-0.7.el2
  • seamonkey-0:1.0.9-0.7.el3
  • seamonkey-0:1.0.9-7.el4
  • seamonkey-chat-0:1.0.9-0.7.el2
  • seamonkey-chat-0:1.0.9-7.el4
  • seamonkey-debuginfo-0:1.0.9-0.7.el3
  • seamonkey-debuginfo-0:1.0.9-7.el4
  • seamonkey-devel-0:1.0.9-0.7.el2
  • seamonkey-devel-0:1.0.9-0.7.el3
  • seamonkey-devel-0:1.0.9-7.el4
  • seamonkey-dom-inspector-0:1.0.9-0.7.el2
  • seamonkey-dom-inspector-0:1.0.9-0.7.el3
  • seamonkey-dom-inspector-0:1.0.9-7.el4
  • seamonkey-js-debugger-0:1.0.9-0.7.el2
  • seamonkey-js-debugger-0:1.0.9-0.7.el3
  • seamonkey-js-debugger-0:1.0.9-7.el4
  • seamonkey-mail-0:1.0.9-0.7.el2
  • seamonkey-mail-0:1.0.9-0.7.el3
  • seamonkey-mail-0:1.0.9-7.el4
  • seamonkey-nspr-0:1.0.9-0.7.el2
  • seamonkey-nspr-0:1.0.9-0.7.el3
  • seamonkey-nspr-0:1.0.9-7.el4
  • seamonkey-nspr-devel-0:1.0.9-0.7.el2
  • seamonkey-nspr-devel-0:1.0.9-0.7.el3
  • seamonkey-nspr-devel-0:1.0.9-7.el4
  • seamonkey-nss-0:1.0.9-0.7.el2
  • seamonkey-nss-0:1.0.9-0.7.el3
  • seamonkey-nss-0:1.0.9-7.el4
  • seamonkey-nss-devel-0:1.0.9-0.7.el2
  • seamonkey-nss-devel-0:1.0.9-0.7.el3
  • seamonkey-nss-devel-0:1.0.9-7.el4

References