Vulnerabilities > CVE-2008-4065 - Cross-Site Scripting vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE

Summary

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."

Vulnerable Configurations

Part Description Count
Application
Mozilla
157
OS
Debian
1
OS
Canonical
4

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0879.NASL
    descriptionAn updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2. You can find a link to the Mozilla advisories in the References section. All firefox users should upgrade to this updated package, which contains backported patches that correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43709
    published2010-01-06
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43709
    titleCentOS 4 / 5 : firefox (CESA-2008:0879)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2008:0879 and 
    # CentOS Errata and Security Advisory 2008:0879 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(43709);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:04");
    
      script_cve_id("CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4067", "CVE-2008-4068");
      script_bugtraq_id(31346);
      script_xref(name:"RHSA", value:"2008:0879");
    
      script_name(english:"CentOS 4 / 5 : firefox (CESA-2008:0879)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated firefox package that fixes various security issues is now
    available for Red Hat Enterprise Linux 4 and 5.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    Mozilla Firefox is an open source Web browser.
    
    Several flaws were found in the processing of malformed web content. A
    web page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code as the user running Firefox.
    (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062,
    CVE-2008-4063, CVE-2008-4064)
    
    Several flaws were found in the way malformed web content was
    displayed. A web page containing specially crafted content could
    potentially trick a Firefox user into surrendering sensitive
    information. (CVE-2008-4067, CVE-2008-4068)
    
    A flaw was found in the way Firefox handles mouse click events. A web
    page containing specially crafted JavaScript code could move the
    content window while a mouse-button was pressed, causing any item
    under the pointer to be dragged. This could, potentially, cause the
    user to perform an unsafe drag-and-drop action. (CVE-2008-3837)
    
    A flaw was found in Firefox that caused certain characters to be
    stripped from JavaScript code. This flaw could allow malicious
    JavaScript to bypass or evade script filters. (CVE-2008-4065)
    
    For technical details regarding these flaws, please see the Mozilla
    security advisories for Firefox 3.0.2. You can find a link to the
    Mozilla advisories in the References section.
    
    All firefox users should upgrade to this updated package, which
    contains backported patches that correct these issues."
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-September/015266.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?881a32b4"
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-September/015267.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?48608290"
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-September/015271.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?1aabe779"
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-September/015272.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f2846e25"
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-September/015277.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f98e4c12"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(22, 79, 189, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:devhelp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:devhelp-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:nss-pkcs11-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:nss-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner-devel-unstable");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:yelp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2008/09/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/09/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 4.x / 5.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"devhelp-0.10-0.10.el4")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"devhelp-0.10-0.10.el4")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"devhelp-devel-0.10-0.10.el4")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"devhelp-devel-0.10-0.10.el4")) flag++;
    if (rpm_check(release:"CentOS-4", reference:"firefox-3.0.2-3.el4.centos")) flag++;
    
    if (rpm_check(release:"CentOS-5", reference:"devhelp-0.12-19.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"devhelp-devel-0.12-19.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"firefox-3.0.2-3.el5.centos")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"nss-3.12.1.1-1.el5.centos.1")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"nss-devel-3.12.1.1-1.el5.centos.1")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"nss-pkcs11-devel-3.12.1.1-1.el5.centos.1")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"nss-tools-3.12.1.1-1.el5.centos.1")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"xulrunner-1.9.0.2-5.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"xulrunner-devel-1.9.0.2-5.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"xulrunner-devel-unstable-1.9.0.2-5.el5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"yelp-2.16.0-21.el5")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "devhelp / devhelp-devel / firefox / nss / nss-devel / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLAFIREFOX-5644.NASL
    descriptionThis update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html
    last seen2020-06-01
    modified2020-06-02
    plugin id34319
    published2008-10-01
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34319
    titleSuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34319);
      script_version ("1.22");
      script_cvs_date("Date: 2019/10/25 13:36:31");
    
      script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069");
    
      script_name(english:"SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and
    security issues :
    
      - XBM image uninitialized memory reading. (MFSA 2008-45 /
        CVE-2008-4069)
    
      - resource: traversal vulnerabilities. (MFSA 2008-44 /
        CVE-2008-4067 / CVE-2008-4068)
    
      - BOM characters stripped from JavaScript before execution
        CVE-2008-4065: Stripped BOM characters bug
        CVE-2008-4066: HTML escaped low surrogates bug. (MFSA
        2008-43)
    
      - Crashes with evidence of memory corruption
        (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman
        reported a crash in the layout engine. CVE-2008-4062:
        Igor Bukanov, Philip Taylor, Georgi Guninski, and
        Antoine Labour reported crashes in the JavaScript
        engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and
        Martijn Wargers reported crashes in the layout engine
        which only affected Firefox 3. CVE-2008-4064: David
        Maciejak and Drew Yao reported crashes in graphics
        rendering which only affected Firefox 3. (MFSA 2008-42)
    
      - Privilege escalation via XPCnativeWrapper pollution
        CVE-2008-4058: XPCnativeWrapper pollution bugs
        CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2)
        CVE-2008-4060: Documents without script handling
        objects. (MFSA 2008-41)
    
      - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837)
    
      - Privilege escalation using feed preview page and XSS
        flaw. (MFSA 2008-39 / CVE-2008-3836)
    
      - nsXMLDocument::OnChannelRedirect() same-origin
        violation. (MFSA 2008-38 / CVE-2008-3835)
    
      - UTF-8 URL stack buffer overflow. (MFSA 2008-37 /
        CVE-2008-0016)
    
    For more details:
    http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-37.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-37/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-38.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-38/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-39.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-39/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-40.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-40/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-41.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-41/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-42.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-42/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-43.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-43/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-44.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-44/"
      );
      # http://www.mozilla.org/security/announce/2008/mfsa2008-45.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-45/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-0016.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-3835.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-3836.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-3837.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4058.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4059.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4060.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4061.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4062.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4063.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4064.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4065.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4066.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4067.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4068.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-4069.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 5644.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(22, 79, 119, 189, 200, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2008/09/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/09/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++;
    if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++;
    if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++;
    if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++;
    if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++;
    if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++;
    if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++;
    if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLA-XULRUNNER181-5656.NASL
    descriptionThis update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
    last seen2020-06-01
    modified2020-06-02
    plugin id34367
    published2008-10-08
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34367
    titleopenSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update mozilla-xulrunner181-5656.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34367);
      script_version ("1.11");
      script_cvs_date("Date: 2019/10/25 13:36:32");
    
      script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069");
    
      script_name(english:"openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)");
      script_summary(english:"Check for the mozilla-xulrunner181-5656 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update brings mozilla-xulrunner181 to security fix version
    1.8.1.17.
    
    It contains the following security fixes: MFSA 2008-45 /
    CVE-2008-4069: XBM image uninitialized memory reading
    
    MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal
    vulnerabilities
    
    MFSA 2008-43: BOM characters stripped from JavaScript before execution
    CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped
    low surrogates bug
    
    MFSA 2008-42 Crashes with evidence of memory corruption
    (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash
    in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor,
    Georgi Guninski, and Antoine Labour reported crashes in the JavaScript
    engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers
    reported crashes in the layout engine which only affected Firefox 3.
    CVE-2008-4064: David Maciejak and Drew Yao reported crashes in
    graphics rendering which only affected Firefox 3.
    
    MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
    CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059:
    XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents
    without script handling objects
    
    MFSA 2008-40 / CVE-2008-3837: Forced mouse drag
    
    MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview
    page and XSS flaw
    
    MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect()
    same-origin violation
    
    MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow
    
    For more details:
    http://www.mozilla.org/security/known-vulnerabilities/firefox20.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/known-vulnerabilities/firefox20.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mozilla-xulrunner181 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(22, 79, 119, 189, 200, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-l10n");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/10/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/08");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.2", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++;
    if ( rpm_check(release:"SUSE10.3", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mozilla-xulrunner181");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1649.NASL
    descriptionSeveral remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835
    last seen2020-06-01
    modified2020-06-02
    plugin id34371
    published2008-10-09
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34371
    titleDebian DSA-1649-1 : iceweasel - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-1649. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34371);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:21");
    
      script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069");
      script_xref(name:"DSA", value:"1649");
    
      script_name(english:"Debian DSA-1649-1 : iceweasel - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several remote vulnerabilities have been discovered in the Iceweasel
    web browser, an unbranded version of the Firefox browser. The Common
    Vulnerabilities and Exposures project identifies the following
    problems :
    
      - CVE-2008-0016
        Justin Schuh, Tom Cross and Peter Williams discovered a
        buffer overflow in the parser for UTF-8 URLs, which may
        lead to the execution of arbitrary code.
    
      - CVE-2008-3835
        'moz_bug_r_a4' discovered that the same-origin check in
        nsXMLDocument::OnChannelRedirect() could by bypassed.
    
      - CVE-2008-3836
        'moz_bug_r_a4' discovered that several vulnerabilities
        in feedWriter could lead to Chrome privilege escalation.
    
      - CVE-2008-3837
        Paul Nickerson discovered that an attacker could move
        windows during a mouse click, resulting in unwanted
        action triggered by drag-and-drop.
    
      - CVE-2008-4058
        'moz_bug_r_a4' discovered a vulnerability which can
        result in Chrome privilege escalation through
        XPCNativeWrappers.
    
      - CVE-2008-4059
        'moz_bug_r_a4' discovered a vulnerability which can
        result in Chrome privilege escalation through
        XPCNativeWrappers.
    
      - CVE-2008-4060
        Olli Pettay and 'moz_bug_r_a4' discovered a Chrome
        privilege escalation vulnerability in XSLT handling.
    
      - CVE-2008-4061
        Jesse Ruderman discovered a crash in the layout engine,
        which might allow the execution of arbitrary code.
    
      - CVE-2008-4062
        Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine
        Labour discovered crashes in the JavaScript engine,
        which might allow the execution of arbitrary code.
    
      - CVE-2008-4065
        Dave Reed discovered that some Unicode byte order marks
        are stripped from JavaScript code before execution,
        which can result in code being executed, which were
        otherwise part of a quoted string.
    
      - CVE-2008-4066
        Gareth Heyes discovered that some Unicode surrogate
        characters are ignored by the HTML parser.
    
      - CVE-2008-4067
        Boris Zbarsky discovered that resource: URLs allow
        directory traversal when using URL-encoded slashes.
    
      - CVE-2008-4068
        Georgi Guninski discovered that resource: URLs could
        bypass local access restrictions.
    
      - CVE-2008-4069
        Billy Hoffman discovered that the XBM decoder could
        reveal uninitialised memory."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-0016"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-3835"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-3836"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-3837"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4058"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4059"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4060"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4061"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4062"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4065"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4066"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4067"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4068"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2008-4069"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2008/dsa-1649"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the iceweasel packages.
    
    For the stable distribution (etch), these problems have been fixed in
    version 2.0.0.17-0etch1. Packages for hppa will be provided later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(22, 79, 119, 189, 200, 264, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceweasel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/10/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"4.0", prefix:"firefox", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"iceweasel", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"iceweasel-dbg", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"iceweasel-dom-inspector", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"iceweasel-gnome-support", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"mozilla-firefox", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"mozilla-firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++;
    if (deb_check(release:"4.0", prefix:"mozilla-firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20080923_FIREFOX_ON_SL4_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2. You can find a link to the Mozilla advisories in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id60475
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60475
    titleScientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_MOZILLAFIREFOX-081002.NASL
    descriptionThis update brings MozillaFirefox to version 3.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag
    last seen2020-06-01
    modified2020-06-02
    plugin id39883
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39883
    titleopenSUSE Security Update : MozillaFirefox (MozillaFirefox-233)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0879.NASL
    descriptionAn updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2. You can find a link to the Mozilla advisories in the References section. All firefox users should upgrade to this updated package, which contains backported patches that correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34274
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34274
    titleRHEL 4 / 5 : firefox (RHSA-2008:0879)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-645-3.NASL
    descriptionUSN-645-1 fixed vulnerabilities in Firefox and xulrunner. The upstream patches introduced a regression in the saved password handling. While password data was not lost, if a user had saved any passwords with non-ASCII characters, Firefox could not access the password database. This update fixes the problem. We apologize for the inconvenience. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id38073
    published2009-04-23
    reporterUbuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/38073
    titleUbuntu 8.04 LTS : firefox-3.0, xulrunner-1.9 regression (USN-645-3)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_MOZILLA-XULRUNNER190-081002.NASL
    descriptionThis update brings the mozilla-xulrunner190 engine to version 1.9.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag
    last seen2020-06-01
    modified2020-06-02
    plugin id40074
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40074
    titleopenSUSE Security Update : mozilla-xulrunner190 (mozilla-xulrunner190-234)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0882.NASL
    descriptionUpdated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34275
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34275
    titleRHEL 2.1 / 3 / 4 : seamonkey (RHSA-2008:0882)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1696.NASL
    descriptionSeveral remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. (MFSA 2008-37) - CVE-2008-1380 It was discovered that crashes in the JavaScript engine could potentially lead to the execution of arbitrary code. (MFSA 2008-20) - CVE-2008-3835
    last seen2020-06-01
    modified2020-06-02
    plugin id35313
    published2009-01-08
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/35313
    titleDebian DSA-1696-1 : icedove - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_SEAMONKEY-081003.NASL
    descriptionThis patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html
    last seen2020-06-01
    modified2020-06-02
    plugin id40130
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/40130
    titleopenSUSE Security Update : seamonkey (seamonkey-238)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2008-270-01.NASL
    descriptionNew mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34300
    published2008-09-28
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34300
    titleSlackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-thunderbird (SSA:2008-270-01)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_2273879E8A2F11DDA6FE0030843D3802.NASL
    descriptionThe Mozilla Foundation reports : MFSA 2008-37UTF-8 URL stack-based buffer overflow MFSA 2008-38nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-39Privilege escalation using feed preview page and XSS flaw MFSA 2008-40Forced mouse drag MFSA 2008-41Privilege escalation via XPCnativeWrapper pollution MFSA 2008-42Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17) MFSA 2008-43BOM characters stripped from JavaScript before execution MFSA 2008-44resource: traversal vulnerabilities MFSA 2008-45XBM image uninitialized memory reading
    last seen2020-06-01
    modified2020-06-02
    plugin id34270
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34270
    titleFreeBSD : mozilla -- multiple vulnerabilities (2273879e-8a2f-11dd-a6fe-0030843d3802)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20080923_SEAMONKEY_ON_SL3_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066)
    last seen2020-06-01
    modified2020-06-02
    plugin id60476
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60476
    titleScientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64
  • NASL familyWindows
    NASL idSEAMONKEY_1112.NASL
    descriptionThe installed version of SeaMonkey is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code. (MFSA 2008-37) - It is possible to bypass the same-origin check in
    last seen2020-06-01
    modified2020-06-02
    plugin id34269
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34269
    titleSeaMonkey < 1.1.12 Multiple Vulnerabilities
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2008-269-01.NASL
    descriptionNew mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34295
    published2008-09-26
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34295
    titleSlackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-firefox (SSA:2008-269-01)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20081001_THUNDERBIRD_ON_SL4_X.NASL
    descriptionSeveral flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) Note2: On SL4 this updates fixes the bug that when a URL link is clicked, firefox wouldn
    last seen2020-06-01
    modified2020-06-02
    plugin id60478
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60478
    titleScientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-645-1.NASL
    descriptionJustin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id36243
    published2009-04-23
    reporterUbuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36243
    titleUbuntu 7.04 / 7.10 / 8.04 LTS : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-645-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLAFIREFOX-5640.NASL
    descriptionThis update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
    last seen2020-06-01
    modified2020-06-02
    plugin id34318
    published2008-10-01
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34318
    titleopenSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5640)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLATHUNDERBIRD-5655.NASL
    descriptionThis update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml
    last seen2020-06-01
    modified2020-06-02
    plugin id34345
    published2008-10-06
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34345
    titleopenSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5655)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-8399.NASL
    descriptionMozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2.[1] All Firefox users should upgrade to these updated packages, which contain patches that correct these issues. [1] http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34306
    published2008-09-29
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34306
    titleFedora 8 : Miro-1.2.3-4.fc8 / blam-1.8.3-18.fc8 / cairo-dock-1.6.2.3-1.fc8.1 / chmsee-1.0.0-4.31.fc8 / etc (2008-8399)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0908.NASL
    descriptionUpdated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34339
    published2008-10-06
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34339
    titleCentOS 4 / 5 : thunderbird (CESA-2008:0908)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0908.NASL
    descriptionUpdated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34330
    published2008-10-02
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34330
    titleRHEL 4 / 5 : thunderbird (RHSA-2008:0908)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_MOZILLATHUNDERBIRD-081003.NASL
    descriptionThis update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml
    last seen2020-06-01
    modified2020-06-02
    plugin id39893
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39893
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-236)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1697.NASL
    descriptionSeveral remote vulnerabilities have been discovered in Iceape an unbranded version of the SeaMonkey internet suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. (MFSA 2008-37) - CVE-2008-0304 It was discovered that a buffer overflow in MIME decoding can lead to the execution of arbitrary code. (MFSA 2008-26) - CVE-2008-2785 It was discovered that missing boundary checks on a reference counter for CSS objects can lead to the execution of arbitrary code. (MFSA 2008-34) - CVE-2008-2798 Devon Hubbard, Jesse Ruderman and Martijn Wargers discovered crashes in the layout engine, which might allow the execution of arbitrary code. (MFSA 2008-21) - CVE-2008-2799 Igor Bukanov, Jesse Ruderman and Gary Kwong discovered crashes in the JavaScript engine, which might allow the execution of arbitrary code. (MFSA 2008-21) - CVE-2008-2800
    last seen2020-06-01
    modified2020-06-02
    plugin id35314
    published2009-01-08
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/35314
    titleDebian DSA-1697-1 : iceape - several vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0879.NASL
    descriptionFrom Red Hat Security Advisory 2008:0879 : An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2. You can find a link to the Mozilla advisories in the References section. All firefox users should upgrade to this updated package, which contains backported patches that correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67744
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67744
    titleOracle Linux 5 : firefox (ELSA-2008-0879)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-645-2.NASL
    descriptionUSN-645-1 fixed vulnerabilities in Firefox and xulrunner for Ubuntu 7.04, 7.10 and 8.04 LTS. This provides the corresponding update for Ubuntu 6.06 LTS. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id65110
    published2013-03-09
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/65110
    titleUbuntu 6.06 LTS : firefox vulnerabilities (USN-645-2)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_20017.NASL
    descriptionThe installed version of Firefox is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in
    last seen2020-06-01
    modified2020-06-02
    plugin id34268
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34268
    titleFirefox < 2.0.0.17 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_20017.NASL
    descriptionThe installed version of Thunderbird is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in
    last seen2020-06-01
    modified2020-06-02
    plugin id34294
    published2008-09-26
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34294
    titleMozilla Thunderbird < 2.0.0.17 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_GECKO-SDK-5654.NASL
    descriptionThis update backports lots of security fixes to mozilla-xulrunner package of SLES 10. It contains among others the following security fixes : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html
    last seen2020-06-01
    modified2020-06-02
    plugin id34366
    published2008-10-08
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34366
    titleSuSE 10 Security Update : Mozilla (ZYPP Patch Number 5654)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2008-269-02.NASL
    descriptionNew seamonkey packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34296
    published2008-09-26
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34296
    titleSlackware 11.0 / 12.0 / 12.1 / current : seamonkey (SSA:2008-269-02)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-8401.NASL
    descriptionUpdated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34307
    published2008-09-29
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34307
    titleFedora 8 : seamonkey-1.1.12-1.fc8 (2008-8401)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-647-1.NASL
    descriptionIt was discovered that the same-origin check in Thunderbird could be bypassed. If a user had JavaScript enabled and were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the browser engine of Thunderbird. If a user had JavaScript enabled, this could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks if a user had JavaScript enabled. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Georgi Guninski discovered that Thunderbird improperly handled cancelled newsgroup messages. If a user opened a crafted newsgroup message, an attacker could cause a buffer overrun and potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4070). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id37910
    published2009-04-23
    reporterUbuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37910
    titleUbuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : mozilla-thunderbird, thunderbird vulnerabilities (USN-647-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0908.NASL
    descriptionFrom Red Hat Security Advisory 2008:0908 : Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67754
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67754
    titleOracle Linux 4 : thunderbird (ELSA-2008-0908)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SEAMONKEY-5657.NASL
    descriptionThis patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html
    last seen2020-06-01
    modified2020-06-02
    plugin id34360
    published2008-10-07
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34360
    titleopenSUSE 10 Security Update : seamonkey (seamonkey-5657)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-8425.NASL
    descriptionMozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-4058, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-4067, CVE-2008-4068) A flaw was found in the way Firefox handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in Firefox that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.2.[1] All Firefox users should upgrade to these updated packages, which contain patches that correct these issues. [1] http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34308
    published2008-09-29
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34308
    titleFedora 9 : Miro-1.2.4-3.fc9 / blam-1.8.5-2.fc9 / cairo-dock-1.6.2.3-1.fc9.1 / chmsee-1.0.1-5.fc9 / etc (2008-8425)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_302.NASL
    descriptionThe installed version of Firefox 3.0 is earlier than 3.0.2. Such versions are potentially affected by the following security issues : - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40). - Privilege escalation is possible via
    last seen2020-06-01
    modified2020-06-02
    plugin id34267
    published2008-09-24
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34267
    titleFirefox 3.0.x < 3.0.2 Multiple Vulnerabilities
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1669.NASL
    descriptionSeveral remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835
    last seen2020-06-01
    modified2020-06-02
    plugin id34938
    published2008-11-24
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34938
    titleDebian DSA-1669-1 : xulrunner - several vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0882.NASL
    descriptionFrom Red Hat Security Advisory 2008:0882 : Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67745
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67745
    titleOracle Linux 3 / 4 : seamonkey (ELSA-2008-0882)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_MOZILLA-XULRUNNER181-081002.NASL
    descriptionThis update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
    last seen2020-06-01
    modified2020-06-02
    plugin id40071
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/40071
    titleopenSUSE Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-237)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-205.NASL
    descriptionSecurity vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069). This update provides the latest Firefox to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id36823
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/36823
    titleMandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:205)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0882.NASL
    descriptionUpdated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34278
    published2008-09-25
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34278
    titleCentOS 3 / 4 : seamonkey (CESA-2008:0882)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-8429.NASL
    descriptionUpdated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34309
    published2008-09-29
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34309
    titleFedora 9 : seamonkey-1.1.12-1.fc9 (2008-8429)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-9807.NASL
    descriptionThis update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34836
    published2008-11-21
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34836
    titleFedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-9859.NASL
    descriptionThis update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id34837
    published2008-11-21
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34837
    titleFedora 9 : thunderbird-2.0.0.18-1.fc9 (2008-9859)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-206.NASL
    descriptionA number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4070). This update provides the latest Thunderbird to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id37308
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/37308
    titleMandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:206)

Oval

accepted2013-04-29T04:13:40.733-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptionMozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."
familyunix
idoval:org.mitre.oval:def:11383
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleMozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."
version27

Redhat

advisories
  • rhsa
    idRHSA-2008:0879
  • rhsa
    idRHSA-2008:0882
  • rhsa
    idRHSA-2008:0908
rpms
  • devhelp-0:0.12-19.el5
  • devhelp-debuginfo-0:0.12-19.el5
  • devhelp-devel-0:0.12-19.el5
  • firefox-0:3.0.2-3.el4
  • firefox-0:3.0.2-3.el5
  • firefox-debuginfo-0:3.0.2-3.el4
  • firefox-debuginfo-0:3.0.2-3.el5
  • nss-0:3.12.1.1-1.el5
  • nss-debuginfo-0:3.12.1.1-1.el5
  • nss-devel-0:3.12.1.1-1.el5
  • nss-pkcs11-devel-0:3.12.1.1-1.el5
  • nss-tools-0:3.12.1.1-1.el5
  • xulrunner-0:1.9.0.2-5.el5
  • xulrunner-debuginfo-0:1.9.0.2-5.el5
  • xulrunner-devel-0:1.9.0.2-5.el5
  • xulrunner-devel-unstable-0:1.9.0.2-5.el5
  • yelp-0:2.16.0-21.el5
  • yelp-debuginfo-0:2.16.0-21.el5
  • devhelp-0:0.10-0.10.el4
  • devhelp-debuginfo-0:0.10-0.10.el4
  • devhelp-devel-0:0.10-0.10.el4
  • seamonkey-0:1.0.9-0.20.el2
  • seamonkey-0:1.0.9-0.24.el3
  • seamonkey-0:1.0.9-26.el4
  • seamonkey-chat-0:1.0.9-0.20.el2
  • seamonkey-chat-0:1.0.9-0.24.el3
  • seamonkey-chat-0:1.0.9-26.el4
  • seamonkey-debuginfo-0:1.0.9-0.24.el3
  • seamonkey-debuginfo-0:1.0.9-26.el4
  • seamonkey-devel-0:1.0.9-0.20.el2
  • seamonkey-devel-0:1.0.9-0.24.el3
  • seamonkey-devel-0:1.0.9-26.el4
  • seamonkey-dom-inspector-0:1.0.9-0.20.el2
  • seamonkey-dom-inspector-0:1.0.9-0.24.el3
  • seamonkey-dom-inspector-0:1.0.9-26.el4
  • seamonkey-js-debugger-0:1.0.9-0.20.el2
  • seamonkey-js-debugger-0:1.0.9-0.24.el3
  • seamonkey-js-debugger-0:1.0.9-26.el4
  • seamonkey-mail-0:1.0.9-0.20.el2
  • seamonkey-mail-0:1.0.9-0.24.el3
  • seamonkey-mail-0:1.0.9-26.el4
  • seamonkey-nspr-0:1.0.9-0.20.el2
  • seamonkey-nspr-0:1.0.9-0.24.el3
  • seamonkey-nspr-devel-0:1.0.9-0.20.el2
  • seamonkey-nspr-devel-0:1.0.9-0.24.el3
  • seamonkey-nss-0:1.0.9-0.20.el2
  • seamonkey-nss-0:1.0.9-0.24.el3
  • seamonkey-nss-devel-0:1.0.9-0.20.el2
  • seamonkey-nss-devel-0:1.0.9-0.24.el3
  • thunderbird-0:1.5.0.12-16.el4
  • thunderbird-0:2.0.0.17-1.el5
  • thunderbird-debuginfo-0:1.5.0.12-16.el4
  • thunderbird-debuginfo-0:2.0.0.17-1.el5

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 31346 CVE ID: CVE-2008-3837 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4063 CVE-2008-4064 CVE-2008-4065 CVE-2008-4066 CVE-2008-4067 CVE-2008-4068 CVE-2008-4069 CVE-2008-3836 CVE-2008-3835 CVE-2008-0016 CNCVE ID:CNCVE-20083837 CNCVE-20084058 CNCVE-20084059 CNCVE-20084060 CNCVE-20084061 CNCVE-20084062 CNCVE-20084063 CNCVE-20084064 CNCVE-20084065 CNCVE-20084066 CNCVE-20084067 CNCVE-20084068 CNCVE-20084069 CNCVE-20083836 CNCVE-20083835 CNCVE-20080016 Mozilla Firefox/SeaMonkey/Thunderbird是开放源代码的浏览器和邮件新闻组客户端产品套件。 Mozilla Firefox/SeaMonkey/Thunderbird存在多个问题,远程攻击者可以利用漏洞进行任意代码执行,获得敏感信息,拒绝服务,跨域执行脚本等攻击。 -IBM X-Force的Justin Schuh和Tom Cross及IBM Watson Labs的Peter Williams报告Mozilla URL解析函数中存在错误,这些错误可通过超级链接中使用特殊构建的UTF-8 URL来触发,导致缓冲区溢出任意代码执行。 -Mozilla security researcher moz_bug_r_a4报告nsXMLDocument::OnChannelRedirect()中的同域检查可被绕过,导致脚本在其他WEB站点上执行。 -Mozilla security researcher moz_bug_r_a4包含feedWriter存在一系列漏洞,允许页面内容中的脚本以chrome特权执行。 -Mozilla security researcher moz_bug_r_a4包含一些漏洞,如页面内容可破坏XPCNativeWrappers,及以chrome特权执行任意代码。其中一个变种问题只影响Firefox 2。 -Mozilla developer Olli Pettay报告XSLT可建立不包含脚本处理对象的文档。moz_bug_r_a4报告document.loadBindingDocument()可返回不包含脚本处理对象的文档。这些问题也可用于以chrome特权执行任意脚本。 -Mozilla developers包含Firefox和其他Mozilla产品的浏览器引擎存在问题,在部分条件下可导致内存破坏或任意代码执行。 pple Product Security的Drew Yao报告Mozilla图像渲染代码存在两个崩溃问题,此漏洞只影响Firefox 3。 Fortinet's FortiGuard Global Security Research Team的David Maciejak也报告影响Firefox 3的图像渲染代码可导致应用程序崩溃。 -Microsoft developer Dave Reed报告部分BOM字符从Javascript代码剥离前可执行,这可导致攻击者绕过脚本过滤器执行XSS攻击。 Security researcher Gareth Heyes报告HTML解析器存在问题,可导致绕过脚本过滤器执行XSS攻击。 -Mozilla developer Boris Zbarsky报告当使用URL编码斜杠时,resource:协议允许在Linux平台上触发目录遍历攻击。 Mozilla developer Georgi Guninski报告在本地HTML文件上的限制可使用resource:协议绕过,此漏洞可导致攻击者读取系统上的信息。 -Security researcher Billy Hoffman在XBM解码上发现一个缺陷,允许随机小的未初始化块内存被读取,此漏洞没有导致内存破坏。 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux AS 4 RedHat Enterprise Linux AS 3 RedHat Enterprise Linux AS 2.1 RedHat Enterprise Linux 5 server RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 Mozilla Thunderbird 2.0 8 Mozilla Thunderbird 2.0 16 Mozilla Thunderbird 2.0 15 Mozilla Thunderbird 2.0 .9 Mozilla Thunderbird 2.0 .6 Mozilla Thunderbird 2.0 .5 Mozilla Thunderbird 2.0 .4 Mozilla Thunderbird 2.0 .14 Mozilla Thunderbird 2.0 .13 Mozilla Thunderbird 2.0 .12 Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey 1.1.2 Mozilla SeaMonkey 1.1.1 Mozilla SeaMonkey 1.0.99 Mozilla SeaMonkey 1.0.9 Mozilla SeaMonkey 1.0.8 Mozilla SeaMonkey 1.0.7 Mozilla SeaMonkey 1.0.6 Mozilla SeaMonkey 1.0.5 Mozilla SeaMonkey 1.0.3 Mozilla SeaMonkey 1.0.2 Mozilla SeaMonkey 1.0.1 Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey 1.0 dev Mozilla SeaMonkey 1.0 Mozilla Firefox 3.0.1 Mozilla Firefox 2.0 8 Mozilla Firefox 2.0 16 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .7 Mozilla Firefox 2.0 .6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .10 Mozilla Firefox 2.0 .1 Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3.0 Mozilla Firefox 2.0.0.3 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.13 Mozilla Firefox 2.0.0.12 Mozilla Firefox 2.0.0.11 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 可参考如下升级程序: Mozilla Firefox 3.0 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_powerpc.deb Mozilla Firefox 2.0.0.14 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.13 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 RC2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 sparc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_sparc.deb Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.04 i386 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.15 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.12 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.11 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 lpia Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0. target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1 target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1</a> nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl</a> y-0ubuntu0.7.10_lpia.deb Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 i386 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_amd64.deb Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla Firefox 2.0 .6 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 16 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .9 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .5 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 8 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .7 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .3 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0.1 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a>
idSSV:4101
last seen2017-11-19
modified2008-09-25
published2008-09-25
reporterRoot
titleMozilla Firefox/SeaMonkey/Thunderbird多个远程漏洞

References