Vulnerabilities > CVE-2008-4066 - Cross-site Scripting vulnerability in Mozilla Firefox 2.0.0.14/2.0.0.15/2.0.0.16
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav�ascript" sequence, aka "HTML escaped low surrogates bug."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Embedding Scripts in Non-Script Elements This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
- Embedding Scripts within Scripts An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
- Cross-Site Scripting in Error Pages An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
- Cross-Site Scripting Using Alternate Syntax The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-5644.NASL description This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html last seen 2020-06-01 modified 2020-06-02 plugin id 34319 published 2008-10-01 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34319 title SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(34319); script_version ("1.22"); script_cvs_date("Date: 2019/10/25 13:36:31"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_name(english:"SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-37.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-37/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-38.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-38/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-39.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-39/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-40.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-40/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-41.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-41/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-42.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-42/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-43.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-43/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-44.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-44/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-45.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-45/" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-0016.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3835.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3836.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3837.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4058.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4059.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4060.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4061.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4062.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4063.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4064.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4065.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4066.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4067.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4068.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4069.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 5644."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2008/09/24"); script_set_attribute(attribute:"patch_publication_date", value:"2008/09/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else exit(0, "The host is not affected.");NASL family SuSE Local Security Checks NASL id SUSE_MOZILLA-XULRUNNER181-5656.NASL description This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html last seen 2020-06-01 modified 2020-06-02 plugin id 34367 published 2008-10-08 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34367 title openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update mozilla-xulrunner181-5656. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(34367); script_version ("1.11"); script_cvs_date("Date: 2019/10/25 13:36:32"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_name(english:"openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)"); script_summary(english:"Check for the mozilla-xulrunner181-5656 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/known-vulnerabilities/firefox20.html" ); script_set_attribute( attribute:"solution", value:"Update the affected mozilla-xulrunner181 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-l10n"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/08"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mozilla-xulrunner181"); }NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1649.NASL description Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835 last seen 2020-06-01 modified 2020-06-02 plugin id 34371 published 2008-10-09 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34371 title Debian DSA-1649-1 : iceweasel - several vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-1649. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(34371); script_version("1.16"); script_cvs_date("Date: 2019/08/02 13:32:21"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_xref(name:"DSA", value:"1649"); script_name(english:"Debian DSA-1649-1 : iceweasel - several vulnerabilities"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835 'moz_bug_r_a4' discovered that the same-origin check in nsXMLDocument::OnChannelRedirect() could by bypassed. - CVE-2008-3836 'moz_bug_r_a4' discovered that several vulnerabilities in feedWriter could lead to Chrome privilege escalation. - CVE-2008-3837 Paul Nickerson discovered that an attacker could move windows during a mouse click, resulting in unwanted action triggered by drag-and-drop. - CVE-2008-4058 'moz_bug_r_a4' discovered a vulnerability which can result in Chrome privilege escalation through XPCNativeWrappers. - CVE-2008-4059 'moz_bug_r_a4' discovered a vulnerability which can result in Chrome privilege escalation through XPCNativeWrappers. - CVE-2008-4060 Olli Pettay and 'moz_bug_r_a4' discovered a Chrome privilege escalation vulnerability in XSLT handling. - CVE-2008-4061 Jesse Ruderman discovered a crash in the layout engine, which might allow the execution of arbitrary code. - CVE-2008-4062 Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour discovered crashes in the JavaScript engine, which might allow the execution of arbitrary code. - CVE-2008-4065 Dave Reed discovered that some Unicode byte order marks are stripped from JavaScript code before execution, which can result in code being executed, which were otherwise part of a quoted string. - CVE-2008-4066 Gareth Heyes discovered that some Unicode surrogate characters are ignored by the HTML parser. - CVE-2008-4067 Boris Zbarsky discovered that resource: URLs allow directory traversal when using URL-encoded slashes. - CVE-2008-4068 Georgi Guninski discovered that resource: URLs could bypass local access restrictions. - CVE-2008-4069 Billy Hoffman discovered that the XBM decoder could reveal uninitialised memory." ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-0016" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3835" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3836" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3837" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4058" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4059" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4060" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4061" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4062" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4065" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4066" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4067" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4068" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4069" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2008/dsa-1649" ); script_set_attribute( attribute:"solution", value: "Upgrade the iceweasel packages. For the stable distribution (etch), these problems have been fixed in version 2.0.0.17-0etch1. Packages for hppa will be provided later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceweasel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/09"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"4.0", prefix:"firefox", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-dbg", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family SuSE Local Security Checks NASL id SUSE_11_0_MOZILLAFIREFOX-081002.NASL description This update brings MozillaFirefox to version 3.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag last seen 2020-06-01 modified 2020-06-02 plugin id 39883 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/39883 title openSUSE Security Update : MozillaFirefox (MozillaFirefox-233) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update MozillaFirefox-233. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(39883); script_version("1.12"); script_cvs_date("Date: 2019/10/25 13:36:31"); script_cve_id("CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068"); script_name(english:"openSUSE Security Update : MozillaFirefox (MozillaFirefox-233)"); script_summary(english:"Check for the MozillaFirefox-233 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update brings MozillaFirefox to version 3.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=429179" ); script_set_attribute( attribute:"solution", value:"Update the affected MozillaFirefox packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_cwe_id(22, 79, 189, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.0", reference:"MozillaFirefox-3.0.3-1.1") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"MozillaFirefox-translations-3.0.3-1.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox"); }NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-645-3.NASL description USN-645-1 fixed vulnerabilities in Firefox and xulrunner. The upstream patches introduced a regression in the saved password handling. While password data was not lost, if a user had saved any passwords with non-ASCII characters, Firefox could not access the password database. This update fixes the problem. We apologize for the inconvenience. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38073 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38073 title Ubuntu 8.04 LTS : firefox-3.0, xulrunner-1.9 regression (USN-645-3) NASL family SuSE Local Security Checks NASL id SUSE_11_0_MOZILLA-XULRUNNER190-081002.NASL description This update brings the mozilla-xulrunner190 engine to version 1.9.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag last seen 2020-06-01 modified 2020-06-02 plugin id 40074 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40074 title openSUSE Security Update : mozilla-xulrunner190 (mozilla-xulrunner190-234) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0882.NASL description Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34275 published 2008-09-24 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34275 title RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2008:0882) NASL family SuSE Local Security Checks NASL id SUSE_11_0_SEAMONKEY-081003.NASL description This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html last seen 2020-06-01 modified 2020-06-02 plugin id 40130 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40130 title openSUSE Security Update : seamonkey (seamonkey-238) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2008-270-01.NASL description New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34300 published 2008-09-28 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34300 title Slackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-thunderbird (SSA:2008-270-01) NASL family Scientific Linux Local Security Checks NASL id SL_20080923_SEAMONKEY_ON_SL3_X.NASL description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) last seen 2020-06-01 modified 2020-06-02 plugin id 60476 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60476 title Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64 NASL family Windows NASL id SEAMONKEY_1112.NASL description The installed version of SeaMonkey is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code. (MFSA 2008-37) - It is possible to bypass the same-origin check in last seen 2020-06-01 modified 2020-06-02 plugin id 34269 published 2008-09-24 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34269 title SeaMonkey < 1.1.12 Multiple Vulnerabilities NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2008-269-01.NASL description New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34295 published 2008-09-26 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34295 title Slackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-firefox (SSA:2008-269-01) NASL family Scientific Linux Local Security Checks NASL id SL_20081001_THUNDERBIRD_ON_SL4_X.NASL description Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) Note2: On SL4 this updates fixes the bug that when a URL link is clicked, firefox wouldn last seen 2020-06-01 modified 2020-06-02 plugin id 60478 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60478 title Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64 NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-645-1.NASL description Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36243 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/36243 title Ubuntu 7.04 / 7.10 / 8.04 LTS : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-645-1) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLAFIREFOX-5640.NASL description This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html last seen 2020-06-01 modified 2020-06-02 plugin id 34318 published 2008-10-01 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34318 title openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5640) NASL family SuSE Local Security Checks NASL id SUSE_MOZILLATHUNDERBIRD-5655.NASL description This update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml last seen 2020-06-01 modified 2020-06-02 plugin id 34345 published 2008-10-06 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34345 title openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5655) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0908.NASL description Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34339 published 2008-10-06 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34339 title CentOS 4 / 5 : thunderbird (CESA-2008:0908) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0908.NASL description Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34330 published 2008-10-02 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34330 title RHEL 4 / 5 : thunderbird (RHSA-2008:0908) NASL family SuSE Local Security Checks NASL id SUSE_11_0_MOZILLATHUNDERBIRD-081003.NASL description This update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml last seen 2020-06-01 modified 2020-06-02 plugin id 39893 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/39893 title openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-236) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-645-2.NASL description USN-645-1 fixed vulnerabilities in Firefox and xulrunner for Ubuntu 7.04, 7.10 and 8.04 LTS. This provides the corresponding update for Ubuntu 6.06 LTS. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 65110 published 2013-03-09 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/65110 title Ubuntu 6.06 LTS : firefox vulnerabilities (USN-645-2) NASL family Windows NASL id MOZILLA_FIREFOX_20017.NASL description The installed version of Firefox is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in last seen 2020-06-01 modified 2020-06-02 plugin id 34268 published 2008-09-24 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34268 title Firefox < 2.0.0.17 Multiple Vulnerabilities NASL family Windows NASL id MOZILLA_THUNDERBIRD_20017.NASL description The installed version of Thunderbird is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in last seen 2020-06-01 modified 2020-06-02 plugin id 34294 published 2008-09-26 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34294 title Mozilla Thunderbird < 2.0.0.17 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_GECKO-SDK-5654.NASL description This update backports lots of security fixes to mozilla-xulrunner package of SLES 10. It contains among others the following security fixes : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html last seen 2020-06-01 modified 2020-06-02 plugin id 34366 published 2008-10-08 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34366 title SuSE 10 Security Update : Mozilla (ZYPP Patch Number 5654) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2008-269-02.NASL description New seamonkey packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34296 published 2008-09-26 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34296 title Slackware 11.0 / 12.0 / 12.1 / current : seamonkey (SSA:2008-269-02) NASL family Fedora Local Security Checks NASL id FEDORA_2008-8401.NASL description Updated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34307 published 2008-09-29 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34307 title Fedora 8 : seamonkey-1.1.12-1.fc8 (2008-8401) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-647-1.NASL description It was discovered that the same-origin check in Thunderbird could be bypassed. If a user had JavaScript enabled and were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the browser engine of Thunderbird. If a user had JavaScript enabled, this could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks if a user had JavaScript enabled. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Georgi Guninski discovered that Thunderbird improperly handled cancelled newsgroup messages. If a user opened a crafted newsgroup message, an attacker could cause a buffer overrun and potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4070). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37910 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/37910 title Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : mozilla-thunderbird, thunderbird vulnerabilities (USN-647-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0908.NASL description From Red Hat Security Advisory 2008:0908 : Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67754 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67754 title Oracle Linux 4 : thunderbird (ELSA-2008-0908) NASL family SuSE Local Security Checks NASL id SUSE_SEAMONKEY-5657.NASL description This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html last seen 2020-06-01 modified 2020-06-02 plugin id 34360 published 2008-10-07 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34360 title openSUSE 10 Security Update : seamonkey (seamonkey-5657) NASL family Windows NASL id MOZILLA_FIREFOX_302.NASL description The installed version of Firefox 3.0 is earlier than 3.0.2. Such versions are potentially affected by the following security issues : - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40). - Privilege escalation is possible via last seen 2020-06-01 modified 2020-06-02 plugin id 34267 published 2008-09-24 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34267 title Firefox 3.0.x < 3.0.2 Multiple Vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201301-01.NASL description The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL’s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser’s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 63402 published 2013-01-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63402 title GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1669.NASL description Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835 last seen 2020-06-01 modified 2020-06-02 plugin id 34938 published 2008-11-24 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34938 title Debian DSA-1669-1 : xulrunner - several vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0882.NASL description From Red Hat Security Advisory 2008:0882 : Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67745 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67745 title Oracle Linux 3 / 4 : seamonkey (ELSA-2008-0882) NASL family SuSE Local Security Checks NASL id SUSE_11_0_MOZILLA-XULRUNNER181-081002.NASL description This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html last seen 2020-06-01 modified 2020-06-02 plugin id 40071 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40071 title openSUSE Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-237) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2008-205.NASL description Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069). This update provides the latest Firefox to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36823 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/36823 title Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:205) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0882.NASL description Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34278 published 2008-09-25 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34278 title CentOS 3 / 4 : seamonkey (CESA-2008:0882) NASL family Fedora Local Security Checks NASL id FEDORA_2008-8429.NASL description Updated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34309 published 2008-09-29 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34309 title Fedora 9 : seamonkey-1.1.12-1.fc9 (2008-8429) NASL family Fedora Local Security Checks NASL id FEDORA_2008-9807.NASL description This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34836 published 2008-11-21 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34836 title Fedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807) NASL family Fedora Local Security Checks NASL id FEDORA_2008-9859.NASL description This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 34837 published 2008-11-21 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34837 title Fedora 9 : thunderbird-2.0.0.18-1.fc9 (2008-9859) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2008-206.NASL description A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4070). This update provides the latest Thunderbird to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 37308 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/37308 title Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:206)
Oval
| accepted | 2013-04-29T04:17:56.690-04:00 | ||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||
| description | #56325ascript" sequence, aka "HTML escaped low surrogates bug." | ||||||||||||||||||||||||||||||||
| family | unix | ||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:8880 | ||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||||||||||
| title | Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "javascript" sequence, aka "HTML escaped low surrogates bug." | ||||||||||||||||||||||||||||||||
| version | 27 |
Redhat
| advisories |
| ||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 31346 CVE ID: CVE-2008-3837 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4063 CVE-2008-4064 CVE-2008-4065 CVE-2008-4066 CVE-2008-4067 CVE-2008-4068 CVE-2008-4069 CVE-2008-3836 CVE-2008-3835 CVE-2008-0016 CNCVE ID：CNCVE-20083837 CNCVE-20084058 CNCVE-20084059 CNCVE-20084060 CNCVE-20084061 CNCVE-20084062 CNCVE-20084063 CNCVE-20084064 CNCVE-20084065 CNCVE-20084066 CNCVE-20084067 CNCVE-20084068 CNCVE-20084069 CNCVE-20083836 CNCVE-20083835 CNCVE-20080016 Mozilla Firefox/SeaMonkey/Thunderbird是开放源代码的浏览器和邮件新闻组客户端产品套件。 Mozilla Firefox/SeaMonkey/Thunderbird存在多个问题，远程攻击者可以利用漏洞进行任意代码执行，获得敏感信息，拒绝服务，跨域执行脚本等攻击。 -IBM X-Force的Justin Schuh和Tom Cross及IBM Watson Labs的Peter Williams报告Mozilla URL解析函数中存在错误，这些错误可通过超级链接中使用特殊构建的UTF-8 URL来触发，导致缓冲区溢出任意代码执行。 -Mozilla security researcher moz_bug_r_a4报告nsXMLDocument::OnChannelRedirect()中的同域检查可被绕过，导致脚本在其他WEB站点上执行。 -Mozilla security researcher moz_bug_r_a4包含feedWriter存在一系列漏洞，允许页面内容中的脚本以chrome特权执行。 -Mozilla security researcher moz_bug_r_a4包含一些漏洞，如页面内容可破坏XPCNativeWrappers，及以chrome特权执行任意代码。其中一个变种问题只影响Firefox 2。 -Mozilla developer Olli Pettay报告XSLT可建立不包含脚本处理对象的文档。moz_bug_r_a4报告document.loadBindingDocument()可返回不包含脚本处理对象的文档。这些问题也可用于以chrome特权执行任意脚本。 -Mozilla developers包含Firefox和其他Mozilla产品的浏览器引擎存在问题，在部分条件下可导致内存破坏或任意代码执行。 pple Product Security的Drew Yao报告Mozilla图像渲染代码存在两个崩溃问题，此漏洞只影响Firefox 3。 Fortinet's FortiGuard Global Security Research Team的David Maciejak也报告影响Firefox 3的图像渲染代码可导致应用程序崩溃。 -Microsoft developer Dave Reed报告部分BOM字符从Javascript代码剥离前可执行，这可导致攻击者绕过脚本过滤器执行XSS攻击。 Security researcher Gareth Heyes报告HTML解析器存在问题，可导致绕过脚本过滤器执行XSS攻击。 -Mozilla developer Boris Zbarsky报告当使用URL编码斜杠时，resource:协议允许在Linux平台上触发目录遍历攻击。 Mozilla developer Georgi Guninski报告在本地HTML文件上的限制可使用resource:协议绕过，此漏洞可导致攻击者读取系统上的信息。 -Security researcher Billy Hoffman在XBM解码上发现一个缺陷，允许随机小的未初始化块内存被读取，此漏洞没有导致内存破坏。 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux AS 4 RedHat Enterprise Linux AS 3 RedHat Enterprise Linux AS 2.1 RedHat Enterprise Linux 5 server RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 Mozilla Thunderbird 2.0 8 Mozilla Thunderbird 2.0 16 Mozilla Thunderbird 2.0 15 Mozilla Thunderbird 2.0 .9 Mozilla Thunderbird 2.0 .6 Mozilla Thunderbird 2.0 .5 Mozilla Thunderbird 2.0 .4 Mozilla Thunderbird 2.0 .14 Mozilla Thunderbird 2.0 .13 Mozilla Thunderbird 2.0 .12 Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey 1.1.2 Mozilla SeaMonkey 1.1.1 Mozilla SeaMonkey 1.0.99 Mozilla SeaMonkey 1.0.9 Mozilla SeaMonkey 1.0.8 Mozilla SeaMonkey 1.0.7 Mozilla SeaMonkey 1.0.6 Mozilla SeaMonkey 1.0.5 Mozilla SeaMonkey 1.0.3 Mozilla SeaMonkey 1.0.2 Mozilla SeaMonkey 1.0.1 Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey 1.0 dev Mozilla SeaMonkey 1.0 Mozilla Firefox 3.0.1 Mozilla Firefox 2.0 8 Mozilla Firefox 2.0 16 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .7 Mozilla Firefox 2.0 .6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .10 Mozilla Firefox 2.0 .1 Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3.0 Mozilla Firefox 2.0.0.3 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.13 Mozilla Firefox 2.0.0.12 Mozilla Firefox 2.0.0.11 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 可参考如下升级程序： Mozilla Firefox 3.0 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_powerpc.deb Mozilla Firefox 2.0.0.14 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.13 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 RC2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 sparc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_sparc.deb Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.04 i386 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.15 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.12 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.11 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 lpia Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0. target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1 target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1</a> nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl</a> y-0ubuntu0.7.10_lpia.deb Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 i386 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_amd64.deb Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla Firefox 2.0 .6 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 16 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .9 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .5 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 8 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .7 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .3 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0.1 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> |
| id | SSV:4101 |
| last seen | 2017-11-19 |
| modified | 2008-09-25 |
| published | 2008-09-25 |
| reporter | Root |
| title | Mozilla Firefox/SeaMonkey/Thunderbird多个远程漏洞 |
Related news
References
- http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx
- http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx
- http://download.novell.com/Download?buildid=WZXONb-tqBw~
- http://download.novell.com/Download?buildid=WZXONb-tqBw~
- http://jvn.jp/en/jp/JVN96950482/index.html
- http://jvn.jp/en/jp/JVN96950482/index.html
- http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000058.html
- http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000058.html
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html
- http://secunia.com/advisories/31984
- http://secunia.com/advisories/31984
- http://secunia.com/advisories/31985
- http://secunia.com/advisories/31985
- http://secunia.com/advisories/32007
- http://secunia.com/advisories/32007
- http://secunia.com/advisories/32010
- http://secunia.com/advisories/32010
- http://secunia.com/advisories/32012
- http://secunia.com/advisories/32012
- http://secunia.com/advisories/32025
- http://secunia.com/advisories/32025
- http://secunia.com/advisories/32042
- http://secunia.com/advisories/32042
- http://secunia.com/advisories/32044
- http://secunia.com/advisories/32044
- http://secunia.com/advisories/32082
- http://secunia.com/advisories/32082
- http://secunia.com/advisories/32092
- http://secunia.com/advisories/32092
- http://secunia.com/advisories/32144
- http://secunia.com/advisories/32144
- http://secunia.com/advisories/32185
- http://secunia.com/advisories/32185
- http://secunia.com/advisories/32196
- http://secunia.com/advisories/32196
- http://secunia.com/advisories/32845
- http://secunia.com/advisories/32845
- http://secunia.com/advisories/34501
- http://secunia.com/advisories/34501
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
- http://www.debian.org/security/2008/dsa-1649
- http://www.debian.org/security/2008/dsa-1649
- http://www.debian.org/security/2008/dsa-1669
- http://www.debian.org/security/2008/dsa-1669
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:205
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:205
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:206
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:206
- http://www.mozilla.org/security/announce/2008/mfsa2008-43.html
- http://www.mozilla.org/security/announce/2008/mfsa2008-43.html
- http://www.redhat.com/support/errata/RHSA-2008-0882.html
- http://www.redhat.com/support/errata/RHSA-2008-0882.html
- http://www.redhat.com/support/errata/RHSA-2008-0908.html
- http://www.redhat.com/support/errata/RHSA-2008-0908.html
- http://www.securityfocus.com/bid/31346
- http://www.securityfocus.com/bid/31346
- http://www.securitytracker.com/id?1020920
- http://www.securitytracker.com/id?1020920
- http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results/
- http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results/
- http://www.ubuntu.com/usn/usn-645-1
- http://www.ubuntu.com/usn/usn-645-1
- http://www.ubuntu.com/usn/usn-645-2
- http://www.ubuntu.com/usn/usn-645-2
- http://www.ubuntu.com/usn/usn-647-1
- http://www.ubuntu.com/usn/usn-647-1
- http://www.vupen.com/english/advisories/2008/2661
- http://www.vupen.com/english/advisories/2008/2661
- http://www.vupen.com/english/advisories/2009/0977
- http://www.vupen.com/english/advisories/2009/0977
- https://bugzilla.mozilla.org/show_bug.cgi?id=448166
- https://bugzilla.mozilla.org/show_bug.cgi?id=448166
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45358
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45358
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8880
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html