2.0.0.16

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

mozilla

CWE-79

nessus

NVD

Published: 2008-09-24

Updated: 2017-09-29

Summary

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&#56325ascript" sequence, aka "HTML escaped low surrogates bug."

Vulnerable Configurations

Part	Description	Count
Application	Mozilla Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.16	3

Common Weakness Enumeration (CWE)

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Embedding Scripts in Non-Script Elements
This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
Embedding Scripts within Scripts
An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
Cross-Site Scripting in Error Pages
An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
Cross-Site Scripting Using Alternate Syntax
The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

NASL family	SuSE Local Security Checks
NASL id	SUSE_MOZILLAFIREFOX-5644.NASL
description	This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html
last seen	2020-06-01
modified	2020-06-02
plugin id	34319
published	2008-10-01
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34319
title	SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(34319); script_version ("1.22"); script_cvs_date("Date: 2019/10/25 13:36:31"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_name(english:"SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-37.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-37/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-38.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-38/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-39.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-39/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-40.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-40/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-41.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-41/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-42.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-42/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-43.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-43/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-44.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-44/" ); # http://www.mozilla.org/security/announce/2008/mfsa2008-45.html script_set_attribute( attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-45/" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-0016.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3835.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3836.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-3837.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4058.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4059.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4060.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4061.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4062.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4063.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4064.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4065.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4066.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4067.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4068.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4069.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 5644."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2008/09/24"); script_set_attribute(attribute:"patch_publication_date", value:"2008/09/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLED10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLED10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLES10", sp:1, reference:"MozillaFirefox-translations-2.0.0.17-0.2.1")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-2.0.0.17-0.3")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"MozillaFirefox-translations-2.0.0.17-0.3")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else exit(0, "The host is not affected.");

NASL family	SuSE Local Security Checks
NASL id	SUSE_MOZILLA-XULRUNNER181-5656.NASL
description	This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
last seen	2020-06-01
modified	2020-06-02
plugin id	34367
published	2008-10-08
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34367
title	openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update mozilla-xulrunner181-5656. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(34367); script_version ("1.11"); script_cvs_date("Date: 2019/10/25 13:36:32"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_name(english:"openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)"); script_summary(english:"Check for the mozilla-xulrunner181-5656 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html" ); script_set_attribute( attribute:"see_also", value:"http://www.mozilla.org/security/known-vulnerabilities/firefox20.html" ); script_set_attribute( attribute:"solution", value:"Update the affected mozilla-xulrunner181 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner181-l10n"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/08"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE10\.2\|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.2", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-devel-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", reference:"mozilla-xulrunner181-l10n-1.8.1.17-0.1") ) flag++; if ( rpm_check(release:"SUSE10.3", cpu:"x86_64", reference:"mozilla-xulrunner181-32bit-1.8.1.17-0.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mozilla-xulrunner181"); }

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-1649.NASL
description	Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835
last seen	2020-06-01
modified	2020-06-02
plugin id	34371
published	2008-10-09
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34371
title	Debian DSA-1649-1 : iceweasel - several vulnerabilities
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-1649. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(34371); script_version("1.16"); script_cvs_date("Date: 2019/08/02 13:32:21"); script_cve_id("CVE-2008-0016", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069"); script_xref(name:"DSA", value:"1649"); script_name(english:"Debian DSA-1649-1 : iceweasel - several vulnerabilities"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835 'moz_bug_r_a4' discovered that the same-origin check in nsXMLDocument::OnChannelRedirect() could by bypassed. - CVE-2008-3836 'moz_bug_r_a4' discovered that several vulnerabilities in feedWriter could lead to Chrome privilege escalation. - CVE-2008-3837 Paul Nickerson discovered that an attacker could move windows during a mouse click, resulting in unwanted action triggered by drag-and-drop. - CVE-2008-4058 'moz_bug_r_a4' discovered a vulnerability which can result in Chrome privilege escalation through XPCNativeWrappers. - CVE-2008-4059 'moz_bug_r_a4' discovered a vulnerability which can result in Chrome privilege escalation through XPCNativeWrappers. - CVE-2008-4060 Olli Pettay and 'moz_bug_r_a4' discovered a Chrome privilege escalation vulnerability in XSLT handling. - CVE-2008-4061 Jesse Ruderman discovered a crash in the layout engine, which might allow the execution of arbitrary code. - CVE-2008-4062 Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour discovered crashes in the JavaScript engine, which might allow the execution of arbitrary code. - CVE-2008-4065 Dave Reed discovered that some Unicode byte order marks are stripped from JavaScript code before execution, which can result in code being executed, which were otherwise part of a quoted string. - CVE-2008-4066 Gareth Heyes discovered that some Unicode surrogate characters are ignored by the HTML parser. - CVE-2008-4067 Boris Zbarsky discovered that resource: URLs allow directory traversal when using URL-encoded slashes. - CVE-2008-4068 Georgi Guninski discovered that resource: URLs could bypass local access restrictions. - CVE-2008-4069 Billy Hoffman discovered that the XBM decoder could reveal uninitialised memory." ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-0016" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3835" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3836" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-3837" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4058" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4059" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4060" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4061" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4062" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4065" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4066" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4067" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4068" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2008-4069" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2008/dsa-1649" ); script_set_attribute( attribute:"solution", value: "Upgrade the iceweasel packages. For the stable distribution (etch), these problems have been fixed in version 2.0.0.17-0etch1. Packages for hppa will be provided later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(22, 79, 119, 189, 200, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceweasel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/09"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"4.0", prefix:"firefox", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-dbg", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"iceweasel-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox-dom-inspector", reference:"2.0.0.17-0etch1")) flag++; if (deb_check(release:"4.0", prefix:"mozilla-firefox-gnome-support", reference:"2.0.0.17-0etch1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_MOZILLAFIREFOX-081002.NASL
description	This update brings MozillaFirefox to version 3.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag
last seen	2020-06-01
modified	2020-06-02
plugin id	39883
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/39883
title	openSUSE Security Update : MozillaFirefox (MozillaFirefox-233)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update MozillaFirefox-233. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(39883); script_version("1.12"); script_cvs_date("Date: 2019/10/25 13:36:31"); script_cve_id("CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068"); script_name(english:"openSUSE Security Update : MozillaFirefox (MozillaFirefox-233)"); script_summary(english:"Check for the MozillaFirefox-233 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update brings MozillaFirefox to version 3.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=429179" ); script_set_attribute( attribute:"solution", value:"Update the affected MozillaFirefox packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_cwe_id(22, 79, 189, 264, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/10/02"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.0", reference:"MozillaFirefox-3.0.3-1.1") ) flag++; if ( rpm_check(release:"SUSE11.0", reference:"MozillaFirefox-translations-3.0.3-1.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox"); }

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-645-3.NASL
description	USN-645-1 fixed vulnerabilities in Firefox and xulrunner. The upstream patches introduced a regression in the saved password handling. While password data was not lost, if a user had saved any passwords with non-ASCII characters, Firefox could not access the password database. This update fixes the problem. We apologize for the inconvenience. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	38073
published	2009-04-23
reporter	Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/38073
title	Ubuntu 8.04 LTS : firefox-3.0, xulrunner-1.9 regression (USN-645-3)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_MOZILLA-XULRUNNER190-081002.NASL
description	This update brings the mozilla-xulrunner190 engine to version 1.9.0.3, fixing a number of bugs and security problems : MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag
last seen	2020-06-01
modified	2020-06-02
plugin id	40074
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/40074
title	openSUSE Security Update : mozilla-xulrunner190 (mozilla-xulrunner190-234)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2008-0882.NASL
description	Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34275
published	2008-09-24
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34275
title	RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2008:0882)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_SEAMONKEY-081003.NASL
description	This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html
last seen	2020-06-01
modified	2020-06-02
plugin id	40130
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/40130
title	openSUSE Security Update : seamonkey (seamonkey-238)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2008-270-01.NASL
description	New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34300
published	2008-09-28
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34300
title	Slackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-thunderbird (SSA:2008-270-01)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20080923_SEAMONKEY_ON_SL3_X.NASL
description	Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066)
last seen	2020-06-01
modified	2020-06-02
plugin id	60476
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60476
title	Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

NASL family	Windows
NASL id	SEAMONKEY_1112.NASL
description	The installed version of SeaMonkey is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code. (MFSA 2008-37) - It is possible to bypass the same-origin check in
last seen	2020-06-01
modified	2020-06-02
plugin id	34269
published	2008-09-24
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34269
title	SeaMonkey < 1.1.12 Multiple Vulnerabilities

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2008-269-01.NASL
description	New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34295
published	2008-09-26
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34295
title	Slackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-firefox (SSA:2008-269-01)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20081001_THUNDERBIRD_ON_SL4_X.NASL
description	Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) Note2: On SL4 this updates fixes the bug that when a URL link is clicked, firefox wouldn
last seen	2020-06-01
modified	2020-06-02
plugin id	60478
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60478
title	Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-645-1.NASL
description	Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	36243
published	2009-04-23
reporter	Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/36243
title	Ubuntu 7.04 / 7.10 / 8.04 LTS : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-645-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_MOZILLAFIREFOX-5640.NASL
description	This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
last seen	2020-06-01
modified	2020-06-02
plugin id	34318
published	2008-10-01
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34318
title	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5640)

NASL family	SuSE Local Security Checks
NASL id	SUSE_MOZILLATHUNDERBIRD-5655.NASL
description	This update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml
last seen	2020-06-01
modified	2020-06-02
plugin id	34345
published	2008-10-06
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34345
title	openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5655)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2008-0908.NASL
description	Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34339
published	2008-10-06
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34339
title	CentOS 4 / 5 : thunderbird (CESA-2008:0908)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2008-0908.NASL
description	Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34330
published	2008-10-02
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34330
title	RHEL 4 / 5 : thunderbird (RHSA-2008:0908)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_MOZILLATHUNDERBIRD-081003.NASL
description	This update brings Mozilla Thunderbird to version 2.0.0.17. It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml
last seen	2020-06-01
modified	2020-06-02
plugin id	39893
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/39893
title	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-236)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-645-2.NASL
description	USN-645-1 fixed vulnerabilities in Firefox and xulrunner for Ubuntu 7.04, 7.10 and 8.04 LTS. This provides the corresponding update for Ubuntu 6.06 LTS. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	65110
published	2013-03-09
reporter	Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/65110
title	Ubuntu 6.06 LTS : firefox vulnerabilities (USN-645-2)

NASL family	Windows
NASL id	MOZILLA_FIREFOX_20017.NASL
description	The installed version of Firefox is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in
last seen	2020-06-01
modified	2020-06-02
plugin id	34268
published	2008-09-24
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34268
title	Firefox < 2.0.0.17 Multiple Vulnerabilities

NASL family	Windows
NASL id	MOZILLA_THUNDERBIRD_20017.NASL
description	The installed version of Thunderbird is affected by various security issues : - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37). - It is possible to bypass the same-origin check in
last seen	2020-06-01
modified	2020-06-02
plugin id	34294
published	2008-09-26
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34294
title	Mozilla Thunderbird < 2.0.0.17 Multiple Vulnerabilities

NASL family	SuSE Local Security Checks
NASL id	SUSE_GECKO-SDK-5654.NASL
description	This update backports lots of security fixes to mozilla-xulrunner package of SLES 10. It contains among others the following security fixes : - XBM image uninitialized memory reading. (MFSA 2008-45 / CVE-2008-4069) - resource: traversal vulnerabilities. (MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068) - BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug. (MFSA 2008-43) - Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. (MFSA 2008-42) - Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects. (MFSA 2008-41) - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837) - Privilege escalation using feed preview page and XSS flaw. (MFSA 2008-39 / CVE-2008-3836) - nsXMLDocument::OnChannelRedirect() same-origin violation. (MFSA 2008-38 / CVE-2008-3835) - UTF-8 URL stack buffer overflow. (MFSA 2008-37 / CVE-2008-0016) For more details: http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html
last seen	2020-06-01
modified	2020-06-02
plugin id	34366
published	2008-10-08
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34366
title	SuSE 10 Security Update : Mozilla (ZYPP Patch Number 5654)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2008-269-02.NASL
description	New seamonkey packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34296
published	2008-09-26
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34296
title	Slackware 11.0 / 12.0 / 12.1 / current : seamonkey (SSA:2008-269-02)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2008-8401.NASL
description	Updated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34307
published	2008-09-29
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34307
title	Fedora 8 : seamonkey-1.1.12-1.fc8 (2008-8401)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-647-1.NASL
description	It was discovered that the same-origin check in Thunderbird could be bypassed. If a user had JavaScript enabled and were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835) Several problems were discovered in the browser engine of Thunderbird. If a user had JavaScript enabled, this could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks if a user had JavaScript enabled. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Thunderbird. If a user had JavaScript enabled and were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Georgi Guninski discovered that Thunderbird improperly handled cancelled newsgroup messages. If a user opened a crafted newsgroup message, an attacker could cause a buffer overrun and potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4070). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	37910
published	2009-04-23
reporter	Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/37910
title	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : mozilla-thunderbird, thunderbird vulnerabilities (USN-647-1)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2008-0908.NASL
description	From Red Hat Security Advisory 2008:0908 : Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	67754
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67754
title	Oracle Linux 4 : thunderbird (ELSA-2008-0908)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SEAMONKEY-5657.NASL
description	This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs : MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow Details can be found here: http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html
last seen	2020-06-01
modified	2020-06-02
plugin id	34360
published	2008-10-07
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34360
title	openSUSE 10 Security Update : seamonkey (seamonkey-5657)

NASL family	Windows
NASL id	MOZILLA_FIREFOX_302.NASL
description	The installed version of Firefox 3.0 is earlier than 3.0.2. Such versions are potentially affected by the following security issues : - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40). - Privilege escalation is possible via
last seen	2020-06-01
modified	2020-06-02
plugin id	34267
published	2008-09-24
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34267
title	Firefox 3.0.x < 3.0.2 Multiple Vulnerabilities

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201301-01.NASL
description	The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL’s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser’s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	63402
published	2013-01-08
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/63402
title	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-1669.NASL
description	Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the execution of arbitrary code. - CVE-2008-3835
last seen	2020-06-01
modified	2020-06-02
plugin id	34938
published	2008-11-24
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34938
title	Debian DSA-1669-1 : xulrunner - several vulnerabilities

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2008-0882.NASL
description	From Red Hat Security Advisory 2008:0882 : Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	67745
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67745
title	Oracle Linux 3 / 4 : seamonkey (ELSA-2008-0882)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_MOZILLA-XULRUNNER181-081002.NASL
description	This update brings mozilla-xulrunner181 to security fix version 1.8.1.17. It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3. CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3. MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects MFSA 2008-40 / CVE-2008-3837: Forced mouse drag MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow For more details: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
last seen	2020-06-01
modified	2020-06-02
plugin id	40071
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/40071
title	openSUSE Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-237)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2008-205.NASL
description	Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069). This update provides the latest Firefox to correct these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	36823
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/36823
title	Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:205)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2008-0882.NASL
description	Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34278
published	2008-09-25
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34278
title	CentOS 3 / 4 : seamonkey (CESA-2008:0882)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2008-8429.NASL
description	Updated seamonkey packages that fix several security issues are now available for Fedora 8 and Fedora 9. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068, CVE-2008-4069) A flaw was found in the way SeaMonkey handles mouse click events. A web page containing specially crafted JavaScript code could move the content window while a mouse-button was pressed, causing any item under the pointer to be dragged. This could, potentially, cause the user to perform an unsafe drag-and-drop action. (CVE-2008-3837) A flaw was found in SeaMonkey that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) All SeaMonkey users should upgrade to these updated packages, which contain patches to resolve these issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34309
published	2008-09-29
reporter	This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34309
title	Fedora 9 : seamonkey-1.1.12-1.fc9 (2008-8429)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2008-9807.NASL
description	This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34836
published	2008-11-21
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34836
title	Fedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2008-9859.NASL
description	This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.17 http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.html#thunderbird2.0.0.18 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	34837
published	2008-11-21
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34837
title	Fedora 9 : thunderbird-2.0.0.18-1.fc9 (2008-9859)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2008-206.NASL
description	A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.17 (CVE-2008-0016, CVE-2008-3835, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068, CVE-2008-4070). This update provides the latest Thunderbird to correct these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	37308
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/37308
title	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:206)

Oval

accepted

2013-04-29T04:17:56.690-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 3
oval oval:org.mitre.oval:def:11782
comment CentOS Linux 3.x
oval oval:org.mitre.oval:def:16651
comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990
comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

#56325ascript" sequence, aka "HTML escaped low surrogates bug."

family

unix

oval:org.mitre.oval:def:8880

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "javascript" sequence, aka "HTML escaped low surrogates bug."

version

Redhat

advisories

rhsa
id RHSA-2008:0882
rhsa
id RHSA-2008:0908

rpms

devhelp-0:0.10-0.10.el4
devhelp-debuginfo-0:0.10-0.10.el4
devhelp-devel-0:0.10-0.10.el4
seamonkey-0:1.0.9-0.20.el2
seamonkey-0:1.0.9-0.24.el3
seamonkey-0:1.0.9-26.el4
seamonkey-chat-0:1.0.9-0.20.el2
seamonkey-chat-0:1.0.9-0.24.el3
seamonkey-chat-0:1.0.9-26.el4
seamonkey-debuginfo-0:1.0.9-0.24.el3
seamonkey-debuginfo-0:1.0.9-26.el4
seamonkey-devel-0:1.0.9-0.20.el2
seamonkey-devel-0:1.0.9-0.24.el3
seamonkey-devel-0:1.0.9-26.el4
seamonkey-dom-inspector-0:1.0.9-0.20.el2
seamonkey-dom-inspector-0:1.0.9-0.24.el3
seamonkey-dom-inspector-0:1.0.9-26.el4
seamonkey-js-debugger-0:1.0.9-0.20.el2
seamonkey-js-debugger-0:1.0.9-0.24.el3
seamonkey-js-debugger-0:1.0.9-26.el4
seamonkey-mail-0:1.0.9-0.20.el2
seamonkey-mail-0:1.0.9-0.24.el3
seamonkey-mail-0:1.0.9-26.el4
seamonkey-nspr-0:1.0.9-0.20.el2
seamonkey-nspr-0:1.0.9-0.24.el3
seamonkey-nspr-devel-0:1.0.9-0.20.el2
seamonkey-nspr-devel-0:1.0.9-0.24.el3
seamonkey-nss-0:1.0.9-0.20.el2
seamonkey-nss-0:1.0.9-0.24.el3
seamonkey-nss-devel-0:1.0.9-0.20.el2
seamonkey-nss-devel-0:1.0.9-0.24.el3
thunderbird-0:1.5.0.12-16.el4
thunderbird-0:2.0.0.17-1.el5
thunderbird-debuginfo-0:1.5.0.12-16.el4
thunderbird-debuginfo-0:2.0.0.17-1.el5

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 31346 CVE ID: CVE-2008-3837 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4063 CVE-2008-4064 CVE-2008-4065 CVE-2008-4066 CVE-2008-4067 CVE-2008-4068 CVE-2008-4069 CVE-2008-3836 CVE-2008-3835 CVE-2008-0016 CNCVE ID：CNCVE-20083837 CNCVE-20084058 CNCVE-20084059 CNCVE-20084060 CNCVE-20084061 CNCVE-20084062 CNCVE-20084063 CNCVE-20084064 CNCVE-20084065 CNCVE-20084066 CNCVE-20084067 CNCVE-20084068 CNCVE-20084069 CNCVE-20083836 CNCVE-20083835 CNCVE-20080016 Mozilla Firefox/SeaMonkey/Thunderbird是开放源代码的浏览器和邮件新闻组客户端产品套件。 Mozilla Firefox/SeaMonkey/Thunderbird存在多个问题，远程攻击者可以利用漏洞进行任意代码执行，获得敏感信息，拒绝服务，跨域执行脚本等攻击。 -IBM X-Force的Justin Schuh和Tom Cross及IBM Watson Labs的Peter Williams报告Mozilla URL解析函数中存在错误，这些错误可通过超级链接中使用特殊构建的UTF-8 URL来触发，导致缓冲区溢出任意代码执行。 -Mozilla security researcher moz_bug_r_a4报告nsXMLDocument::OnChannelRedirect()中的同域检查可被绕过，导致脚本在其他WEB站点上执行。 -Mozilla security researcher moz_bug_r_a4包含feedWriter存在一系列漏洞，允许页面内容中的脚本以chrome特权执行。 -Mozilla security researcher moz_bug_r_a4包含一些漏洞，如页面内容可破坏XPCNativeWrappers，及以chrome特权执行任意代码。其中一个变种问题只影响Firefox 2。 -Mozilla developer Olli Pettay报告XSLT可建立不包含脚本处理对象的文档。moz_bug_r_a4报告document.loadBindingDocument()可返回不包含脚本处理对象的文档。这些问题也可用于以chrome特权执行任意脚本。 -Mozilla developers包含Firefox和其他Mozilla产品的浏览器引擎存在问题，在部分条件下可导致内存破坏或任意代码执行。 pple Product Security的Drew Yao报告Mozilla图像渲染代码存在两个崩溃问题，此漏洞只影响Firefox 3。 Fortinet's FortiGuard Global Security Research Team的David Maciejak也报告影响Firefox 3的图像渲染代码可导致应用程序崩溃。 -Microsoft developer Dave Reed报告部分BOM字符从Javascript代码剥离前可执行，这可导致攻击者绕过脚本过滤器执行XSS攻击。 Security researcher Gareth Heyes报告HTML解析器存在问题，可导致绕过脚本过滤器执行XSS攻击。 -Mozilla developer Boris Zbarsky报告当使用URL编码斜杠时，resource:协议允许在Linux平台上触发目录遍历攻击。 Mozilla developer Georgi Guninski报告在本地HTML文件上的限制可使用resource:协议绕过，此漏洞可导致攻击者读取系统上的信息。 -Security researcher Billy Hoffman在XBM解码上发现一个缺陷，允许随机小的未初始化块内存被读取，此漏洞没有导致内存破坏。 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux AS 4 RedHat Enterprise Linux AS 3 RedHat Enterprise Linux AS 2.1 RedHat Enterprise Linux 5 server RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 Mozilla Thunderbird 2.0 8 Mozilla Thunderbird 2.0 16 Mozilla Thunderbird 2.0 15 Mozilla Thunderbird 2.0 .9 Mozilla Thunderbird 2.0 .6 Mozilla Thunderbird 2.0 .5 Mozilla Thunderbird 2.0 .4 Mozilla Thunderbird 2.0 .14 Mozilla Thunderbird 2.0 .13 Mozilla Thunderbird 2.0 .12 Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey 1.1.2 Mozilla SeaMonkey 1.1.1 Mozilla SeaMonkey 1.0.99 Mozilla SeaMonkey 1.0.9 Mozilla SeaMonkey 1.0.8 Mozilla SeaMonkey 1.0.7 Mozilla SeaMonkey 1.0.6 Mozilla SeaMonkey 1.0.5 Mozilla SeaMonkey 1.0.3 Mozilla SeaMonkey 1.0.2 Mozilla SeaMonkey 1.0.1 Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey 1.0 dev Mozilla SeaMonkey 1.0 Mozilla Firefox 3.0.1 Mozilla Firefox 2.0 8 Mozilla Firefox 2.0 16 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .7 Mozilla Firefox 2.0 .6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .10 Mozilla Firefox 2.0 .1 Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3.0 Mozilla Firefox 2.0.0.3 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.13 Mozilla Firefox 2.0.0.12 Mozilla Firefox 2.0.0.11 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 可参考如下升级程序： Mozilla Firefox 3.0 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_powerpc.deb Mozilla Firefox 2.0.0.14 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_sparc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.13 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 RC2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 sparc Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_sparc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_sparc.deb Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a> Ubuntu Ubuntu Linux 7.04 i386 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_i386.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.15 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu firefox-dbg_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox-libthai_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnspr4_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss-dev_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu libnss3_1.firefox2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x2.0.0.17+0nobinonly-0ubuntu0.7.4_amd64.deb Ubuntu mozilla-firefox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dom-inspector_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-gnome-support_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Ubuntu mozilla-firefox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox_2.0.0.17+0nobinonly-0ubuntu0.7.4_all.deb Mozilla Firefox 2.0.0.10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_powerpc.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Mozilla Firefox 2.0.0.12 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.11 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0.0.2 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Ubuntu Ubuntu Linux 7.10 lpia Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dbg_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-dev_2.0.0.17+1nobi</a> nonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0. target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-gnome-support_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1 target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox-libthai_2.0.0.17+1</a> nobinonly-0ubuntu0.7.10_lpia.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_lpia.deb <a href=http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl target=_blank>http://ports.ubuntu.com/pool/main/f/firefox/firefox_2.0.0.17+1nobinonl</a> y-0ubuntu0.7.10_lpia.deb Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_i386.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 i386 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_i386.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_i386.deb Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.</a> dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg</a> +1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.fi</a> refox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firef</a> ox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.fir</a> efox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefo</a> x1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_amd64.deb Ubuntu mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-fire</a> fox-dev_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_</a> 1.5.dfsg+1.5.0.15~prepatch080614e-0ubuntu3_all.deb Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu firefox-dbg_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dev_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0. target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_2.0.</a> 0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-dom-inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb <a href=http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom- target=_blank>http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-</a> inspector_2.0.0.17+1nobinonly-0ubuntu0.7.10_all.deb Ubuntu firefox-gnome-support_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-su</a> pport_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox-libthai_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_ target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-libthai_</a> 2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb Ubuntu firefox_2.0.0.17+1nobinonly-0ubuntu0.7.10_amd64.deb <a href=http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17 target=_blank>http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_2.0.0.17</a> +1nobinonly-0ubuntu0.7.10_amd64.deb Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey Download <a href=http://www.seamonkey-project.org/releases/ target=_blank>http://www.seamonkey-project.org/releases/</a> Mozilla Firefox 2.0 .6 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .1 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 16 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .9 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .5 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 8 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .7 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .10 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 2.0 .3 Mozilla Firefox 2 Download <a href=http://www.mozilla.com/en-US/firefox/all-older.html target=_blank>http://www.mozilla.com/en-US/firefox/all-older.html</a> Mozilla Firefox 3.0.1 Mozilla Firefox 3 Download <a href=http://www.mozilla.com/en-US/firefox/all.html target=_blank>http://www.mozilla.com/en-US/firefox/all.html</a>
id	SSV:4101
last seen	2017-11-19
modified	2008-09-25
published	2008-09-25
reporter	Root
title	Mozilla Firefox/SeaMonkey/Thunderbird多个远程漏洞

Vulnerabilities > CVE-2008-4066 - Cross-Site Scripting vulnerability in Mozilla Firefox 2.0.0.14/2.0.0.15/2.0.0.16

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Oval

Redhat

Seebug

Related news

References