Vulnerabilities > CVE-2010-3131 - Unspecified vulnerability in Mozilla Firefox, Seamonkey and Thunderbird

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
mozilla
critical
nessus
exploit available

Summary

Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file. Per: http://cwe.mitre.org/data/definitions/426.html CWE-426 - 'Untrusted Search Path Vulnerability'

Vulnerable Configurations

Part Description Count
Application
Mozilla
266

Exploit-Db

  • descriptionFirefox <= 3.6.8 DLL Hijacking Exploit (dwmapi.dll). CVE-2010-3131. Local exploit for windows platform
    fileexploits/windows/local/14730.c
    idEDB-ID:14730
    last seen2016-02-01
    modified2010-08-24
    platformwindows
    port
    published2010-08-24
    reporterGlafkos Charalambous
    sourcehttps://www.exploit-db.com/download/14730/
    titleFirefox <= 3.6.8 DLL Hijacking Exploit dwmapi.dll
    typelocal
  • descriptionMozilla Thunderbird DLL Hijacking Exploit ( dwmapi.dll ). CVE-2010-3131. Local exploit for windows platform
    fileexploits/windows/local/14783.c
    idEDB-ID:14783
    last seen2016-02-01
    modified2010-08-25
    platformwindows
    port
    published2010-08-25
    reporterh4ck3r#47
    sourcehttps://www.exploit-db.com/download/14783/
    titleMozilla Thunderbird DLL Hijacking Exploit dwmapi.dll
    typelocal

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_SEAMONKEY-100917.NASL
    descriptionMozilla SeaMonkey 2.0 was updated to version 2.0.8, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49280
    published2010-09-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/49280
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2010:0632-2)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update seamonkey-3138.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(49280);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/25 13:36:38");
    
      script_cve_id("CVE-2010-2753", "CVE-2010-2760", "CVE-2010-2762", "CVE-2010-2763", "CVE-2010-2764", "CVE-2010-2765", "CVE-2010-2766", "CVE-2010-2767", "CVE-2010-2768", "CVE-2010-2769", "CVE-2010-2770", "CVE-2010-3131", "CVE-2010-3166", "CVE-2010-3167", "CVE-2010-3168", "CVE-2010-3169");
    
      script_name(english:"openSUSE Security Update : seamonkey (openSUSE-SU-2010:0632-2)");
      script_summary(english:"Check for the seamonkey-3138 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla SeaMonkey 2.0 was updated to version 2.0.8, fixing various
    bugs and security issues.
    
    Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169:
    Mozilla developers identified and fixed several memory safety bugs in
    the browser engine used in Firefox and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption under certain
    circumstances, and we presume that with enough effort at least some of
    these could be exploited to run arbitrary code.
    
    MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of
    Matasano Security reported that the implementation of the HTML
    frameset element contained an integer overflow vulnerability. The code
    responsible for parsing the frameset columns used an 8-byte counter
    for the column numbers, so when a very large number of columns was
    passed in the counter would overflow. When this counter was
    subsequently used to allocate memory for the frameset, the memory
    buffer would be too small, potentially resulting in a heap buffer
    overflow and execution of attacker-controlled memory.
    
    MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov
    reported a dangling pointer vulnerability in the implementation of
    navigator.plugins in which the navigator object could retain a pointer
    to the plugins array even after it had been destroyed. An attacker
    could potentially use this issue to crash the browser and run
    arbitrary code on a victim's computer.
    
    MFSA 2010-52 / CVE-2010-3131: Security researcher Haifei Li of
    FortiGuard Labs reported that Firefox could be used to load a
    malicious code library that had been planted on a victim's computer.
    Firefox attempts to load dwmapi.dll upon startup as part of its
    platform detection, so on systems that don't have this library, such
    as Windows XP, Firefox will subsequently attempt to load the library
    from the current working directory. An attacker could use this
    vulnerability to trick a user into downloading a HTML file and a
    malicious copy of dwmapi.dll into the same directory on their computer
    and opening the HTML file with Firefox, thus causing the malicious
    code to be executed. If the attacker was on the same network as the
    victim, the malicious DLL could also be loaded via a UNC path. The
    attack also requires that Firefox not currently be running when it is
    asked to open the HTML file and accompanying DLL.
    
    As this is a Windows only problem, it does not affect the Linux
    version. It is listed for completeness only.
    
    MFSA 2010-53 / CVE-2010-3166: Security researcher wushi of team509
    reported a heap buffer overflow in code routines responsible for
    transforming text runs. A page could be constructed with a
    bidirectional text run which upon reflow could result in an incorrect
    length being calculated for the run of text. When this value is
    subsequently used to allocate memory for the text too small a buffer
    may be created potentially resulting in a buffer overflow and the
    execution of attacker controlled memory.
    
    MFSA 2010-54 / CVE-2010-2760: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that there was a remaining
    dangling pointer issue leftover from the fix to CVE-2010-2753. Under
    certain circumstances one of the pointers held by a XUL tree selection
    could be freed and then later reused, potentially resulting in the
    execution of attacker-controlled memory.
    
    MFSA 2010-55 / CVE-2010-3168: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that XUL <tree> objects could
    be manipulated such that the setting of certain properties on the
    object would trigger the removal of the tree from the DOM and cause
    certain sections of deleted memory to be accessed. In products based
    on Gecko version 1.9.2 (Firefox 3.6, Thunderbird 3.1) and newer this
    memory has been overwritten by a value that will cause an
    unexploitable crash. In products based on Gecko version 1.9.1 (Firefox
    3.5, Thunderbird 3.0, and SeaMonkey 2.0) and older an attacker could
    potentially use this vulnerability to crash a victim's browser and run
    arbitrary code on their computer.
    
    MFSA 2010-56 / CVE-2010-3167: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that the implementation of XUL
    <tree>'s content view contains a dangling pointer vulnerability. One
    of the content view's methods for accessing the internal structure of
    the tree could be manipulated into removing a node prior to accessing
    it, resulting in the accessing of deleted memory. If an attacker can
    control the contents of the deleted memory prior to its access they
    could use this vulnerability to run arbitrary code on a victim's
    machine.
    
    MFSA 2010-57 / CVE-2010-2766: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that code used to normalize a
    document contained a logical flaw that could be leveraged to run
    arbitrary code. When the normalization code ran, a static count of the
    document's child nodes was used in the traversal, so a page could be
    constructed that would remove DOM nodes during this normalization
    which could lead to the accessing of a deleted object and potentially
    the execution of attacker-controlled memory.
    
    MFSA 2010-58 / CVE-2010-2770: Security researcher Marc Schoenefeld
    reported that a specially crafted font could be applied to a document
    and cause a crash on Mac systems. The crash showed signs of memory
    corruption and presumably could be used by an attacker to execute
    arbitrary code on a victim's computer.
    
    This issue probably does not affect the Linux builds and so is listed
    for completeness.
    
    MFSA 2010-59 / CVE-2010-2762: Mozilla developer Blake Kaplan reported
    that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security
    wrapper that allows content-defined objects to be safely accessed by
    privileged code, creates scope chains ending in outer objects. Users
    of SJOWs which expect the scope chain to end on an inner object may be
    handed a chrome privileged object which could be leveraged to run
    arbitrary JavaScript with chrome privileges.
    
    Michal Zalewski's recent contributions helped to identify this
    architectural weakness.
    
    MFSA 2010-60 / CVE-2010-2763: Mozilla security researcher moz_bug_r_a4
    reported that the wrapper class XPCSafeJSObjectWrapper (SJOW) on the
    Mozilla 1.9.1 development branch has a logical error in its scripted
    function implementation that allows the caller to run the function
    within the context of another site. This is a violation of the
    same-origin policy and could be used to mount an XSS attack.
    
    MFSA 2010-61 / CVE-2010-2768: Security researchers David Huang and
    Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley
    campus) reported that the type attribute of an <object> tag can
    override the charset of a framed HTML document, even when the document
    is included across origins. A page could be constructed containing
    such an <object> tag which sets the charset of the framed document to
    UTF-7. This could potentially allow an attacker to inject UTF-7
    encoded JavaScript into a site, bypassing the site's XSS filters, and
    then executing the code using the above technique.
    
    MFSA 2010-62 / CVE-2010-2769: Security researcher Paul Stone reported
    that when an HTML selection containing JavaScript is copy-and-pasted
    or dropped onto a document with designMode enabled the JavaScript will
    be executed within the context of the site where the code was dropped.
    A malicious site could leverage this issue in an XSS attack by
    persuading a user into taking such an action and in the process
    running malicious JavaScript within the context of another site.
    
    MFSA 2010-63 / CVE-2010-2764: Matt Haggard reported that the
    statusText property of an XMLHttpRequest object is readable by the
    requestor even when the request is made across origins. This status
    information reveals the presence of a web server and could be used to
    gather information about servers on internal private networks.
    
    This issue was also independently reported to Mozilla by Nicholas
    Berthaume"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=637303"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2010-09/msg00032.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected seamonkey packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-venkman");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/09/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"seamonkey-2.0.8-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"seamonkey-dom-inspector-2.0.8-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"seamonkey-irc-2.0.8-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"seamonkey-venkman-2.0.8-0.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "seamonkey");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_MOZILLA-XULRUNNER191-100917.NASL
    descriptionMozilla XULRunner 1.9.1 was updated to version 1.9.1.13, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49945
    published2010-10-12
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49945
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3141)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update mozilla-xulrunner191-3141.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(49945);
      script_version("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:38");
    
      script_cve_id("CVE-2010-2753", "CVE-2010-2760", "CVE-2010-2762", "CVE-2010-2763", "CVE-2010-2764", "CVE-2010-2765", "CVE-2010-2766", "CVE-2010-2767", "CVE-2010-2768", "CVE-2010-2769", "CVE-2010-2770", "CVE-2010-3131", "CVE-2010-3166", "CVE-2010-3167", "CVE-2010-3168", "CVE-2010-3169");
    
      script_name(english:"openSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3141)");
      script_summary(english:"Check for the mozilla-xulrunner191-3141 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla XULRunner 1.9.1 was updated to version 1.9.1.13, fixing
    various bugs and security issues.
    
    Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169:
    Mozilla developers identified and fixed several memory safety bugs in
    the browser engine used in Firefox and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption under certain
    circumstances, and we presume that with enough effort at least some of
    these could be exploited to run arbitrary code.
    
    MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of
    Matasano Security reported that the implementation of the HTML
    frameset element contained an integer overflow vulnerability. The code
    responsible for parsing the frameset columns used an 8-byte counter
    for the column numbers, so when a very large number of columns was
    passed in the counter would overflow. When this counter was
    subsequently used to allocate memory for the frameset, the memory
    buffer would be too small, potentially resulting in a heap buffer
    overflow and execution of attacker-controlled memory.
    
    MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov
    reported a dangling pointer vulnerability in the implementation of
    navigator.plugins in which the navigator object could retain a pointer
    to the plugins array even after it had been destroyed. An attacker
    could potentially use this issue to crash the browser and run
    arbitrary code on a victim's computer.
    
    MFSA 2010-52 / CVE-2010-3131: Security researcher Haifei Li of
    FortiGuard Labs reported that Firefox could be used to load a
    malicious code library that had been planted on a victim's computer.
    Firefox attempts to load dwmapi.dll upon startup as part of its
    platform detection, so on systems that don't have this library, such
    as Windows XP, Firefox will subsequently attempt to load the library
    from the current working directory. An attacker could use this
    vulnerability to trick a user into downloading a HTML file and a
    malicious copy of dwmapi.dll into the same directory on their computer
    and opening the HTML file with Firefox, thus causing the malicious
    code to be executed. If the attacker was on the same network as the
    victim, the malicious DLL could also be loaded via a UNC path. The
    attack also requires that Firefox not currently be running when it is
    asked to open the HTML file and accompanying DLL.
    
    As this is a Windows only problem, it does not affect the Linux
    version. It is listed for completeness only.
    
    MFSA 2010-53 / CVE-2010-3166: Security researcher wushi of team509
    reported a heap buffer overflow in code routines responsible for
    transforming text runs. A page could be constructed with a
    bidirectional text run which upon reflow could result in an incorrect
    length being calculated for the run of text. When this value is
    subsequently used to allocate memory for the text too small a buffer
    may be created potentially resulting in a buffer overflow and the
    execution of attacker controlled memory.
    
    MFSA 2010-54 / CVE-2010-2760: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that there was a remaining
    dangling pointer issue leftover from the fix to CVE-2010-2753. Under
    certain circumstances one of the pointers held by a XUL tree selection
    could be freed and then later reused, potentially resulting in the
    execution of attacker-controlled memory.
    
    MFSA 2010-55 / CVE-2010-3168: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that XUL <tree> objects could
    be manipulated such that the setting of certain properties on the
    object would trigger the removal of the tree from the DOM and cause
    certain sections of deleted memory to be accessed. In products based
    on Gecko version 1.9.2 (Firefox 3.6, Thunderbird 3.1) and newer this
    memory has been overwritten by a value that will cause an
    unexploitable crash. In products based on Gecko version 1.9.1 (Firefox
    3.5, Thunderbird 3.0, and SeaMonkey 2.0) and older an attacker could
    potentially use this vulnerability to crash a victim's browser and run
    arbitrary code on their computer.
    
    MFSA 2010-56 / CVE-2010-3167: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that the implementation of XUL
    <tree>'s content view contains a dangling pointer vulnerability. One
    of the content view's methods for accessing the internal structure of
    the tree could be manipulated into removing a node prior to accessing
    it, resulting in the accessing of deleted memory. If an attacker can
    control the contents of the deleted memory prior to its access they
    could use this vulnerability to run arbitrary code on a victim's
    machine.
    
    MFSA 2010-57 / CVE-2010-2766: Security researcher regenrecht reported
    via TippingPoint's Zero Day Initiative that code used to normalize a
    document contained a logical flaw that could be leveraged to run
    arbitrary code. When the normalization code ran, a static count of the
    document's child nodes was used in the traversal, so a page could be
    constructed that would remove DOM nodes during this normalization
    which could lead to the accessing of a deleted object and potentially
    the execution of attacker-controlled memory.
    
    MFSA 2010-58 / CVE-2010-2770: Security researcher Marc Schoenefeld
    reported that a specially crafted font could be applied to a document
    and cause a crash on Mac systems. The crash showed signs of memory
    corruption and presumably could be used by an attacker to execute
    arbitrary code on a victim's computer.
    
    This issue probably does not affect the Linux builds and so is listed
    for completeness.
    
    MFSA 2010-59 / CVE-2010-2762: Mozilla developer Blake Kaplan reported
    that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security
    wrapper that allows content-defined objects to be safely accessed by
    privileged code, creates scope chains ending in outer objects. Users
    of SJOWs which expect the scope chain to end on an inner object may be
    handed a chrome privileged object which could be leveraged to run
    arbitrary JavaScript with chrome privileges.
    
    Michal Zalewski's recent contributions helped to identify this
    architectural weakness.
    
    MFSA 2010-60 / CVE-2010-2763: Mozilla security researcher moz_bug_r_a4
    reported that the wrapper class XPCSafeJSObjectWrapper (SJOW) on the
    Mozilla 1.9.1 development branch has a logical error in its scripted
    function implementation that allows the caller to run the function
    within the context of another site. This is a violation of the
    same-origin policy and could be used to mount an XSS attack.
    
    MFSA 2010-61 / CVE-2010-2768: Security researchers David Huang and
    Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley
    campus) reported that the type attribute of an <object> tag can
    override the charset of a framed HTML document, even when the document
    is included across origins. A page could be constructed containing
    such an <object> tag which sets the charset of the framed document to
    UTF-7. This could potentially allow an attacker to inject UTF-7
    encoded JavaScript into a site, bypassing the site's XSS filters, and
    then executing the code using the above technique.
    
    MFSA 2010-62 / CVE-2010-2769: Security researcher Paul Stone reported
    that when an HTML selection containing JavaScript is copy-and-pasted
    or dropped onto a document with designMode enabled the JavaScript will
    be executed within the context of the site where the code was dropped.
    A malicious site could leverage this issue in an XSS attack by
    persuading a user into taking such an action and in the process
    running malicious JavaScript within the context of another site.
    
    MFSA 2010-63 / CVE-2010-2764: Matt Haggard reported that the
    statusText property of an XMLHttpRequest object is readable by the
    requestor even when the request is made across origins. This status
    information reveals the presence of a web server and could be used to
    gather information about servers on internal private networks.
    
    This issue was also independently reported to Mozilla by Nicholas
    Berthaume"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=637303"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mozilla-xulrunner191 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-gnomevfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-gnomevfs-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-xulrunner191-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-xpcom191");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/09/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/12");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"mozilla-xulrunner191-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"mozilla-xulrunner191-devel-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"mozilla-xulrunner191-gnomevfs-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"mozilla-xulrunner191-translations-common-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"mozilla-xulrunner191-translations-other-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"python-xpcom191-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", cpu:"x86_64", reference:"mozilla-xulrunner191-32bit-1.9.1.13-0.3.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", cpu:"x86_64", reference:"mozilla-xulrunner191-gnomevfs-32bit-1.9.1.13-0.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mozilla-xulrunner191");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4A21CE2CBB1311DF8E32000F20797EDE.NASL
    descriptionThe Mozilla Project reports : MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12) MFSA 2010-50 Frameset integer overflow vulnerability MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array MFSA 2010-52 Windows XP DLL loading vulnerability MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection MFSA 2010-55 XUL tree removal crash and remote code execution MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView MFSA 2010-57 Crash and remote code execution in normalizeDocument MFSA 2010-58 Crash on Mac using fuzzed font in data: URL MFSA 2010-59 SJOW creates scope chains ending in outer object MFSA 2010-60 XSS using SJOW scripted function MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS MFSA 2010-63 Information leak via XMLHttpRequest statusText
    last seen2020-06-01
    modified2020-06-02
    plugin id49166
    published2010-09-09
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/49166
    titleFreeBSD : mozilla -- multiple vulnerabilities (4a21ce2c-bb13-11df-8e32-000f20797ede)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_307.NASL
    descriptionThe installed version of Thunderbird is earlier than 3.0.7. Such versions are potentially affected by the following security issues : - Multiple memory safety bugs could lead to memory corruption, potentially resulting in arbitrary code execution. (MFSA 2010-49) - An integer overflow vulnerability in HTML frameset element implementation could lead to arbitrary code execution. (MFSA 2010-50) - A dangling pointer vulnerability in
    last seen2020-06-01
    modified2020-06-02
    plugin id49147
    published2010-09-08
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49147
    titleMozilla Thunderbird < 3.0.7 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_MOZILLAFIREFOX-100921.NASL
    descriptionMozilla Firefox 3.6 was updated to version 3.6.10, fixing various bugs and security issues. The following security issues were fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2010-49 / CVE-2010-3169) - Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. (MFSA 2010-50 / CVE-2010-2765) - Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50875
    published2010-12-02
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50875
    titleSuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 3159 / 3160)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_MOZILLA-XULRUNNER191-101028.NASL
    descriptionThis update brings Mozilla XULRunner to version 1.9.1.15, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50462
    published2010-11-03
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50462
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3421)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_MOZILLA-XULRUNNER191-101028.NASL
    descriptionThis update brings Mozilla XULRunner to version 1.9.1.15, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75671
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/75671
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3421)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_MOZILLA-XULRUNNER191-101028.NASL
    descriptionThis update brings Mozilla XULRunner to version 1.9.1.15, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50466
    published2010-11-03
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50466
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3421)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_SEAMONKEY-100917.NASL
    descriptionMozilla SeaMonkey 2.0 was updated to version 2.0.8, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49282
    published2010-09-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/49282
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2010:0632-2)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_SEAMONKEY-100917.NASL
    descriptionMozilla SeaMonkey 2.0 was updated to version 2.0.8, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75732
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75732
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2010:0632-2)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_313.NASL
    descriptionThe installed version of Thunderbird 3.1 is earlier than 3.1.3. Such versions are potentially affected by the following security issues : - Multiple memory safety bugs could lead to memory corruption, potentially resulting in arbitrary code execution. (MFSA 2010-49) - An integer overflow vulnerability in HTML frameset element implementation could lead to arbitrary code execution. (MFSA 2010-50) - A dangling pointer vulnerability in
    last seen2020-06-01
    modified2020-06-02
    plugin id49148
    published2010-09-08
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49148
    titleMozilla Thunderbird 3.1 < 3.1.3 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_MOZILLAFIREFOX-100916.NASL
    descriptionMozilla Firefox was updated to version 3.6.10, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49279
    published2010-09-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/49279
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0632-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_MOZILLATHUNDERBIRD-100916.NASL
    descriptionMozilla Thunderbird 3.0 was updated to version 3.0.7, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49944
    published2010-10-12
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49944
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3154)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_3512.NASL
    descriptionThe installed version of Firefox is earlier than 3.5.12. Such versions are potentially affected by the following security issues : - The pseudo-random number generator is only seeded once per browsing session and
    last seen2020-06-01
    modified2020-06-02
    plugin id49145
    published2010-09-08
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49145
    titleFirefox < 3.5.12 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idSEAMONKEY_207.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.0.7. Such versions are potentially affected by the following security issues : - Multiple memory safety bugs could lead to memory corruption, potentially resulting in arbitrary code execution. (MFSA 2010-49) - An integer overflow vulnerability in HTML frameset element implementation could lead to arbitrary code execution. (MFSA 2010-50) - A dangling pointer vulnerability in
    last seen2020-06-01
    modified2020-06-02
    plugin id49149
    published2010-09-08
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49149
    titleSeaMonkey < 2.0.7 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_369.NASL
    descriptionThe installed version of Firefox 3.6 is earlier than 3.6.9. Such versions are potentially affected by the following security issues : - The pseudo-random number generator is only seeded once per browsing session and
    last seen2020-06-01
    modified2020-06-02
    plugin id49146
    published2010-09-08
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49146
    titleFirefox 3.6 < 3.6.9 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_MOZILLAFIREFOX-7208.NASL
    descriptionThis update brings Mozilla Firefox to version 3.5.15, fixing various bugs and security issues. The following security issues were fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2010-49 / CVE-2010-3169) - Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. (MFSA 2010-50 / CVE-2010-2765) - Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50488
    published2010-11-05
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/50488
    titleSuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7208)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_MOZILLA-XULRUNNER191-100917.NASL
    descriptionMozilla XULRunner 1.9.1 was updated to version 1.9.1.13, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75670
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/75670
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3141)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_MOZILLA-XULRUNNER191-101028.NASL
    descriptionThis update brings Mozilla XULRunner to version 1.9.1.14, fixing various bugs and security issues. The following security issues were fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2010-49 / CVE-2010-3169) - Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. (MFSA 2010-50 / CVE-2010-2765) - Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50951
    published2010-12-02
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50951
    titleSuSE 11 / 11.1 Security Update : Mozilla (SAT Patch Numbers 3417 / 3419)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_MOZILLA-XULRUNNER191-100917.NASL
    descriptionMozilla XULRunner 1.9.1 was updated to version 1.9.1.13, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49947
    published2010-10-12
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49947
    titleopenSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-3141)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_MOZILLATHUNDERBIRD-100916.NASL
    descriptionMozilla Thunderbird 3.0 was updated to version 3.0.7, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75659
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/75659
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3154)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_MOZILLATHUNDERBIRD-100917.NASL
    descriptionMozilla Thunderbird 3.0 was updated to version 3.0.7, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49946
    published2010-10-12
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49946
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3154)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_MOZILLATHUNDERBIRD-101021.NASL
    descriptionThis update brings Mozilla Thunderbird to version 3.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50366
    published2010-10-28
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50366
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3378)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_MOZILLATHUNDERBIRD-101022.NASL
    descriptionThis update brings Mozilla Thunderbird to version 3.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50372
    published2010-10-28
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50372
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3378)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_SEAMONKEY-101021.NASL
    descriptionThis update brings Mozilla SeaMonkey to version 2.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50371
    published2010-10-28
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50371
    titleopenSUSE Security Update : seamonkey (seamonkey-3372)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_MOZILLAFIREFOX-100916.NASL
    descriptionMozilla Firefox was updated to version 3.6.10, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id49281
    published2010-09-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/49281
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0632-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_MOZILLAFIREFOX-100916.NASL
    descriptionMozilla Firefox was updated to version 3.6.10, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75647
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75647
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0632-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_SEAMONKEY-101021.NASL
    descriptionThis update brings Mozilla SeaMonkey to version 2.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75733
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/75733
    titleopenSUSE Security Update : seamonkey (seamonkey-3372)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_MOZILLATHUNDERBIRD-101021.NASL
    descriptionThis update brings Mozilla Thunderbird to version 3.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id75660
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/75660
    titleopenSUSE Security Update : MozillaThunderbird (MozillaThunderbird-3378)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_SEAMONKEY-101021.NASL
    descriptionThis update brings Mozilla SeaMonkey to version 2.0.9, fixing various bugs and security issues. The following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id50376
    published2010-10-28
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/50376
    titleopenSUSE Security Update : seamonkey (seamonkey-3372)

Oval

accepted2014-10-06T04:00:34.368-04:00
classvulnerability
contributors
  • nameJ. Daniel Brown
    organizationDTCC
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
descriptionUntrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.
familywindows
idoval:org.mitre.oval:def:12143
statusaccepted
submitted2010-09-10T17:30:00.000-05:00
titleMozilla Multiple Products Path Subversion Arbitrary DLL Injection Code Execution
version39