Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.

Numerous security fixes are available in Mozilla 1.0.1. For a detailed list, refer to the 'Recently fixed security issues' page on the Mozilla website (see the first reference). All users are encouraged to upgrade to this latest stable 1.0.x release of Mozilla.

The remote host is using the Netscape web browser, which contains a built-in IRC client. There is a flaw in this version that may allow an attacker to execute arbitrary code on this host, provided the user uses it to go on IRC.

The remote host is using the Mozilla web browser, which contains a built-in IRC client. There is a flaw in this version that may allow an attacker to execute arbitrary code on this host, provided the user uses it to go on IRC.

The remote host is using a version of the Galeon web browser that may allow a rogue web server to determine the existence of files on the side of the client.

The remote host is using a version of the Netscape web browser that may allow a rogue web server to determine the existence of files on the side of the client. 

Versions of Mozilla Firefox prior to 1.0rc2 may allow a rogue web server to determine the existence of files on the side of the client. 

The remote host is running a version of the Mozilla browser that is vulnerable to a buffer overflow. Specifically the browser will crash when handling an exceptionally long request (32kb+) for a channel. The vulnerability may be used to crash the browser and/or allow the execution of arbitrary code on the client host. 

The remote host is running a version of the Mozilla browser that has a problem in its implementation of the JavaScript "onUnload" event handler that has the potential to leak sensitive information to websites. When other pages are launched using the event handler, the vulnerable client encapsulates the address of the next page that is visited in the HTTP referer field. The correct behavior is to include the address of the previously visited page in the HTTP referer field. Using this handler, a webpage can cause the browser to link information about the next page that was visited.

The remote host is running a version of the Mozilla browser that could allow a remote attacker to detect the existence of files on the local file system of the web client accessing the attackers page. The vulnerability is caused by improper handling of embedded Cascading Style-Sheet (CSS) <LINK> elements in the broswer.

A buffer overflow vulnerability exists in nss_ldap versions prior to 198. When nss_ldap is configured without a value for the 'host' keyword, it attempts to configure itself using SRV records stored in DNS. nss_ldap does not check that the data returned by the DNS query will fit into an internal buffer, thus exposing it to an overflow.

A similar issue exists in versions of nss_ldap prior to 199 where nss_ldap does not check that the data returned by the DNS query has not been truncated by the resolver libraries to avoid a buffer overflow. This can make nss_ldap attempt to parse more data than what is actually available, making it vulnerable to a read buffer overflow.

Finally, a format string bug in the logging function of pam_ldap prior to version 144 exist.

All users are recommended to upgrade to these updated packages. Note that the nss_ldap packages for 7.2, 8.0, and Single Network Firewall 7.2 contain the pam_ldap modules.

Updated Mozilla packages are now available for Red Hat Linux Advanced Server. These new packages fix vulnerabilities in previous versions of Mozilla.

Mozilla is an open source Web browser. Versions of Mozilla prior to version 1.0.1 contain various security vulnerabilities. These vulnerabilities could be used by an attacker to read data off of the local hard drive, to gain information that should normally be kept private, and in some cases to execute arbitrary code. For more information on the specific vulnerabilities fixed please see the references below.

All users of Mozilla should update to these errata packages containing Mozilla version 1.0.1 which is not vulnerable to these issues.

ID	Name	Product	Family	Severity
61919	Mandrake Linux Security Advisory : mozilla (MDKSA-2002:074)	Nessus	Mandriva Local Security Checks	high
1752	Netscape < 6.2.3 IRC Client Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium
1751	Mozilla < 1.0rc2 IRC Client Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium
1750	Galeon < 1.2.2 Local File Detection	Nessus Network Monitor	Web Clients	medium
1749	Netscape < 6.2.3 Local File Detection	Nessus Network Monitor	Web Clients	medium
1748	Mozilla Firefox < 1.0rc2 Local File Detection	Nessus Network Monitor	Web Clients	medium
1327	Netscape/Mozilla/Galeon Long IRC Channel Name Overflow (deprecated)	Nessus Network Monitor	SMTP Clients	critical
1316	Mozilla OnUnload Referer Information Leakage Race Condition Information Disclosure (deprecated)	Nessus Network Monitor	SMTP Clients	low
1311	Netscape/Mozilla/Galeon Local File Enumeration (deprecated)	Nessus Network Monitor	SMTP Clients	low
13974	Mandrake Linux Security Advisory : nss_ldap (MDKSA-2002:075)	Nessus	Mandriva Local Security Checks	high
12361	RHEL 2.1 : mozilla (RHSA-2003:046)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2002-1126

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

critical

low

low

high

high