Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue, so it might not be a vulnerability.

An updated firefox package that fixes several security bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

A bug was found in the way Firefox processes XBM image files. If a user views a specially crafted XBM file, it becomes possible to execute arbitrary code as the user running Firefox. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2701 to this issue.

A bug was found in the way Firefox processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Firefox if the user views a specially crafted Unicode sequence. (CVE-2005-2702)

A bug was found in the way Firefox makes XMLHttp requests. It is possible that a malicious web page could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of the browser is to disallow this. (CVE-2005-2703)

A bug was found in the way Firefox implemented its XBL interface. It may be possible for a malicious web page to create an XBL binding in such a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Firefox 1.0.6 this issue is not directly exploitable and will need to leverage other unknown exploits.
(CVE-2005-2704)

An integer overflow bug was found in Firefox's JavaScript engine.
Under favorable conditions, it may be possible for a malicious web page to execute arbitrary code as the user running Firefox.
(CVE-2005-2705)

A bug was found in the way Firefox displays about: pages. It is possible for a malicious web page to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Firefox opens new windows. It is possible for a malicious website to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes.
(CVE-2005-2707)

A bug was found in the way Firefox processes URLs passed to it on the command line. If a user passes a malformed URL to Firefox, such as clicking on a link in an instant messaging program, it is possible to execute arbitrary commands as the user running Firefox.
(CVE-2005-2968)

Users of Firefox are advised to upgrade to this updated package that contains Firefox version 1.0.7 and is not vulnerable to these issues.

Updated mozilla packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla processes XBM image files. If a user views a specially crafted XBM file, it becomes possible to execute arbitrary code as the user running Mozilla. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2701 to this issue.

A bug was found in the way Mozilla processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Mozilla, if the user views a specially crafted Unicode sequence. (CVE-2005-2702)

A bug was found in the way Mozilla makes XMLHttp requests. It is possible that a malicious web page could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of the browser is to disallow this. (CVE-2005-2703)

A bug was found in the way Mozilla implemented its XBL interface. It may be possible for a malicious web page to create an XBL binding in a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Mozilla 1.7.10 this issue is not directly exploitable and would need to leverage other unknown exploits. (CVE-2005-2704)

An integer overflow bug was found in Mozilla's JavaScript engine.
Under favorable conditions, it may be possible for a malicious web page to execute arbitrary code as the user running Mozilla.
(CVE-2005-2705)

A bug was found in the way Mozilla displays about: pages. It is possible for a malicious web page to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Mozilla opens new windows. It is possible for a malicious website to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes.
(CVE-2005-2707)

Users of Mozilla are advised to upgrade to this updated package that contains Mozilla version 1.7.12 and is not vulnerable to these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:785 advisory.

    Mozilla Firefox is an open source Web browser.

    A bug was found in the way Firefox processes XBM image files. If a user     views a specially crafted XBM file, it becomes possible to execute     arbitrary code as the user running Firefox. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-2701 to     this issue.

    A bug was found in the way Firefox processes certain Unicode     sequences. It may be possible to execute arbitrary code as the user running     Firefox if the user views a specially crafted Unicode sequence. (CAN-2005-2702)

    A bug was found in the way Firefox makes XMLHttp requests. It is possible     that a malicious web page could leverage this flaw to exploit other proxy     or server flaws from the victim's machine. It is also possible that this     flaw could be leveraged to send XMLHttp requests to hosts other than the     originator; the default behavior of the browser is to disallow this.
    (CAN-2005-2703)

    A bug was found in the way Firefox implemented its XBL interface. It may be     possible for a malicious web page to create an XBL binding in such a way     that would allow arbitrary JavaScript execution with chrome permissions.
    Please note that in Firefox 1.0.6 this issue is not directly exploitable     and will need to leverage other unknown exploits. (CAN-2005-2704)

    An integer overflow bug was found in Firefox's JavaScript engine. Under     favorable conditions, it may be possible for a malicious web page to     execute arbitrary code as the user running Firefox. (CAN-2005-2705)

    A bug was found in the way Firefox displays about: pages. It is possible     for a malicious web page to open an about: page, such as about:mozilla, in     such a way that it becomes possible to execute JavaScript with chrome     privileges. (CAN-2005-2706)

    A bug was found in the way Firefox opens new windows. It is possible for a     malicious web site to construct a new window without any user interface     components, such as the address bar and the status bar. This window could     then be used to mislead the user for malicious purposes. (CAN-2005-2707)

    A bug was found in the way Firefox processes URLs passed to it on the     command line. If a user passes a malformed URL to Firefox, such as clicking     on a link in an instant messaging program, it is possible to execute     arbitrary commands as the user running Firefox. (CAN-2005-2968)

    Users of Firefox are advised to upgrade to this updated package that     contains Firefox version 1.0.7 and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Mozilla Firefox prior to 1.0.7 are known to contain various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host. 

Versions of Mozilla Firefox prior to 1.7.12 are affected by various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.

The remote host is using Firefox, an alternative web browser. 

The installed version of Firefox contains various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.

The remote host is using Netscape Browser / Netscape Navigator, an alternative web browser. 

The version of Netscape Browser / Netscape Navigator installed on the remote host is prone to multiple flaws, including one that may allow an attacker to execute arbitrary code on the affected system.

ID	Name	Product	Family	Severity
21963	CentOS 4 : firefox (CESA-2005:785)	Nessus	CentOS Local Security Checks	high
21859	CentOS 3 / 4 : Mozilla (CESA-2005:789)	Nessus	CentOS Local Security Checks	high
19837	RHEL 2.1 / 3 / 4 : mozilla (RHSA-2005:789)	Nessus	Red Hat Local Security Checks	high
19835	RHEL 4 : firefox (RHSA-2005:785)	Nessus	Red Hat Local Security Checks	critical
3239	Mozilla Firefox < 1.0.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
3238	Mozilla Firefox < 1.7.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
19719	Firefox < 1.0.7 Multiple Vulnerabilities	Nessus	Windows	high
19696	Netscape Browser < 8.0.4 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2005-3089

high

Tenable Plugins

high

high

high

critical

high

high

high

high