Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved .url shortcut files. If a user were tricked into downloading a crafted .url file and a crafted HTML file, an attacker could steal information from the user's cache.
(CVE-2008-4582)

Georgi Guninski, Michal Zalewsk and Chris Evans discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker could obtain private information from data stored in the images, or discover information about software on the user's computer. This issue only affects Firefox 2. (CVE-2008-5012)

It was discovered that Firefox did not properly check if the Flash module was properly unloaded. By tricking a user into opening a crafted SWF file, an attacker could cause Firefox to crash and possibly execute arbitrary code with user privileges. This issue only affects Firefox 2. (CVE-2008-5013)

Jesse Ruderman discovered that Firefox did not properly guard locks on non-native objects. If a user were tricked into opening a malicious website, an attacker could cause a browser crash and possibly execute arbitrary code with user privileges. This issue only affects Firefox 2. (CVE-2008-5014)

Luke Bryan discovered that Firefox sometimes opened file URIs with chrome privileges. If a user saved malicious code locally, then opened the file in the same tab as a privileged document, an attacker could run arbitrary JavaScript code with chrome privileges. This issue only affects Firefox 3.0. (CVE-2008-5015)

Several problems were discovered in the browser, layout and JavaScript engines. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges.
(CVE-2008-5016, CVE-2008-5017, CVE-2008-5018)

David Bloom discovered that the same-origin check in Firefox could be bypassed by utilizing the session restore feature. An attacker could exploit this to run JavaScript in the context of another site or execute arbitrary JavaScript code with chrome privileges.
(CVE-2008-5019)

Justin Schuh discovered a flaw in Firefox's mime-type parsing. If a user were tricked into opening a malicious website, an attacker could send a crafted header in the HTTP index response, causing a browser crash and execute arbitrary code with user privileges. (CVE-2008-0017)

A flaw was discovered in Firefox's DOM constructing code. If a user were tricked into opening a malicious website, an attacker could cause the browser to crash and potentially execute arbitrary code with user privileges. (CVE-2008-5021)

It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker could execute JavaScript in the context of a different website. (CVE-2008-5022)

Collin Jackson discovered various flaws in Firefox when processing stylesheets which allowed JavaScript to be injected into signed JAR files. If a user were tricked into opening malicious web content, an attacker could execute arbitrary code with the privileges of the signed JAR or of a different website. (CVE-2008-5023)

Chris Evans discovered that Firefox did not properly parse E4X documents, leading to quote characters in the namespace not being properly escaped. (CVE-2008-5024).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Iceape an unbranded version of the SeaMonkey internet suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0016     Justin Schuh, Tom Cross and Peter Williams discovered a     buffer overflow in the parser for UTF-8 URLs, which may     lead to the execution of arbitrary code. (MFSA 2008-37)

  - CVE-2008-0304     It was discovered that a buffer overflow in MIME     decoding can lead to the execution of arbitrary code.
    (MFSA 2008-26)

  - CVE-2008-2785     It was discovered that missing boundary checks on a     reference counter for CSS objects can lead to the     execution of arbitrary code. (MFSA 2008-34)

  - CVE-2008-2798     Devon Hubbard, Jesse Ruderman and Martijn Wargers     discovered crashes in the layout engine, which might     allow the execution of arbitrary code. (MFSA 2008-21)

  - CVE-2008-2799     Igor Bukanov, Jesse Ruderman and Gary Kwong discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code. (MFSA 2008-21)

  - CVE-2008-2800     'moz_bug_r_a4' discovered several cross-site scripting     vulnerabilities. (MFSA 2008-22)

  - CVE-2008-2801     Collin Jackson and Adam Barth discovered that JavaScript     code could be executed in the context or signed JAR     archives. (MFSA 2008-23)

  - CVE-2008-2802     'moz_bug_r_a4' discovered that XUL documements can     escalate privileges by accessing the pre-compiled     'fastload' file. (MFSA 2008-24)

  - CVE-2008-2803     'moz_bug_r_a4' discovered that missing input sanitising     in the mozIJSSubScriptLoader.loadSubScript() function     could lead to the execution of arbitrary code. Iceape     itself is not affected, but some addons are. (MFSA     2008-25)

  - CVE-2008-2805     Claudio Santambrogio discovered that missing access     validation in DOM parsing allows malicious websites to     force the browser to upload local files to the server,     which could lead to information disclosure. (MFSA     2008-27)

  - CVE-2008-2807     Daniel Glazman discovered that a programming error in     the code for parsing .properties files could lead to     memory content being exposed to addons, which could lead     to information disclosure. (MFSA 2008-29)

  - CVE-2008-2808     Masahiro Yamada discovered that file URLs in directory     listings were insufficiently escaped. (MFSA 2008-30)

  - CVE-2008-2809     John G. Myers, Frank Benkstein and Nils Toedtmann     discovered that alternate names on self-signed     certificates were handled insufficiently, which could     lead to spoofings of secure connections. (MFSA 2008-31)

  - CVE-2008-2810     It was discovered that URL shortcut files could be used     to bypass the same-origin restrictions. This issue does     not affect current Iceape, but might occur with     additional extensions installed. (MFSA 2008-32)

  - CVE-2008-2811     Greg McManus discovered a crash in the block reflow     code, which might allow the execution of arbitrary code.
    (MFSA 2008-33)

  - CVE-2008-2933     Billy Rios discovered that passing an URL containing a     pipe symbol to Iceape can lead to Chrome privilege     escalation. (MFSA 2008-35)

  - CVE-2008-3835     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLDocument::OnChannelRedirect() could be bypassed.
    (MFSA 2008-38)

  - CVE-2008-3836     'moz_bug_r_a4' discovered that several vulnerabilities     in feedWriter could lead to Chrome privilege escalation.
    (MFSA 2008-39)

  - CVE-2008-3837     Paul Nickerson discovered that an attacker could move     windows during a mouse click, resulting in unwanted     action triggered by drag-and-drop. (MFSA 2008-40)

  - CVE-2008-4058     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4059     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4060     Olli Pettay and 'moz_bug_r_a4' discovered a Chrome     privilege escalation vulnerability in XSLT handling.
    (MFSA 2008-41)

  - CVE-2008-4061     Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4062     Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine     Labour discovered crashes in the JavaScript engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4065     Dave Reed discovered that some Unicode byte order marks     are stripped from JavaScript code before execution,     which can result in code being executed, which were     otherwise part of a quoted string. (MFSA 2008-43)

  - CVE-2008-4067     Boris Zbarsky discovered that resource: URLs allow     directory traversal when using URL-encoded slashes.
    (MFSA 2008-44)

  - CVE-2008-4068     Georgi Guninski discovered that resource: URLs could     bypass local access restrictions. (MFSA 2008-44)

  - CVE-2008-4069     Billy Hoffman discovered that the XBM decoder could     reveal uninitialised memory. (MFSA 2008-45)

  - CVE-2008-4070     It was discovered that a buffer overflow could be     triggered via a long header in a news article, which     could lead to arbitrary code execution. (MFSA 2008-46)

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions. (MFSA 2008-48)

  - CVE-2008-5013     It was discovered that insufficient checks in the Flash     plugin glue code could lead to arbitrary code execution.
    (MFSA 2008-49)

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution. (MFSA 2008-50)

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-0017     Justin Schuh discovered that a buffer overflow in     http-index-format parser could lead to arbitrary code     execution. (MFSA 2008-54)

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code. (MFSA     2008-55)

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed. (MFSA 2008-56)

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents. (MFSA 2008-58)

  - CVE-2008-4582     Liu Die Yu discovered an information leak through local     shortcut files. (MFSA 2008-59)

  - CVE-2008-5500     Jesse Ruderman discovered that the layout engine is     vulnerable to DoS attacks that might trigger memory     corruption and an integer overflow. (MFSA 2008-60)

  - CVE-2008-5503     Boris Zbarsky discovered that an information disclosure     attack could be performed via XBL bindings. (MFSA     2008-61)

  - CVE-2008-5506     Marius Schilder discovered that it is possible to obtain     sensible data via a XMLHttpRequest. (MFSA 2008-64)

  - CVE-2008-5507     Chris Evans discovered that it is possible to obtain     sensible data via a JavaScript URL. (MFSA 2008-65)

  - CVE-2008-5508     Chip Salzenberg discovered possible phishing attacks via     URLs with leading whitespaces or control characters.
    (MFSA 2008-66)

  - CVE-2008-5511     It was discovered that it is possible to perform     cross-site scripting attacks via an XBL binding to an     'unloaded document.' (MFSA 2008-68)

  - CVE-2008-5512     It was discovered that it is possible to run arbitrary     JavaScript with chrome privileges via unknown vectors.
    (MFSA 2008-68)

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0016     Justin Schuh, Tom Cross and Peter Williams discovered a     buffer overflow in the parser for UTF-8 URLs, which may     lead to the execution of arbitrary code. (MFSA 2008-37)

  - CVE-2008-1380     It was discovered that crashes in the JavaScript engine     could potentially lead to the execution of arbitrary     code. (MFSA 2008-20)

  - CVE-2008-3835     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLDocument::OnChannelRedirect() could be bypassed.
    (MFSA 2008-38)

  - CVE-2008-4058     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4059     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4060     Olli Pettay and 'moz_bug_r_a4' discovered a Chrome     privilege escalation vulnerability in XSLT handling.
    (MFSA 2008-41)

  - CVE-2008-4061     Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4062     Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine     Labour discovered crashes in the JavaScript engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4065     Dave Reed discovered that some Unicode byte order marks     are stripped from JavaScript code before execution,     which can result in code being executed, which were     otherwise part of a quoted string. (MFSA 2008-43)

  - CVE-2008-4067     It was discovered that a directory traversal allows     attackers to read arbitrary files via a certain     character. (MFSA 2008-44)

  - CVE-2008-4068     It was discovered that a directory traversal allows     attackers to bypass security restrictions and obtain     sensitive information. (MFSA 2008-44)

  - CVE-2008-4070     It was discovered that a buffer overflow could be     triggered via a long header in a news article, which     could lead to arbitrary code execution. (MFSA 2008-46)

  - CVE-2008-4582     Liu Die Yu and Boris Zbarsky discovered an information     leak through local shortcut files. (MFSA 2008-47, MFSA     2008-59)

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions. (MFSA 2008-48)

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution. (MFSA 2008-50)

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-5018     It was discovered that crashes in the JavaScript engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code. (MFSA     2008-55)

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed. (MFSA 2008-56)

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents. (MFSA 2008-58)

  - CVE-2008-5500     Jesse Ruderman discovered that the layout engine is     vulnerable to DoS attacks that might trigger memory     corruption and an integer overflow. (MFSA 2008-60)

  - CVE-2008-5503     Boris Zbarsky discovered that an information disclosure     attack could be performed via XBL bindings. (MFSA     2008-61)

  - CVE-2008-5506     Marius Schilder discovered that it is possible to obtain     sensible data via a XMLHttpRequest. (MFSA 2008-64)

  - CVE-2008-5507     Chris Evans discovered that it is possible to obtain     sensible data via a JavaScript URL. (MFSA 2008-65)

  - CVE-2008-5508     Chip Salzenberg discovered possible phishing attacks via     URLs with leading whitespaces or control characters.
    (MFSA 2008-66)

  - CVE-2008-5511     It was discovered that it is possible to perform     cross-site scripting attacks via an XBL binding to an     'unloaded document.' (MFSA 2008-68)

  - CVE-2008-5512     It was discovered that it is possible to run arbitrary     JavaScript with chrome privileges via unknown vectors.
    (MFSA 2008-68)

Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0017     Justin Schuh discovered that a buffer overflow in the     http-index-format parser could lead to arbitrary code     execution.

  - CVE-2008-4582     Liu Die Yu discovered an information leak through local     shortcut files.

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions.

  - CVE-2008-5013     It was discovered that insufficient checks in the Flash     plugin glue code could lead to arbitrary code execution.

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution.

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution.

  - CVE-2008-5018     It was discovered that crashes in the JavaScript engine     could lead to arbitrary code execution.

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code.

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed.

  - CVE-2008-5023     Collin Jackson discovered that the -moz-binding property     bypasses security checks on codebase principals.

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0016     Justin Schuh, Tom Cross and Peter Williams discovered a     buffer overflow in the parser for UTF-8 URLs, which may     lead to the execution of arbitrary code.

  - CVE-2008-3835     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLDocument::OnChannelRedirect() could by bypassed.

  - CVE-2008-3836     'moz_bug_r_a4' discovered that several vulnerabilities     in feedWriter could lead to Chrome privilege escalation.

  - CVE-2008-3837     Paul Nickerson discovered that an attacker could move     windows during a mouse click, resulting in unwanted     action triggered by drag-and-drop.

  - CVE-2008-4058     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers.

  - CVE-2008-4059     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers.

  - CVE-2008-4060     Olli Pettay and 'moz_bug_r_a4' discovered a Chrome     privilege escalation vulnerability in XSLT handling.

  - CVE-2008-4061     Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code.

  - CVE-2008-4062     Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine     Labour discovered crashes in the JavaScript engine,     which might allow the execution of arbitrary code.

  - CVE-2008-4065     Dave Reed discovered that some Unicode byte order marks     are stripped from JavaScript code before execution,     which can result in code being executed, which were     otherwise part of a quoted string.

  - CVE-2008-4066     Gareth Heyes discovered that some Unicode surrogate     characters are ignored by the HTML parser.

  - CVE-2008-4067     Boris Zbarsky discovered that resource: URls allow     directory traversal when using URL-encoded slashes.

  - CVE-2008-4068     Georgi Guninski discovered that resource: URLs could     bypass local access restrictions.

  - CVE-2008-4069     Billy Hoffman discovered that the XBM decoder could     reveal uninitialised memory.

  - CVE-2008-4582     Liu Die Yu discovered an information leak through local     shortcut files.

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions.

  - CVE-2008-5013     It was discovered that insufficient checks in the Flash     plugin glue code could lead to arbitrary code execution.

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution.

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution.

  - CVE-2008-5018     It was discovered that crashes in the JavaScript engine     could lead to arbitrary code execution.

  - CVE-2008-0017     Justin Schuh discovered that a buffer overflow in     http-index-format parser could lead to arbitrary code     execution.

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code.

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed.

  - CVE-2008-5023     Collin Jackson discovered that the -moz-binding property     bypasses security checks on codebase principals.

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents.

Updated firefox and xulrunner packages that fix various security issues are now available for Fedora Core 9. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-0017, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021) Several flaws were found in the way malformed content was processed. A website containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-5022, CVE-2008-5023, CVE-2008-5024) A flaw was found in the way Firefox opened 'file:' URIs. If a file: URI was loaded in the same tab as a chrome or privileged 'about:' page, the file: URI could execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-5015) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.4[1]. All firefox users and users of packages depending on xulrunner[2] should upgrade to these updated packages, which contain patches that correct these issues. [1] http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.4 [2] cairo-dock chmsee devhelp epiphany epiphany-extensions evolution-rss galeon gnome-python2-extras gnome- web-photo google-gadgets gtkmozembedmm kazehakase Miro mozvoikko mugshot ruby- gnome2 totem yelp Provides Python bindings for libgdl on PPC64. This update fixes a build break.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox and xulrunner packages that fix various security issues are now available for Fedora Core 8. This update has been rated as having critical security impact by the Fedora Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-0017, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021) Several flaws were found in the way malformed content was processed. A website containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-5022, CVE-2008-5023, CVE-2008-5024) A flaw was found in the way Firefox opened 'file:' URIs. If a file: URI was loaded in the same tab as a chrome or privileged 'about:' page, the file: URI could execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-5015) For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 2.0.0.18[1]. All firefox users and users of packages depending on firefox[2] should upgrade to these updated packages, which correct these issues. [1] http://www.mozilla.org/security/known- vulnerabilities/firefox20.html#firefox2.0.0.18 [2] blam cairo-dock chmsee devhelp epiphany epiphany-extensions evolution-rss galeon gnome-python2-extras gnome-web-photo kazehakase liferea Miro openvrml ruby-gnome2 yelp Provides Python bindings for libgdl on PPC64.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Foundation reports :

MFSA 2008-58 Parsing error in E4X default namespace

MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals

MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation

MFSA 2008-55 Crash and remote code execution in nsFrameManager

MFSA 2008-54 Buffer overflow in http-index-format parser

MFSA 2008-53 XSS and JavaScript privilege escalation via session restore

MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18)

MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome

MFSA 2008-50 Crash and remote code execution via __proto__ tampering

MFSA 2008-49 Arbitrary code execution via Flash Player dynamic module unloading

MFSA 2008-48 Image stealing via canvas and HTTP redirect

MFSA 2008-47 Information stealing via local shortcut files

MFSA 2008-46 Heap overflow when canceling newsgroup message

MFSA 2008-44 resource: traversal vulnerabilities

MFSA 2008-43 BOM characters stripped from JavaScript before execution

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution

MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 UTF-8 URL stack-based buffer overflow

The installed version of SeaMonkey is earlier than 1.1.13.  Such versions are potentially affected by the following security issues : 

  - Locally saved '.url' shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - 'file: ' URIs are given chrome privileges when opened in the same tab as a chrome page or privileged 'about: ' page, which could allow an attacker to run arbitrary JavaScript with chrome privileges. (MFSA 2008-51)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - The browser's session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. (MFSA 2008-53)
  - There is a buffer overflow that can be triggered by sending a specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - The '-moz-binding' CSS property can be used to bypass security checks that validate codebase principals. (MFSA 2008-57)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)

The installed version of Firefox 3.0 is earlier than 3.0.4.  Such versions are potentially affected by the following security issues : 

 - Locally saved '.url' shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - 'file: ' URIs are given chrome privileges when opened in the same tab as a chrome page or privileged 'about: ' page, which could allow an attacker to run arbitrary JavaScript with chrome privileges. (MFSA 2008-51)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - The browser's session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. (MFSA 2008-53)
  - There is a buffer overflow that can be triggered by sending a specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - The '-moz-binding' CSS property can be used to bypass security checks that validate codebase principals. (MFSA 2008-57)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)

The installed version of Firefox is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues : 

 - Locally saved '.url' shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)
  - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. (MFSA 2008-48)
  - Arbitrary code execution is possible via Flash Player dynamic module unloading. (MFSA 2008-49)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - The browser's session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. (MFSA 2008-53)
  - There is a buffer overflow that can be triggered by sending a specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - The '-moz-binding' CSS property can be used to bypass security checks that validate codebase principals. (MFSA 2008-57)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)

The installed version of SeaMonkey is earlier than 1.1.13.  Such versions are potentially affected by the following security issues :

  - Locally saved '.url' shortcut files can be used to read     information stored in the local cache. (MFSA 2008-47)

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - Arbitrary code execution is possible via Flash Player     dynamic module unloading. (MFSA 2008-49)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - There is a buffer overflow that can be triggered by     sending a specially crafted 200 header line in the HTTP     index response. (MFSA 2008-54)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - The '-moz-binding' CSS property can be used to bypass     security checks which validate codebase principals.
    (MFSA 2008-57)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

  - Scripts in a malicous mail message can access the     .document URI and .textContext. DOM properties.
    (MFSA 2008-59)

The installed version of Firefox 3.0 is earlier than 3.0.4.  Such versions are potentially affected by the following security issues :

  - Locally saved '.url' shortcut files can be used to read     information stored in the local cache. (MFSA 2008-47)

  - 'file:' URIs are given chrome privileges when opened in     the same tab as a chrome page or privileged 'about:'     page, which could allow an attacker to run arbitrary     JavaScript with chrome privileges. (MFSA 2008-51)

  - There are several stability bugs in the browser engine     that could lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - The browser's session restore feature can be used to     violate the same-origin policy and run JavaScript in     the context of another site. (MFSA 2008-53)

  - There is a buffer overflow that can be triggered by     sending a specially crafted 200 header line in the HTTP     index response. (MFSA 2008-54)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - The '-moz-binding' CSS property can be used to bypass     security checks which validate codebase principals.
    (MFSA 2008-57)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

The installed version of Firefox is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues :

  - Locally saved '.url' shortcut files can be used to read     information stored in the local cache. (MFSA 2008-47)

  - The canvas element can be used in conjunction with an     HTTP redirect to bypass same-origin restrictions and     gain access to the content in arbitrary images from     other domains. (MFSA 2008-48)

  - Arbitrary code execution is possible via Flash Player     dynamic module unloading. (MFSA 2008-49)

  - By tampering with the window.__proto__.__proto__ object,     one can cause the browser to place a lock on a non-     native object, leading to a crash and possible code     execution. (MFSA 2008-50)

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-52)

  - The browser's session restore feature can be used to     violate the same-origin policy and run JavaScript in     the context of another site. (MFSA 2008-53)

  - There is a buffer overflow that can be triggered by     sending a specially crafted 200 header line in the HTTP     index response. (MFSA 2008-54)

  - Crashes and remote code execution in nsFrameManager are     possible by modifying certain properties of a file     input element before it has finished initializing.
    (MFSA 2008-55)

  - The same-origin check in     'nsXMLHttpRequest::NotifyEventListeners()' can be     bypassed. (MFSA 2008-56)

  - The '-moz-binding' CSS property can be used to bypass     security checks which validate codebase principals.
    (MFSA 2008-57)

  - There is an error in the method used to parse the     default namespace in an E4X document caused by quote     characters in the namespace not being properly escaped.
    (MFSA 2008-58)

The installed version of Firefox 3.0 is earlier than 3.0.4.  Such versions are potentially affected by the following security issues : 

  - Locally saved '.url' shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - 'file: ' URIs are given chrome privileges when opened in the same tab as a chrome page or privileged 'about: ' page, which could allow an attacker to run arbitrary JavaScript with chrome privileges. (MFSA 2008-51)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - The browser's session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. (MFSA 2008-53)
  - There is a buffer overflow that can be triggered by sending a specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - The '-moz-binding' CSS property can be used to bypass security checks that validate codebase principals. (MFSA 2008-57)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)

The installed version of Firefox is earlier than 2.0.0.18.  Such versions are potentially affected by the following security issues : 

  - Locally saved '.url' shortcut files can be used to read information stored in the local cache. (MFSA 2008-47)
  - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from other domains. (MFSA 2008-48)
  - Arbitrary code execution is possible via Flash Player dynamic module unloading. (MFSA 2008-49)
  - By tampering with the window.__proto__.__proto__ object, one can cause the browser to place a lock on a non-native object, leading to a crash and possible code execution. (MFSA 2008-50)
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-52)
  - The browser's session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. (MFSA 2008-53)
  - There is a buffer overflow that can be triggered by sending a specially crafted 200 header line in the HTTP index response. (MFSA 2008-54)
  - Crashes and remote code execution in nsFrameManager are possible by modifying certain properties of a file input element before it has finished initializing. (MFSA 2008-55)
  - The same-origin check in 'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)
  - The '-moz-binding' CSS property can be used to bypass security checks that validate codebase principals. (MFSA 2008-57)
  - There is an error in the method used to parse the default namespace in an E4X document caused by quote characters in the namespace not being properly escaped. (MFSA 2008-58)

ID	Name	Product	Family	Severity
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
36711	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-667-1)	Nessus	Ubuntu Local Security Checks	critical
35314	Debian DSA-1697-1 : iceape - several vulnerabilities	Nessus	Debian Local Security Checks	critical
35313	Debian DSA-1696-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	critical
34950	Debian DSA-1671-1 : iceweasel - several vulnerabilities	Nessus	Debian Local Security Checks	critical
34938	Debian DSA-1669-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	critical
34778	Fedora 9 : Miro-1.2.7-2.fc9 / cairo-dock-1.6.3.1-1.fc9.1 / chmsee-1.0.1-6.fc9 / devhelp-0.19.1-6.fc9 / etc (2008-9669)	Nessus	Fedora Local Security Checks	critical
34777	Fedora 8 : Miro-1.2.7-2.fc8 / blam-1.8.3-19.fc8 / cairo-dock-1.6.3.1-1.fc8.1 / chmsee-1.0.0-5.31.fc8 / etc (2008-9667)	Nessus	Fedora Local Security Checks	critical
34771	FreeBSD : mozilla -- multiple vulnerabilities (f29fea8f-b19f-11dd-a55e-00163e000016)	Nessus	FreeBSD Local Security Checks	critical
4753	SeaMonkey < 1.1.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
4752	Mozilla Firefox 3.x < 3.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
4751	Mozilla Firefox < 2.0.0.18 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
34768	SeaMonkey < 1.1.13 Multiple Vulnerabilities	Nessus	Windows	high
34767	Firefox 3.0.x < 3.0.4 Multiple Vulnerabilities	Nessus	Windows	high
34766	Firefox < 2.0.0.18 Multiple Vulnerabilities	Nessus	Windows	high
800876	SeaMonkey < 1.1.13 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800751	Firefox 3.x < 3.0.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800741	Firefox < 2.0.0.18 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-4582

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

high

high

high

high

high

high