liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to "memory safety issues."

From Red Hat Security Advisory 2009:1673 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3979)

A flaw was found in the SeaMonkey NT Lan Manager (NTLM) authentication protocol implementation. If an attacker could trick a local user that has NTLM credentials into visiting a specially crafted web page, they could send arbitrary requests, authenticated with the user's NTLM credentials, to other applications on the user's system.
(CVE-2009-3983)

A flaw was found in the way SeaMonkey displayed the SSL location bar indicator. An attacker could create an unencrypted web page that appears to be encrypted, possibly tricking the user into believing they are visiting a secure page. (CVE-2009-3984)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The Mozilla Firefox was updated to version 3.5.6, fixing lots of bugs and various security issues.

The following issues were fixed :

  - Crashes with evidence of memory corruption (rv:1.9.1.6).
    (MFSA 2009-65 / CVE-2009-3979 / CVE-2009-3980 /     CVE-2009-3982)

  - (bmo#504843,bmo#523816) Memory safety fixes in     liboggplay media library. (MFSA 2009-66 / CVE-2009-3388)

  - (bmo#515882,bmo#504613) Integer overflow, crash in     libtheora video library. (MFSA 2009-67 / CVE-2009-3389)

  - (bmo#487872) NTLM reflection vulnerability. (MFSA     2009-68 / CVE-2009-3983)

  - (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities. (MFSA 2009-69 / CVE-2009-3984 /     CVE-2009-3985)

  - (bmo#522430) Privilege escalation via chrome     window.opener. (MFSA 2009-70 / CVE-2009-3986)

Security issues were identified and fixed in firefox 3.5.x :

liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to memory safety issues. (CVE-2009-3388)

Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a video with large dimensions (CVE-2009-3389).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3979).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3980).

Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3982).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user (CVE-2009-3983).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body (CVE-2009-3984).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654 (CVE-2009-3985).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property (CVE-2009-3986).

The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects (CVE-2009-3987).

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Mozilla Thunderbird was upgraded to version 3.0.3, fixing various bugs and security issues.

Following security issues have been fixed: MFSA 2010-01 / CVE-2010-0159: Mozilla developers identified and fixed several stability bugs in the browser  engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2010-03 / CVE-2009-1571: Security researcher Alin Rad Pop of Secunia Research reported that the HTML parser incorrectly freed used memory when insufficient space was available to process remaining input. Under such circumstances, memory occupied by in-use objects was freed and could later be filled with attacker-controlled text.
These conditions could result in the execution or arbitrary code if methods on the freed objects were subsequently called.

MFSA 2009-65 / CVE-2009-3979 / CVE-2009-3980 / CVE-2009-3982: Crashes with evidence of memory corruption were fixed. (rv:1.9.1.6)

MFSA 2009-66 / CVE-2009-3388 (bmo#504843,bmo#523816):
Memory safety fixes in liboggplay media library were added.

MFSA 2009-67 / CVE-2009-3389 (bmo#515882,bmo#504613): An Integer overflow, crash in libtheora video library was fixed.

Versions of Mozilla Thunderbird prior to 3.0.1 are affected by the following vulnerabilities :

 - Multiple crashes can result in arbitrary code execution. (MFSA 2009-65)
 - Multiple vulnerabilities in 'liboggplay' can lead to arbitrary code execution. (MFSA 2009-66)
 - An integer overflow in the 'Theora' video library can lead to a crash or the execution of arbitrary code. (MFSA 2009-67)

The installed version of Thunderbird is earlier than 3.0.1.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code     execution. (MFSA 2009-65)   
  - Multiple vulnerabilities in 'liboggplay' can lead to     arbitrary code execution. (MFSA 2009-66)   
  - An integer overflow in the 'Theora' video library can     lead to a crash or the execution of arbitrary code.
    (MFSA 2009-67)

USN-874-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream changes introduced a regression when using NTLM authentication. This update fixes the problem and adds additional stability fixes.

We apologize for the inconvenience.

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3979, CVE-2009-3980, CVE-2009-3982, CVE-2009-3986)

Takehiro Takahashi discovered flaws in the NTLM implementation in Firefox. If an NTLM authenticated user visited a malicious website, a remote attacker could send requests to other applications, authenticated as the user.
(CVE-2009-3983)

Jonathan Morgan discovered that Firefox did not properly display SSL indicators under certain circumstances. This could be used by an attacker to spoof an encrypted page, such as in a phishing attack. (CVE-2009-3984)

Jordi Chancel discovered that Firefox did not properly display invalid URLs for a blank page. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. (CVE-2009-3985)

David Keeler, Bob Clary, and Dan Kaminsky discovered several flaws in third party media libraries. If a user were tricked into opening a crafted media file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-3388, CVE-2009-3389).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla SeaMonkey browser suite was updated to version 2.0.1, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3981 Crashes with     evidence of memory corruption (1.9.0.16)

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

  - MFSA 2009-71/CVE-2009-3987: COM object enumeration only     affects Windows operating systems.

The Mozilla Firefox was updated to version 3.5.6, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3980/CVE-2009-3982     Crashes with evidence of memory corruption (rv:1.9.1.6)

  - MFSA 2009-66/CVE-2009-3388 (bmo#504843,bmo#523816)     Memory safety fixes in liboggplay media library

  - MFSA 2009-67/CVE-2009-3389 (bmo#515882,bmo#504613)     Integer overflow, crash in libtheora video library

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3979, CVE-2009-3980, CVE-2009-3982, CVE-2009-3986)

Takehiro Takahashi discovered flaws in the NTLM implementation in Firefox. If an NTLM authenticated user visited a malicious website, a remote attacker could send requests to other applications, authenticated as the user. (CVE-2009-3983)

Jonathan Morgan discovered that Firefox did not properly display SSL indicators under certain circumstances. This could be used by an attacker to spoof an encrypted page, such as in a phishing attack.
(CVE-2009-3984)

Jordi Chancel discovered that Firefox did not properly display invalid URLs for a blank page. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. (CVE-2009-3985)

David Keeler, Bob Clary, and Dan Kaminsky discovered several flaws in third party media libraries. If a user were tricked into opening a crafted media file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3388, CVE-2009-3389).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3979)

A flaw was found in the SeaMonkey NT Lan Manager (NTLM) authentication protocol implementation. If an attacker could trick a local user that has NTLM credentials into visiting a specially crafted web page, they could send arbitrary requests, authenticated with the user's NTLM credentials, to other applications on the user's system.
(CVE-2009-3983)

A flaw was found in the way SeaMonkey displayed the SSL location bar indicator. An attacker could create an unencrypted web page that appears to be encrypted, possibly tricking the user into believing they are visiting a secure page. (CVE-2009-3984)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Update to new upstream Firefox version 3.5.6, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox35.html#firefox3.5.6 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2009-3979 CVE-2009-3980 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986 CVE-2009-3388 CVE-2009-3389

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream SeaMonkey version 2.0.1, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.1 CVE-2009-3979 CVE-2009-3980 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986 CVE-2009-3388 CVE-2009-3389

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Project reports :

MFSA 2009-71 GeckoActiveXObject exception messages can be used to enumerate installed COM objects

MFSA 2009-70 Privilege escalation via chrome window.opener

MFSA 2009-69 Location bar spoofing vulnerabilities

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-67 Integer overflow, crash in libtheora video library

MFSA 2009-66 Memory safety fixes in liboggplay media library

MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/ 1.9.0.16)

The remote host is running a version of SeaMonkey earlier than 2.0.1.  Such versions are potentially affected by multiple vulnerabilities : 

  - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)

  - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)

  - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)

  - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)

The remote host is running a version of Mozilla Firefox earlier than 3.0.16 or 3.5.6.  Such versions are potentially affected by multiple vulnerabilities : 

 - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)
 - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)
 - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)
 - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)
 - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)
 - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)
 - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)



The installed version of SeaMonkey is earlier than 2.0.1.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code execution.     (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay' can lead to     arbitrary code execution. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library can     lead to a crash or the execution of arbitrary code.
    (MFSA 2009-67)

  - The NTLM implementation is vulnerable to reflection     attacks in which NTLM credentials from one application     can be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities exist.
    (MFSA 2009-69)

  - A content window which is opened by a chrome window     retains a reference to the chrome window via the     'window.opener' property, which can lead to privilege     escalation. (MFSA 2009-70)

  - The exception messages generated by the     'GeckoActiveXObject' differ based on whether or not the     requested COM object's ProgID is present in the system     registry. (MFSA 2009-71)

The installed version of Firefox is 3.5.x earlier than 3.5.6.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code     execution. (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay' can lead to     arbitrary code execution. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library can     lead to a crash or the execution of arbitrary code.     (MFSA 2009-67)

  - The NTLM implementation is vulnerable to reflection     attacks in which NTLM credentials from one application     can be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities exist.     (MFSA 2009-69)

  - A content window which is opened by a chrome window     retains a reference to the chrome window via the     'window.opener' property, which can lead to privilege     escalation. (MFSA 2009-70)

  - The exception messages generated by the     'GeckoActiveXObject' differ based on whether or not the     requested COM object's ProgID is present in the system     registry. (MFSA 2009-71)

ID	Name	Product	Family	Severity
67974	Oracle Linux 3 / 4 : seamonkey (ELSA-2009-1673)	Nessus	Oracle Linux Local Security Checks	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
49889	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6735)	Nessus	SuSE Local Security Checks	high
48162	Mandriva Linux Security Advisory : firefox (MDVSA-2009:338)	Nessus	Mandriva Local Security Checks	high
45034	SuSE 11.2 Security Update: MozillaThunderbird (2010-03-05)	Nessus	SuSE Local Security Checks	critical
5354	Mozilla Thunderbird < 3.0.1 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium
44111	Mozilla Thunderbird < 3.0.1 Multiple Vulnerabilities	Nessus	Windows	high
43824	Ubuntu 9.10 : firefox-3.5, xulrunner-1.9.1 regression (USN-878-1)	Nessus	Ubuntu Local Security Checks	high
43619	openSUSE Security Update : seamonkey (seamonkey-1738)	Nessus	SuSE Local Security Checks	high
43397	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6733)	Nessus	SuSE Local Security Checks	high
43386	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1709)	Nessus	SuSE Local Security Checks	high
43383	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1708)	Nessus	SuSE Local Security Checks	high
43367	Ubuntu 9.10 : firefox-3.5, xulrunner-1.9.1 vulnerabilities (USN-874-1)	Nessus	Ubuntu Local Security Checks	high
43355	CentOS 4 : seamonkey (CESA-2009:1673)	Nessus	CentOS Local Security Checks	high
43339	Fedora 12 : Miro-2.5.2-7.fc12 / blam-1.8.5-21.fc12 / firefox-3.5.6-1.fc12 / galeon-2.0.7-19.fc12 / etc (2009-13366)	Nessus	Fedora Local Security Checks	high
43336	Fedora 12 : seamonkey-2.0.1-1.fc12 (2009-13362)	Nessus	Fedora Local Security Checks	high
43334	Fedora 11 : Miro-2.5.2-7.fc11 / blam-1.8.5-17.fc11 / chmsee-1.0.1-14.fc11 / epiphany-2.26.3-7.fc11 / etc (2009-13333)	Nessus	Fedora Local Security Checks	high
43176	FreeBSD : mozilla -- multiple vulnerabilities (01c57d20-ea26-11de-bd39-00248c9b4be7)	Nessus	FreeBSD Local Security Checks	high
5265	SeaMonkey < 2.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
5264	Mozilla Firefox < 3.0.16 / 3.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
43175	SeaMonkey < 2.0.1 Multiple Vulnerabilities	Nessus	Windows	high
43174	Firefox 3.5 < 3.5.6 Multiple Vulnerabilities	Nessus	Windows	high
43170	RHEL 3 / 4 : seamonkey (RHSA-2009:1673)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2009-3388

high

Tenable Plugins

high

critical

high

high

critical

medium

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

high

high

high