Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

The remote Solaris system is missing necessary patches to address security updates :

  - Use-after-free vulnerability in Mozilla Firefox before     3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18     and 5.0 through 9.0, and SeaMonkey before 2.7 might     allow remote attackers to execute arbitrary code via     vectors related to incorrect AttributeChildRemoved     notifications that affect access to removed     nsDOMAttribute child nodes. (CVE-2011-3659)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 3.6.26 and 4.x through     9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and     SeaMonkey before 2.7 allow remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown     vectors. (CVE-2012-0442)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 4.x through 9.0, Thunderbird     5.0 through 9.0, and SeaMonkey before 2.7 allow remote     attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2012-0443)

  - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through     9.0, and SeaMonkey before 2.7 allow remote attackers to     bypass the HTML5 frame-navigation policy and replace     arbitrary sub-frames by creating a form submission     target with a sub-frame's name attribute.
    (CVE-2012-0445)

  - Multiple cross-site scripting (XSS) vulnerabilities in     Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through     9.0, and SeaMonkey before 2.7 allow remote attackers to     inject arbitrary web script or HTML via a (1) web page     or (2) Firefox extension, related to improper     enforcement of XPConnect security restrictions for frame     scripts that call untrusted objects. (CVE-2012-0446)

  - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through     9.0, and SeaMonkey before 2.7 do not properly initialize     data for image/vnd.microsoft.icon images, which allows     remote attackers to obtain potentially sensitive     information by reading a PNG image that was created     through conversion from an ICO image. (CVE-2012-0447)

  - Mozilla Firefox before 3.6.26 and 4.x through 9.0,     Thunderbird before 3.1.18 and 5.0 through 9.0, and     SeaMonkey before 2.7 allow remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly execute arbitrary code via a     malformed XSLT stylesheet that is embedded in a     document. (CVE-2012-0449)

Mozilla Firefox was updated to version 10 to fix bugs and security issues.

MFSA 2012-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References

CVE-2012-0443: Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse Ruderman, Jan Odvarko, Peter Van Der Beken, and Bill McCloskey reported memory safety problems that were fixed in Firefox 10.

CVE-2012-0442: Jesse Ruderman and Bob Clary reported memory safety problems that were fixed in both Firefox 10 and Firefox 3.6.26.

MFSA 2012-02/CVE-2011-3670: For historical reasons Firefox has been generous in its interpretation of web addresses containing square brackets around the host. If this host was not a valid IPv6 literal address, Firefox attempted to interpret the host as a regular domain name. Gregory Fleischer reported that requests made using IPv6 syntax using XMLHttpRequest objects through a proxy may generate errors depending on proxy configuration for IPv6. The resulting error messages from the proxy may disclose sensitive data because Same-Origin Policy (SOP) will allow the XMLHttpRequest object to read these error messages, allowing user privacy to be eroded. Firefox now enforces RFC 3986 IPv6 literal syntax and that may break links written using the non-standard Firefox-only forms that were previously accepted.

This was fixed previously for Firefox 7.0, Thunderbird 7.0, and SeaMonkey 2.4 but only fixed in Firefox 3.6.26 and Thunderbird 3.1.18 during 2012.

MFSA 2012-03/CVE-2012-0445: Alex Dvorov reported that an attacker could replace a sub-frame in another domain's document by using the name attribute of the sub-frame as a form submission target. This can potentially allow for phishing attacks against users and violates the HTML5 frame navigation policy.

Firefox 3.6 and Thunderbird 3.1 are not affected by this vulnerability

MFSA 2012-04/CVE-2011-3659: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that removed child nodes of nsDOMAttribute can be accessed under certain circumstances because of a premature notification of AttributeChildRemoved. This use-after-free of the child nodes could possibly allow for for remote code execution.

MFSA 2012-05/CVE-2012-0446: Mozilla security researcher moz_bug_r_a4 reported that frame scripts bypass XPConnect security checks when calling untrusted objects. This allows for cross-site scripting (XSS) attacks through web pages and Firefox extensions. The fix enables the Script Security Manager (SSM) to force security checks on all frame scripts.

Firefox 3.6 and Thunderbird 3.1 are not affected by this vulnerability

MFSA 2012-06/CVE-2012-0447: Mozilla developer Tim Abraldes reported that when encoding images as image/vnd.microsoft.icon the resulting data was always a fixed size, with uninitialized memory appended as padding beyond the size of the actual image. This is the result of mImageBufferSize in the encoder being initialized with a value different than the size of the source image. There is the possibility of sensitive data from uninitialized memory being appended to a PNG image when converted fron an ICO format image. This sensitive data may then be disclosed in the resulting image.

Firefox 3.6 and Thunderbird 3.1 are not affected by this vulnerability

MFSA 2012-07/CVE-2012-0444: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution.

MFSA 2012-08/CVE-2012-0449: Security researchers Nicolas Gregoire and Aki Helin independently reported that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to a memory corruption. While there is no evidence that this is directly exploitable, there is a possibility of remote code execution.

MFSA 2012-09/CVE-2012-0450: magicant starmen reported that if a user chooses to export their Firefox Sync key the 'Firefox Recovery Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users on Linux and OS X systems.

Firefox 3.6 is not affected by this vulnerability.

Changes in MozillaFirefox :

  - update to Firefox 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - KDE integration has been disabled since it needs     refactoring

  - removed obsolete ppc64 patch

  - Disable neon for arm as it doesn't build correctly

Changes in MozillaThunderbird :

  - update to version 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - update enigmail to 1.3.5

  - added mozilla-disable-neon-option.patch to be able to     disable neon on ARM

  - removed obsolete PPC64 patch

Changes in seamonkey :

  - update to SeaMonkey 2.7 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

Changes in xulrunner :

  - update to version 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - removed obsolete ppc64 patch

  - disable neon for ARM as it doesn't build correctly

Changes in mozilla-xulrunner192 :

  - security update to 1.9.2.26 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-02/CVE-2011-3670 (bmo#504014)

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Thunderbird can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-0449)

It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-0444)

Tim Abraldes discovered that when encoding certain image types the resulting data was always a fixed size. There is the possibility of sensitive data from uninitialized memory being appended to these images. (CVE-2012-0447)

It was discovered that Thunderbird did not properly perform XPConnect security checks. An attacker could exploit this to conduct cross-site scripting (XSS) attacks through web pages and Thunderbird extensions.
With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0446)

It was discovered that Thunderbird did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2011-3659)

Alex Dvorov discovered that Thunderbird did not properly handle sub-frames in form submissions. An attacker could exploit this to conduct phishing attacks using HTML5 frames. (CVE-2012-0445)

Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse Ruderman, Jan Odvarko, Peter Van Der Beken, Bob Clary, and Bill McCloskey discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-0442, CVE-2012-0443)

Andrew McCreight and Olli Pettay discovered a use-after-free vulnerability in the XBL bindings. An attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird.
(CVE-2012-0452)

Jueri Aedla discovered that libpng, which is in Thunderbird, did not properly verify the size used when allocating memory during chunk decompression. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with the privileges of the user invoking the program. (CVE-2011-3026).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of SeaMonkey 2.x earlier than 2.7.0 are potentially affected by the following security issues : 

  - A use-after-free error exists related to removed nsDOMAttribute child nodes. (CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442, CVE-2012-0443)

  - Memory corruption errors exist related to the decoding of Ogg Vorbis files and processing of malformed XSLT stylesheets. (CVE-2012-0444, CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by allowing an attacker to replace a sub-frame in another domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security restrictions in XPConnect.  This bypass can allow malicious web sites to carry out cross-site scripting attacks. (CVE-2012-0446)

  - An information disclosure issue exists when uninitialized memory is used as padding when encoding icon images. (CVE-2012-0447)

  - If a user chooses to export their SeaMonkey Sync key the 'SeaMonkey Recover Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users.  Note that this issue only affects SeaMonkey on Linux and Mac OS X systems. (CVE-2012-0450)

Versions of Mozilla Thunderbird prior to 10.0 are affected by the following security issues :

 - A use-after-free error exists related to removed nsDOMAttribute child nodes. (CVE-2011-3659)
 - Various memory safety issues exist. (CVE-2012-0442, CVE-2012-0443)
 - Memory corruption errors exist related to the decoding of Ogg Vorbis files and processing of malformed XSLT stylesheets. (CVE-2012-0444, CVE-2012-0449)
 - The HTML5 frame navigation policy can be violated by allowing an attacker to replace a sub-frame in another domain's document. (CVE-2012-0445)
 - Scripts in frames are able to bypass security restrictions in XPConnect. This bypass can allow malicious web sites to carry out cross-site scripting attacks. (CVE-2012-0446)
 - An information disclosure issue exists when uninitialized memory is used as padding when encoding icon images. (CVE-2012-0447)
 - If a user chooses to export their Thunderbird Sync key the 'Thunderbird Recover Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users. Note that this issue only affects Thunderbird on Linux and Mac OS X systems. (CVE-2012-0450)

Versions of Firefox prior to 10.0 are affected by the following security issues : 

 - A use-after-free error exists related to removed 'nsDOMAttribute' child nodes. (CVE-2011-3659)
 - Various memory safety issues exist. (CVE-2012-0442, CVE-2012-0443)
 - Memory corruption errors exist related to the decoding of Ogg Vorbis files and processing of malformed XSLT stylesheets. (CVE-2012-0444, CVE-2012-0449)
 - The HTML5 frame navigation policy can be violated by allowing an attacker to replace a sub-frame in another domain's document. (CVE-2012-0445)
 - Scripts in frames are able to bypass security restrictions in XPConnect.  This bypass can allow malicious web sites to carry out cross-site scripting attacks. (CVE-2012-0446)
 - An information disclosure issue exists when uninitialized memory is used as padding when encoding icon images. (CVE-2012-0447)
 - If a user chooses to export their Firefox Sync key the 'Firefox Recover Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users.  Note that this issue only affects Firefox on Linux and Mac OS X systems. (CVE-2012-0450)

USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox.

It was discovered that if a user chose to export their Firefox Sync key the 'Firefox Recovery Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users. (CVE-2012-0450)

Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0449)

It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0444)

Tim Abraldes discovered that when encoding certain images types the resulting data was always a fixed size. There is the possibility of sensitive data from uninitialized memory being appended to these images. (CVE-2012-0447)

It was discovered that Firefox did not properly perform XPConnect security checks. An attacker could exploit this to conduct cross-site scripting (XSS) attacks through web pages and Firefox extensions. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0446)

It was discovered that Firefox did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2011-3659)

Alex Dvorov discovered that Firefox did not properly handle sub-frames in form submissions. An attacker could exploit this to conduct phishing attacks using HTML5 frames.
(CVE-2012-0445)

Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse Ruderman, Jan Odvarko, Peter Van Der Beken, Bob Clary, and Bill McCloskey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0442, CVE-2012-0443).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox.

It was discovered that if a user chose to export their Firefox Sync key the 'Firefox Recovery Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users. (CVE-2012-0450)

Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0449)

It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0444)

Tim Abraldes discovered that when encoding certain images types the resulting data was always a fixed size. There is the possibility of sensitive data from uninitialized memory being appended to these images. (CVE-2012-0447)

It was discovered that Firefox did not properly perform XPConnect security checks. An attacker could exploit this to conduct cross-site scripting (XSS) attacks through web pages and Firefox extensions. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0446)

It was discovered that Firefox did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2011-3659)

Alex Dvorov discovered that Firefox did not properly handle sub-frames in form submissions. An attacker could exploit this to conduct phishing attacks using HTML5 frames.
(CVE-2012-0445)

Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse Ruderman, Jan Odvarko, Peter Van Der Beken, Bob Clary, and Bill McCloskey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0442, CVE-2012-0443).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that if a user chose to export their Firefox Sync key the 'Firefox Recovery Key.html' file is saved with incorrect permissions, making the file contents potentially readable by other users. (CVE-2012-0450)

Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0449)

It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0444)

Tim Abraldes discovered that when encoding certain images types the resulting data was always a fixed size. There is the possibility of sensitive data from uninitialized memory being appended to these images. (CVE-2012-0447)

It was discovered that Firefox did not properly perform XPConnect security checks. An attacker could exploit this to conduct cross-site scripting (XSS) attacks through web pages and Firefox extensions. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0446)

It was discovered that Firefox did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2011-3659)

Alex Dvorov discovered that Firefox did not properly handle sub-frames in form submissions. An attacker could exploit this to conduct phishing attacks using HTML5 frames. (CVE-2012-0445)

Ben Hawkes, Christian Holler, Honza Bombas, Jason Orendorff, Jesse Ruderman, Jan Odvarko, Peter Van Der Beken, Bob Clary, and Bill McCloskey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0442, CVE-2012-0443).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides Mozilla Firefox 10, which provides many fixes, security and feature enhancements.

For a detailed list, please have a look at

http://www.mozilla.org/en-US/firefox/10.0/releasenotes/

and

http://www.mozilla.org/de/firefox/features/

The following security issues have been fixed in this update :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-01 / CVE-2012-0442 / CVE-2012-0443)

  - Alex Dvorov reported that an attacker could replace a     sub-frame in another domain's document by using the name     attribute of the sub-frame as a form submission target.
    This can potentially allow for phishing attacks against     users and violates the HTML5 frame navigation policy.
    (MFSA 2012-03 / CVE-2012-0445)

  - Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that removed child     nodes of nsDOMAttribute can be accessed under certain     circumstances because of a premature notification of     AttributeChildRemoved. This use-after-free of the child     nodes could possibly allow for for remote code     execution. (MFSA 2012-04 / CVE-2011-3659)

  - Mozilla security researcher moz_bug_r_a4 reported that     frame scripts bypass XPConnect security checks when     calling untrusted objects. This allows for cross-site     scripting (XSS) attacks through web pages and Firefox     extensions. The fix enables the Script Security Manager     (SSM) to force security checks on all frame scripts.
    (MFSA 2012-05 / CVE-2012-0446)

  - Mozilla developer Tim Abraldes reported that when     encoding images as image/vnd.microsoft.icon the     resulting data was always a fixed size, with     uninitialized memory appended as padding beyond the size     of the actual image. This is the result of     mImageBufferSize in the encoder being initialized with a     value different than the size of the source image. There     is the possibility of sensitive data from uninitialized     memory being appended to a PNG image when converted fron     an ICO format image. This sensitive data may then be     disclosed in the resulting image. ((MFSA 2012-06)     http://www.mozilla.org/security/announce/2012/mfsa2012-0     6.html], [CVE-2012-0447)

  - Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative the possibility of     memory corruption during the decoding of Ogg Vorbis     files. This can cause a crash during decoding and has     the potential for remote code execution. (MFSA 2012-07 /     CVE-2012-0444)

  - Security researchers Nicolas Gregoire and Aki Helin     independently reported that when processing a malformed     embedded XSLT stylesheet, Firefox can crash due to a     memory corruption. While there is no evidence that this     is directly exploitable, there is a possibility of     remote code execution. (MFSA 2012-08 / CVE-2012-0449)

  - magicant starmen reported that if a user chooses to     export their Firefox Sync key the 'Firefox Recovery     Key.html' file is saved with incorrect permissions,     making the file contents potentially readable by other     users on Linux and OS X systems. (MFSA 2012-09 /     CVE-2012-0450)

Security issues were identified and fixed in mozilla firefox and thunderbird :

Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes (CVE-2011-3659).

Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before 3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls through a proxy and reading the error messages (CVE-2011-3670).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2012-0442).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2012-0443).

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file (CVE-2012-0444).

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute (CVE-2012-0445).

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects (CVE-2012-0446).

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image (CVE-2012-0447).

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document (CVE-2012-0449).

Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions for Firefox Recovery Key.html, which might allow local users to read a Firefox Sync key via standard filesystem operations (CVE-2012-0450).

Additionally the libvpx packages has been upgraded to the 0.9.7 version for Mandriva Linux 2011 which is required by firefox 10.0.

The Mozilla Project reports :

MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)

MFSA 2012-02 Overly permissive IPv6 literal syntax

MFSA 2012-03 iframe element exposed across domains via name attribute

MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes

MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks

MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure

MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files

MFSA 2012-08 Crash with malformed embedded XSLT stylesheets

MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission

The installed version of Thunderbird 9.x is potentially affected by the following security issues :

  - A use-after-free error exists related to removed     nsDOMAttribute child nodes.(CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442,     CVE-2012-0443)

  - Memory corruption errors exist related to the     decoding of Ogg Vorbis files and processing of     malformed XSLT stylesheets. (CVE-2012-0444,     CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by     allowing an attacker to replace a sub-frame in another     domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security     restrictions in XPConnect. This bypass can allow     malicious websites to carry out cross-site scripting     attacks. (CVE-2012-0446)

  - An information disclosure issue exists when     uninitialized memory is used as padding when encoding     icon images. (CVE-2012-0447)

The installed version of Firefox 9.x is potentially affected by the following security issues :

  - A use-after-free error exists related to removed     nsDOMAttribute child nodes.(CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442,     CVE-2012-0443)

  - Memory corruption errors exist related to the     decoding of Ogg Vorbis files and processing of     malformed XSLT stylesheets. (CVE-2012-0444,     CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by     allowing an attacker to replace a sub-frame in another     domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security     restrictions in XPConnect. This bypass can allow     malicious websites to carry out cross-site scripting     attacks. (CVE-2012-0446)

  - An information disclosure issue exists when     uninitialized memory is used as padding when encoding     icon images. (CVE-2012-0447)

  - Exported 'Firefox Sync' key permissions are not     correct. (CVE-2012-0450)

The installed version of SeaMonkey is earlier than 2.7.0.  Such versions are potentially affected by the following security issues :

  - A use-after-free error exists related to removed     nsDOMAttribute child nodes.(CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442,     CVE-2012-0443)

  - Memory corruption errors exist related to the     decoding of Ogg Vorbis files and processing of     malformed XSLT stylesheets. (CVE-2012-0444,     CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by     allowing an attacker to replace a sub-frame in another     domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security     restrictions in XPConnect. This bypass can allow     malicious websites to carry out cross-site scripting     attacks. (CVE-2012-0446)

  - An information disclosure issue exists when     uninitialized memory is used as padding when encoding     icon images. (CVE-2012-0447)

The installed version of Thunderbird is earlier than 10.0 and thus, is potentially affected by the following security issues :

  - A use-after-free error exists related to removed     nsDOMAttribute child nodes.(CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442,     CVE-2012-0443)

  - Memory corruption errors exist related to the     decoding of Ogg Vorbis files and processing of     malformed XSLT stylesheets. (CVE-2012-0444,     CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by     allowing an attacker to replace a sub-frame in another     domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security     restrictions in XPConnect. This bypass can allow     malicious websites to carry out cross-site scripting     attacks. (CVE-2012-0446)

  - An information disclosure issue exists when     uninitialized memory is used as padding when encoding     icon images. (CVE-2012-0447)

The installed version of Firefox is earlier than 10.0 and thus, is potentially affected by the following security issues :

  - A use-after-free error exists related to removed     nsDOMAttribute child nodes.(CVE-2011-3659)

  - Various memory safety issues exist. (CVE-2012-0442,     CVE-2012-0443)

  - Memory corruption errors exist related to the     decoding of Ogg Vorbis files and processing of     malformed XSLT stylesheets. (CVE-2012-0444,     CVE-2012-0449)

  - The HTML5 frame navigation policy can be violated by     allowing an attacker to replace a sub-frame in another     domain's document. (CVE-2012-0445)

  - Scripts in frames are able to bypass security     restrictions in XPConnect. This bypass can allow     malicious websites to carry out cross-site scripting     attacks. (CVE-2012-0446)

  - An information disclosure issue exists when     uninitialized memory is used as padding when encoding     icon images. (CVE-2012-0447)

ID	Name	Product	Family	Severity
80788	Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird6)	Nessus	Solaris Local Security Checks	critical
75951	openSUSE Security Update : MozillaFirefox (MozillaFirefox-5750)	Nessus	SuSE Local Security Checks	critical
74833	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / chmsee / etc (openSUSE-2012-83)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
58037	Ubuntu 11.10 : thunderbird vulnerabilities (USN-1369-1)	Nessus	Ubuntu Local Security Checks	critical
6310	SeaMonkey 2.x < 2.7.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6308	Mozilla Thunderbird < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6306	Mozilla Firefox < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
57846	Ubuntu 10.04 LTS / 10.10 : ubufox and webfav update (USN-1355-3)	Nessus	Ubuntu Local Security Checks	critical
57845	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : mozvoikko update (USN-1355-2)	Nessus	Ubuntu Local Security Checks	critical
57844	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : firefox vulnerabilities (USN-1355-1)	Nessus	Ubuntu Local Security Checks	critical
57838	SuSE 11.1 Security Update : MozillaFirefox (SAT Patch Number 5754)	Nessus	SuSE Local Security Checks	critical
57833	Mandriva Linux Security Advisory : mozilla (MDVSA-2012:013)	Nessus	Mandriva Local Security Checks	critical
57785	FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	critical
57775	Thunderbird 9.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57773	Firefox < 10.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57772	SeaMonkey < 2.7.0 Multiple Vulnerabilities	Nessus	Windows	high
57770	Mozilla Thunderbird < 10.0 Multiple Vulnerabilities	Nessus	Windows	high
57768	Firefox < 10.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-0443

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

critical

critical

critical

critical

critical

critical

high

high

high

high

high