The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted GIF image.

MozillaFirefox was updated to Firefox 19.0 (bnc#804248) MozillaThunderbird was updated to Thunderbird 17.0.3 (bnc#804248) seamonkey was updated to SeaMonkey 2.16 (bnc#804248) xulrunner was updated to 17.0.3esr (bnc#804248) chmsee was updated to version 2.0.

Changes in MozillaFirefox 19.0 :

  - MFSA 2013-21/CVE-2013-0783/2013-0784 Miscellaneous     memory safety hazards

  - MFSA 2013-22/CVE-2013-0772 (bmo#801366) Out-of-bounds     read in image rendering

  - MFSA 2013-23/CVE-2013-0765 (bmo#830614) Wrapped WebIDL     objects can be wrapped again

  - MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content     bypass of COW and SOW security wrappers

  - MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in     JavaScript Workers

  - MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free     in nsImageLoadingContent

  - MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on     HTTPS connection through malicious proxy

  - MFSA 2013-28/CVE-2013-0780/CVE-2013-0782/CVE-2013-0777/     CVE-2013-0778/CVE-2013-0779/CVE-2013-0781     Use-after-free, out of bounds read, and buffer overflow     issues found using Address Sanitizer

  - removed obsolete patches

  - mozilla-webrtc.patch

  - mozilla-gstreamer-803287.patch

  - added patch to fix session restore window order     (bmo#712763)

  - update to Firefox 18.0.2

  - blocklist and CTP updates

  - fixes in JS engine

  - update to Firefox 18.0.1

  - blocklist updates

  - backed out bmo#677092 (removed patch)

  - fixed problems involving HTTP proxy transactions

  - Fix WebRTC to build on powerpc

Changes in MozillaThunderbird :

  - update to Thunderbird 17.0.3 (bnc#804248)

  - MFSA 2013-21/CVE-2013-0783 Miscellaneous memory safety     hazards

  - MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content     bypass of COW and SOW security wrappers

  - MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in     JavaScript Workers

  - MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free     in nsImageLoadingContent

  - MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on     HTTPS connection through malicious proxy

  - MFSA 2013-28/CVE-2013-0780/CVE-2013-0782 Use-after-free,     out of bounds read, and buffer overflow issues found     using Address Sanitizer

  - update Enigmail to 1.5.1

  - The release fixes the regressions found in the past few     weeks

Changes in seamonkey :

  - update to SeaMonkey 2.16 (bnc#804248)

  - MFSA 2013-21/CVE-2013-0783/2013-0784 Miscellaneous     memory safety hazards

  - MFSA 2013-22/CVE-2013-0772 (bmo#801366) Out-of-bounds     read in image rendering

  - MFSA 2013-23/CVE-2013-0765 (bmo#830614) Wrapped WebIDL     objects can be wrapped again

  - MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content     bypass of COW and SOW security wrappers

  - MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in     JavaScript Workers

  - MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free     in nsImageLoadingContent

  - MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on     HTTPS connection through malicious proxy

  - MFSA 2013-28/CVE-2013-0780/CVE-2013-0782/CVE-2013-0777/     CVE-2013-0778/CVE-2013-0779/CVE-2013-0781     Use-after-free, out of bounds read, and buffer overflow     issues found using Address Sanitizer

  - removed obsolete patches

  - mozilla-webrtc.patch

  - mozilla-gstreamer-803287.patch

  - update to SeaMonkey 2.15.2

  - Applications could not be removed from the 'Application     details' dialog under Preferences, Helper Applications     (bmo#826771).

  - View / Message Body As could show menu items out of     context (bmo#831348)

  - update to SeaMonkey 2.15.1

  - backed out bmo#677092 (removed patch)

  - fixed problems involving HTTP proxy transactions

  - backed out restartless language packs as it broke     multi-locale setup (bmo#677092, bmo#818468)

Changes in xulrunner :

  - update to 17.0.3esr (bnc#804248)

  - MFSA 2013-21/CVE-2013-0783 Miscellaneous memory safety     hazards

  - MFSA 2013-24/CVE-2013-0773 (bmo#809652) Web content     bypass of COW and SOW security wrappers

  - MFSA 2013-25/CVE-2013-0774 (bmo#827193) Privacy leak in     JavaScript Workers

  - MFSA 2013-26/CVE-2013-0775 (bmo#831095) Use-after-free     in nsImageLoadingContent

  - MFSA 2013-27/CVE-2013-0776 (bmo#796475) Phishing on     HTTPS connection through malicious proxy

  - MFSA 2013-28/CVE-2013-0780/CVE-2013-0782 Use-after-free,     out of bounds read, and buffer overflow issues found     using Address Sanitizer

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content.
Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Thunderbird rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross site-scripting (XSS) attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5614)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.2.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.2.0 ESR, which corrects these issues.
After installing the update, Thunderbird must be restarted for the changes to take effect.

From Red Hat Security Advisory 2013:1823 :

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed content.
Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Thunderbird rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross site-scripting (XSS) attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-5614)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.2.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.2.0 ESR, which corrects these issues.
After installing the update, Thunderbird must be restarted for the changes to take effect.

From Red Hat Security Advisory 2013:1812 :

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Firefox rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross-site scripting (XSS) attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-5614)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.2.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Firefox users should upgrade to these updated packages, which contain Firefox version 24.2.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613)

A flaw was found in the way Firefox rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross-site scripting (XSS) attacks. (CVE-2013-5612)

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-5614)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler, Masato Kinugawa, Daniel Veditz, Jesse Schwartzentruber, Nils, Tyson Smith, and Atte Kettunen as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.2.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Firefox users should upgrade to these updated packages, which contain Firefox version 24.2.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced       below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Further, a remote attacker could conduct XSS       attacks, spoof URLs, bypass address space layout randomization, conduct       clickjacking attacks, obtain potentially sensitive information, bypass       access restrictions, modify the local filesystem, or conduct other       unspecified attacks.
  Workaround :

    There is no known workaround at this time.

MozillaFirefox has been updated to the 17.0.4ESR release. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes :

  - VUPEN Security, via TippingPoint's Zero Day Initiative,     reported a use-after-free within the HTML editor when     content script is run by the document.execCommand()     function while internal editor operations are occurring.
    This could allow for arbitrary code execution. (MFSA     2013-29 / CVE-2013-0787)

The Firefox 17.0.3ESR release also contains lots of security fixes :

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team used the Address Sanitizer     tool to discover a series of use-after-free, out of     bounds read, and buffer overflow problems rated as low     to critical security issues in shipped software. Some of     these issues are potentially exploitable, allowing for     remote code execution. We would also like to thank     Abhishek for reporting four additional use-after-free     and out of bounds write flaws introduced during Firefox     development that were fixed before general release.
    (MFSA 2013-28)

The following issues have been fixed in Firefox 19 and ESR 17.0.3 :

  - Heap-use-after-free in     nsOverflowContinuationTracker::Finish, with

    -moz-columns. (CVE-2013-0780)

  - Heap-buffer-overflow WRITE in     nsSaveAsCharset::DoCharsetConversion. (CVE-2013-0782)

  - Google security researcher Michal Zalewski reported an     issue where the browser displayed the content of a     proxy's 407 response if a user canceled the proxy's     authentication prompt. In this circumstance, the     addressbar will continue to show the requested site's     address, including HTTPS addresses that appear to be     secure. This spoofing of addresses can be used for     phishing attacks by fooling users into entering     credentials, for example. (MFSA 2013-27 / CVE-2013-0776)

  - Security researcher Nils reported a use-after-free in     nsImageLoadingContent when content script is executed.
    This could allow for arbitrary code execution. (MFSA     2013-26 / CVE-2013-0775)

  - Mozilla security researcher Frederik Braun discovered     that since Firefox 15 the file system location of the     active browser profile was available to JavaScript     workers. While not dangerous by itself, this could     potentially be combined with other vulnerabilities to     target the profile in an attack. (MFSA 2013-25 /     CVE-2013-0774)

  - Mozilla developer Bobby Holley discovered that it was     possible to bypass some protections in Chrome Object     Wrappers (COW) and System Only Wrappers (SOW), making     their prototypes mutable by web content. This could be     used leak information from chrome objects and possibly     allow for arbitrary code execution. (MFSA 2013-24 /     CVE-2013-0773)

  - Mozilla developer Boris Zbarsky reported that in some     circumstances a wrapped WebIDL object can be wrapped     multiple times, overwriting the existing wrapped state.
    This could lead to an exploitable condition in rare     cases. (MFSA 2013-23 / CVE-2013-0765)

  - Using the Address Sanitizer tool, security researcher     Atte Kettunen from OUSPG found an out-of-bounds read     while rendering GIF format images. This could cause a     non-exploitable crash and could also attempt to render     normally inaccesible data as part of the image. (MFSA     2013-22 / CVE-2013-0772)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2013-21)

    Olli Pettay, Christoph Diehl, Gary Kwong, Jesse     Ruderman, Andrew McCreight, Joe Drew, and Wayne Mery     reported memory safety problems and crashes that affect     Firefox ESR 17, and Firefox 18.

  - Memory safety bugs fixed in Firefox ESR 17.0.3, and     Firefox 19. (CVE-2013-0783)

Mozilla Firefox has been updated to the 17.0.3ESR release.

Important: due to compatibility issues, the Beagle plug-in for MozillaFirefox is temporarily disabled by this update.

Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes :

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team used the Address Sanitizer     tool to discover a series of use-after-free, out of     bounds read, and buffer overflow problems rated as low     to critical security issues in shipped software. Some of     these issues are potentially exploitable, allowing for     remote code execution. We would also like to thank     Abhishek for reporting four additional use-after-free     and out of bounds write flaws introduced during Firefox     development that were fixed before general release.
    (MFSA 2013-28)

  - The following issues have been fixed in Firefox 19 and     ESR 17.0.3 :

  - Heap-use-after-free in     nsOverflowContinuationTracker::Finish, with
    -moz-columns. (CVE-2013-0780)

  - Heap-buffer-overflow WRITE in     nsSaveAsCharset::DoCharsetConversion. (CVE-2013-0782)

  - Google security researcher Michal Zalewski reported an     issue where the browser displayed the content of a     proxy's 407 response if a user canceled the proxy's     authentication prompt. In this circumstance, the     addressbar will continue to show the requested site's     address, including HTTPS addresses that appear to be     secure. This spoofing of addresses can be used for     phishing attacks by fooling users into entering     credentials, for example. (MFSA 2013-27 / CVE-2013-0776)

  - Security researcher Nils reported a use-after-free in     nsImageLoadingContent when content script is executed.
    This could allow for arbitrary code execution. (MFSA     2013-26 / CVE-2013-0775)

  - Mozilla security researcher Frederik Braun discovered     that since Firefox 15 the file system location of the     active browser profile was available to JavaScript     workers. While not dangerous by itself, this could     potentially be combined with other vulnerabilities to     target the profile in an attack. (MFSA 2013-25 /     CVE-2013-0774)

  - Mozilla developer Bobby Holley discovered that it was     possible to bypass some protections in Chrome Object     Wrappers (COW) and System Only Wrappers (SOW), making     their prototypes mutable by web content. This could be     used leak information from chrome objects and possibly     allow for arbitrary code execution. (MFSA 2013-24 /     CVE-2013-0773)

  - Mozilla developer Boris Zbarsky reported that in some     circumstances a wrapped WebIDL object can be wrapped     multiple times, overwriting the existing wrapped state.
    This could lead to an exploitable condition in rare     cases. (MFSA 2013-23 / CVE-2013-0765)

  - Using the Address Sanitizer tool, security researcher     Atte Kettunen from OUSPG found an out-of-bounds read     while rendering GIF format images. This could cause a     non-exploitable crash and could also attempt to render     normally inaccesible data as part of the image. (MFSA     2013-22 / CVE-2013-0772)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2013-21)

    Olli Pettay, Christoph Diehl, Gary Kwong, Jesse     Ruderman, Andrew McCreight, Joe Drew, and Wayne Mery     reported memory safety problems and crashes that affect     Firefox ESR 17, and Firefox 18.

  - Memory safety bugs fixed in Firefox ESR 17.0.3, and     Firefox 19. (CVE-2013-0783)

USN-1729-1 fixed vulnerabilities in Firefox. This update introduced a regression which sometimes resulted in freezes and crashes when using multiple tabs with images displayed. This update fixes the problem.

We apologize for the inconvenience.

Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, Wayne Mery, Alon Zakai, Christian Holler, Gary Kwong, Luke Wagner, Terrence Cole, Timothy Nikkel, Bill McCloskey, and Nicolas Pierron discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash. (CVE-2013-0783, CVE-2013-0784)

Atte Kettunen discovered that Firefox could perform an out-of-bounds read while rendering GIF format images. An attacker could exploit this to crash Firefox.
(CVE-2013-0772)

Boris Zbarsky discovered that Firefox did not properly handle some wrapped WebIDL objects. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2013-0765)

Bobby Holley discovered vulnerabilities in Chrome Object Wrappers (COW) and System Only Wrappers (SOW). If a user were tricked into opening a specially crafted page, a remote attacker could exploit this to bypass security protections to obtain sensitive information or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2013-0773)

Frederik Braun discovered that Firefox made the location of the active browser profile available to JavaScript workers.
(CVE-2013-0774)

A use-after-free vulnerability was discovered in Firefox. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-0775)

Michal Zalewski discovered that Firefox would not always show the correct address when cancelling a proxy authentication prompt. A remote attacker could exploit this to conduct URL spoofing and phishing attacks.
(CVE-2013-0776)

Abhishek Arya discovered several problems related to memory handling. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2013-0777, CVE-2013-0778, CVE-2013-0779, CVE-2013-0780, CVE-2013-0781, CVE-2013-0782).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of SeaMonkey earlier than 2.16 are potentially affected by multiple vulnerabilities :

  - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Thunderbird less than 17.0.3  are potentially affected by the following security issues :

- Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)



  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Firefox 18.x and older are potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Mozilla Thunderbird prior to 17.0.3 are affected by the following security issues :

- Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)
 - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)
 - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)
 - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)
 - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)
 - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)
 - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)
 - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)
 - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)
 - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)
 - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)
 - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)
 - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Firefox prior to 19.0 are potentially affected by the following security issues :

 - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)
 - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)
 - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)
 - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)
 - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)
 - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)
 - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)
 - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)
 - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)
 - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)
 - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)
 - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)
 - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

The installed version of SeaMonkey is earlier than 2.16 and thus, is potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783,     CVE-2013-0784)

  - An out-of-bounds read error exists related to the     handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping     that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW)     or System Only Wrappers (SOW) that could allow security     bypass. (CVE-2013-0773)

  - The file system location of the active browser profile     could be disclosed and used in further attacks.
    (CVE-2013-0774)

  - A use-after-free error exists in the function     'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related     to proxy '407' responses and embedded script code.
    (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function     'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function     'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function     'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function     'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function     'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the     function 'nsSaveAsCharset::DoCharsetConversion'.
    (CVE-2013-0782)

The installed version of Thunderbird is earlier than 17.0.3 and thus, is potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783,     CVE-2013-0784)

  - An out-of-bounds read error exists related to the     handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping     that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW)     or System Only Wrappers (SOW) that could allow security     bypass. (CVE-2013-0773)

  - The file system location of the active browser profile     could be disclosed and used in further attacks.
    (CVE-2013-0774)

  - A use-after-free error exists in the function     'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related     to proxy '407' responses and embedded script code.
    (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function     'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function     'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function     'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function     'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function     'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the     function 'nsSaveAsCharset::DoCharsetConversion'.
    (CVE-2013-0782)

The installed version of Firefox is earlier than 19.0 and thus, is potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783,     CVE-2013-0784)

  - An out-of-bounds read error exists related to the     handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping     that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW)     or System Only Wrappers (SOW) that could allow security     bypass. (CVE-2013-0773)

  - The file system location of the active browser profile     could be disclosed and used in further attacks.
    (CVE-2013-0774)

  - A use-after-free error exists in the function     'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related     to proxy '407' responses and embedded script code.
    (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function     'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function     'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function     'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function     'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function     'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the     function 'nsSaveAsCharset::DoCharsetConversion'.
    (CVE-2013-0782)

The installed version of Firefox 18.x is potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783,     CVE-2013-0784)

  - An out-of-bounds read error exists related to the     handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping     that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW)     or System Only Wrappers (SOW) that could allow security     bypass. (CVE-2013-0773)

  - The file system location of the active browser profile     could be disclosed and used in further attacks.
    (CVE-2013-0774)

  - A use-after-free error exists in the function     'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related     to proxy '407' responses and embedded script code.
    (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function     'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function     'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function     'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function     'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function     'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the     function 'nsSaveAsCharset::DoCharsetConversion'.
    (CVE-2013-0782)

Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, Wayne Mery, Alon Zakai, Christian Holler, Gary Kwong, Luke Wagner, Terrence Cole, Timothy Nikkel, Bill McCloskey, and Nicolas Pierron discovered multiple memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash. (CVE-2013-0783, CVE-2013-0784)

Atte Kettunen discovered that Firefox could perform an out-of-bounds read while rendering GIF format images. An attacker could exploit this to crash Firefox. (CVE-2013-0772)

Boris Zbarsky discovered that Firefox did not properly handle some wrapped WebIDL objects. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2013-0765)

Bobby Holley discovered vulnerabilities in Chrome Object Wrappers (COW) and System Only Wrappers (SOW). If a user were tricked into opening a specially crafted page, a remote attacker could exploit this to bypass security protections to obtain sensitive information or potentially execute code with the privileges of the user invoking Firefox. (CVE-2013-0773)

Frederik Braun that Firefox made the location of the active browser profile available to JavaScript workers. (CVE-2013-0774)

A use-after-free vulnerability was discovered in Firefox. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-0775)

Michal Zalewski discovered that Firefox would not always show the correct address when cancelling a proxy authentication prompt. A remote attacker could exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-0776)

Abhishek Arya discovered several problems related to memory handling.
If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2013-0777, CVE-2013-0778, CVE-2013-0779, CVE-2013-0780, CVE-2013-0781, CVE-2013-0782).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Project reports :

MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)

MFSA 2013-22 Out-of-bounds read in image rendering

MFSA 2013-23 Wrapped WebIDL objects can be wrapped again

MFSA 2013-24 Web content bypass of COW and SOW security wrappers

MFSA 2013-25 Privacy leak in JavaScript Workers

MFSA 2013-26 Use-after-free in nsImageLoadingContent

MFSA 2013-27 Phishing on HTTPS connection through malicious proxy

MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer

ID	Name	Product	Family	Severity
74898	openSUSE Security Update : Mozilla (openSUSE-SU-2013:0323-1)	Nessus	SuSE Local Security Checks	critical
71370	RHEL 5 / 6 : thunderbird (RHSA-2013:1823)	Nessus	Red Hat Local Security Checks	critical
71368	Oracle Linux 6 : thunderbird (ELSA-2013-1823)	Nessus	Oracle Linux Local Security Checks	critical
71366	Oracle Linux 5 / 6 : firefox (ELSA-2013-1812)	Nessus	Oracle Linux Local Security Checks	critical
71357	CentOS 5 / 6 : thunderbird (CESA-2013:1823)	Nessus	CentOS Local Security Checks	critical
71354	CentOS 5 / 6 : firefox (CESA-2013:1812)	Nessus	CentOS Local Security Checks	critical
71335	RHEL 5 / 6 : firefox (RHSA-2013:1812)	Nessus	Red Hat Local Security Checks	critical
70183	GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
65598	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8506)	Nessus	SuSE Local Security Checks	critical
65175	SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7447)	Nessus	SuSE Local Security Checks	critical
64967	Ubuntu 11.10 / 12.04 LTS / 12.10 : firefox regression (USN-1729-2)	Nessus	Ubuntu Local Security Checks	critical
801258	Mozilla SeaMonkey < 2.16 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6693	SeaMonkey < 2.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
801245	Mozilla Thunderbird 17.x < 17.0.3 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
801233	Mozilla Firefox 18.x <= 18 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6692	Mozilla Thunderbird < 17.0.3 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6691	Mozilla Firefox < 19.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
64726	SeaMonkey < 2.16 Multiple Vulnerabilities	Nessus	Windows	critical
64724	Mozilla Thunderbird < 17.0.3 Multiple Vulnerabilities	Nessus	Windows	critical
64723	Firefox < 19.0 Multiple Vulnerabilities	Nessus	Windows	critical
64720	Thunderbird < 17.0.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
64719	Firefox 18.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
64698	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox vulnerabilities (USN-1729-1)	Nessus	Ubuntu Local Security Checks	critical
64693	FreeBSD : mozilla -- multiple vulnerabilities (e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-0772

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

high