The remote Solaris system is missing necessary patches to address security updates :

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 4.x through 13.0, Firefox ESR     10.x before 10.0.6, Thunderbird 5.0 through 13.0,     Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before     2.11 allow remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
    (CVE-2012-1948)

  - The drag-and-drop implementation in Mozilla Firefox 4.x     through 13.0 and Firefox ESR 10.x before 10.0.6 allows     remote attackers to spoof the address bar by canceling a     page load. (CVE-2012-1950)

  - Use-after-free vulnerability in the     nsSMILTimeValueSpec::IsEventBased function in Mozilla     Firefox 4.x through 13.0, Firefox ESR 10.x before     10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR     10.x before 10.0.6, and SeaMonkey before 2.11 allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly execute arbitrary code by     interacting with objects used for SMIL Timing.
    (CVE-2012-1951)

  - The nsTableFrame::InsertFrames function in Mozilla     Firefox 4.x through 13.0, Firefox ESR 10.x before     10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR     10.x before 10.0.6, and SeaMonkey before 2.11 does not     properly perform a cast of a frame variable during     processing of mixed row-group and column-group frames,     which might allow remote attackers to execute arbitrary     code via a crafted web site. (CVE-2012-1952)

  - The ElementAnimations::EnsureStyleRuleFor function in     Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows     remote attackers to cause a denial of service (buffer     over-read, incorrect pointer dereference, and heap-based     buffer overflow) or possibly execute arbitrary code via     a crafted web site. (CVE-2012-1953)

  - Use-after-free vulnerability in the     nsDocument::AdoptNode function in Mozilla Firefox 4.x     through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 allows remote     attackers to cause a denial of service (heap memory     corruption) or possibly execute arbitrary code via     vectors involving multiple adoptions and empty     documents. (CVE-2012-1954)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow     remote attackers to spoof the address bar via vectors     involving history.forward and history.back calls.
    (CVE-2012-1955)

  - An unspecified parser-utility class in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 does not     properly handle EMBED elements within description     elements in RSS feeds, which allows remote attackers to     conduct cross-site scripting (XSS) attacks via a feed.
    (CVE-2012-1957)

  - Use-after-free vulnerability in the     nsGlobalWindow::PageHidden function in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 might allow     remote attackers to execute arbitrary code via vectors     related to focused content. (CVE-2012-1958)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     consider the presence of same-compartment security     wrappers (SCSW) during the cross-compartment wrapping of     objects, which allows remote attackers to bypass     intended XBL access restrictions via crafted content.
    (CVE-2012-1959)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     properly handle duplicate values in X-Frame-Options     headers, which makes it easier for remote attackers to     conduct clickjacking attacks via a FRAME element     referencing a web site that produces these duplicate     values. (CVE-2012-1961)

  - Use-after-free vulnerability in the     JSDependentString::undepend function in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via     vectors involving strings with multiple dependencies.
    (CVE-2012-1962)

  - The Content Security Policy (CSP) functionality in     Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does     not properly restrict the strings placed into the     blocked-uri parameter of a violation report, which     allows remote web servers to capture OpenID credentials     and OAuth 2.0 access tokens by triggering a violation.
    (CVE-2012-1963)

  - The certificate-warning functionality in     browser/components/certerror/content/     aboutCertError.xhtml in Mozilla Firefox 4.x through     12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0     through 12.0, Thunderbird ESR 10.x before 10.0.6, and     SeaMonkey before 2.10 does not properly handle attempted     clickjacking of the about:certerror page, which allows     man-in-the-middle attackers to trick users into adding     an unintended exception via an IFRAME element.
    (CVE-2012-1964)

  - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x     before 10.0.6 do not properly establish the security     context of a feed: URL, which allows remote attackers to     bypass unspecified cross-site scripting (XSS) protection     mechanisms via a feed:javascript: URL. (CVE-2012-1965)

  - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x     before 10.0.6 do not have the same context-menu     restrictions for data: URLs as for javascript: URLs,     which allows remote attackers to conduct cross-site     scripting (XSS) attacks via a crafted URL.
    (CVE-2012-1966)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     properly implement the JavaScript sandbox utility, which     allows remote attackers to execute arbitrary JavaScript     code with improper privileges via a javascript: URL.
    (CVE-2012-1967)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 15.0, Firefox ESR 10.x     before 10.0.7, Thunderbird before 15.0, Thunderbird ESR     10.x before 10.0.7, and SeaMonkey before 2.12 allow     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2012-1970)

  - Use-after-free vulnerability in the     nsObjectLoadingContent::LoadObject function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1973)

  - Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allow remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a negative height value     in a BMP image within a .ICO file, related to (1)     improper handling of the transparency bitmask by the     nsICODecoder component and (2) improper processing of     the alpha channel by the nsBMPDecoder component.
    (CVE-2012-3966)

Detections

Analytics

Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird7)

critical Nessus Plugin ID 80787

No changelogs found