The installed version of SeaMonkey contains various security issues that could cause the application to crash or lead to execution of arbitrary code on the affected host subject to the user's privileges.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3089     Ronen Zilberman and Michal Zalewski discovered that a     timing race allows the injection of content into     about:blank frames.

  - CVE-2007-3656     Michal Zalewski discovered that same-origin policies for     wyciwyg:// documents are insufficiently enforced.

  - CVE-2007-3734     Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz,     Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats     Palmgren, Olli Pettay, Paul Nickerson and Vladimir     Sukhoy discovered crashes in the layout engine, which     might allow the execution of arbitrary code.

  - CVE-2007-3735     Asaf Romano, Jesse Ruderman and Igor Bukanov discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2007-3736     'moz_bug_r_a4' discovered that the addEventListener()     and setTimeout() functions allow cross-site scripting.

  - CVE-2007-3737     'moz_bug_r_a4' discovered that a programming error in     event handling allows privilege escalation.

  - CVE-2007-3738     'shutdown' and 'moz_bug_r_a4' discovered that the     XPCNativeWrapper allows the execution of arbitrary code.

The oldstable distribution (sarge) doesn't include xulrunner.

This update fixes several security issues in Mozilla SeaMonkey 1.0.9.

Following security problems were fixed :

  - MFSA 2007-18: Crashes with evidence of memory corruption

    The usual collection of stability fixes for crashes that     look suspicious but haven't been proven to be     exploitable.

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy     (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov (CVE-2007-3735)

  - MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener     and setTimeout

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - MFSA 2007-20 / CVE-2007-3089: frame spoofing

    Ronen Zilberman and Michal Zalewski both reported that     it was possible to exploit a timing issue to inject     content into about:blank frames in a page.

  - MFSA 2007-21 / CVE-2007-3737: Privilege escalation using     an event handler attached to an element not in the     document

    Reported by moz_bug_r_a4.

  - MFSA 2007-22 / CVE-2007-3285: File type confusion due to     %00 in name

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - MFSA 2007-23 / CVE-2007-3670: Remote code execution by     launching Firefox from Internet Explorer

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - MFSA 2007-24 / CVE-2007-3656: unauthorized access to     wyciwyg:// documents

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution

    shutdown and moz_bug_r_a4 reported two separate ways to     modify an XPCNativeWrapper such that subsequent access     by the browser would result in executing user-supplied     code.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML email message containing JavaScript code could cause Thunderbird to crash or potentially execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; these issues are not exploitable unless the user has enabled JavaScript. (CVE-2007-3089, CVE-2007-3734, CVE-2007-3735, CVE-2007-3736, CVE-2007-3737, CVE-2007-3738)

Users of Thunderbird are advised to upgrade to these erratum packages, which contain patches that correct these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-3734, CVE-2007-3735, CVE-2007-3737, CVE-2007-3738)

Several content injection flaws were found in the way SeaMonkey handled certain JavaScript code. A web page containing malicious JavaScript code could inject arbitrary content into other web pages.
(CVE-2007-3736, CVE-2007-3089)

A flaw was found in the way SeaMonkey cached web pages on the local disk. A malicious web page may be able to inject arbitrary HTML into a browsing session if the user reloads a targeted site. (CVE-2007-3656)

Users of SeaMonkey are advised to upgrade to these erratum packages, which contain patches that correct these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3734     Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz,     Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats     Palmgren, Olli Pettay, Paul Nickerson and Vladimir     Sukhoy discovered crashes in the layout engine, which     might allow the execution of arbitrary code.

  - CVE-2007-3735     Asaf Romano, Jesse Ruderman and Igor Bukanov discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2007-3844     'moz_bug_r_a4' discovered that a regression in the     handling of'about:blank' windows used by addons may lead     to an attacker being able to modify the content of     websites.

  - CVE-2007-3845     Jesper Johansson discovered that missing sanitising of     double-quotes and spaces in URIs passed to external     programs may allow an attacker to pass arbitrary     arguments to the helper program if the user is tricked     into opening a malformed web page.

  - CVE-2007-5339     L. David Baron, Boris Zbarsky, Georgi Guninski, Paul     Nickerson, Olli Pettay, Jesse Ruderman, Vladimir Sukhoy,     Daniel Veditz, and Martijn Wargers discovered crashes in     the layout engine, which might allow the execution of     arbitrary code.

  - CVE-2007-5340     Igor Bukanov, Eli Friedman, and Jesse Ruderman     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code. Generally,     enabling JavaScript in Icedove is not recommended.

The Mozilla products in the oldstable distribution (sarge) are no longer supported with security updates.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.9.

This update provides the latest Thunderbird to correct these issues.

Versions of Mozilla Firefox prior to 2.0.0.5 are affected by various security issues, one of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

The installed version of Firefox is affected by various security issues, one of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

ID	Name	Product	Family	Published	Updated	Severity
25765	SeaMonkey < 1.1.3 Multiple Vulnerabilities	Nessus	Windows	7/25/2007	7/27/2018	high
25780	Debian DSA-1337-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	7/27/2007	1/4/2021	high
27444	openSUSE 10 Security Update : seamonkey (seamonkey-3986)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
27705	Fedora 7 : thunderbird-2.0.0.5-1.fc7 (2007-1180)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	high
27706	Fedora 7 : seamonkey-1.1.3-1.fc7 (2007-1181)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	high
27546	Debian DSA-1391-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	10/25/2007	1/4/2021	high
37880	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:047)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	high
4140	Mozilla Firefox < 2.0.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	7/18/2007	3/6/2019	medium
800770	Firefox < 2.0.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

medium

high