New seamonkey packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues.

The installed version of SeaMonkey is affected by various security issues :

  - A stability problem that could result in a crash during     JavaScript garbage collection (MFSA 2008-20).

  - Several stability bugs leading to crashes which, in     some cases, show traces of memory corruption     (MFSA 2008-21).

  - A vulnerability involving violation of the same-origin     policy could allow for cross-site scripting attacks     (MFSA 2008-22).

  - JavaScript can be injected into the context of signed     JARs and executed under the context of the JAR's signer     (MFSA 2008-23).

  - By taking advantage of the privilege level stored in     the pre-compiled 'fastload' file. an attacker may be     able to run arbitrary JavaScript code with chrome     privileges (MFSA 2008-24).

  - Arbitrary code execution is possible in     'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).

  - Several function calls in the MIME handling code     use unsafe versions of string routines (MFSA 2008-26).

  - An attacker can steal files from known locations on a     victim's computer via originalTarget and DOM Range     (MFSA 2008-27).

  - It is possible for a malicious Java applet to bypass     the same-origin policy and create arbitrary socket     connections to other domains (MFSA 2008-28).

  - An improperly encoded '.properties' file in an add-on     can result in uninitialized memory being used, which     could lead to data formerly used by other programs     being exposed to the add-on code (MFSA 2008-29).

  - File URLs in directory listings are not properly HTML-     escaped when the filenames contained particular     characters (MFSA 2008-30).

  - A weakness in the trust model regarding alt names on     peer-trusted certs could lead to spoofing secure     connections to any other site (MFSA 2008-31).

  - URL shortcut files on Windows (for example, saved IE     favorites) could be interpreted as if they were in the     local file context when opened by SeaMonkey, although     the referenced remote content would be downloaded and     displayed (MFSA 2008-32).

  - A crash in Mozilla's block reflow code could be used     by an attacker to crash the browser and run arbitrary     code on the victim's computer (MFSA 2008-33).

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808)

A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

All Mozilla Firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.

Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-2798     Devon Hubbard, Jesse Ruderman and Martijn Wargers     discovered crashes in the layout engine, which might     allow the execution of arbitrary code.

  - CVE-2008-2799     Igor Bukanov, Jesse Ruderman and Gary Kwong discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2008-2800     'moz_bug_r_a4' discovered several cross-site scripting     vulnerabilities.

  - CVE-2008-2801     Collin Jackson and Adam Barth discovered that JavaScript     code could be executed in the context of signed JAR     archives.

  - CVE-2008-2802     'moz_bug_r_a4' discovered that XUL documents can     escalate privileges by accessing the pre-compiled     'fastload' file.

  - CVE-2008-2803     'moz_bug_r_a4' discovered that missing input sanitising     in the mozIJSSubScriptLoader.loadSubScript() function     could lead to the execution of arbitrary code. Iceweasel     itself is not affected, but some addons are.

  - CVE-2008-2805     Claudio Santambrogio discovered that missing access     validation in DOM parsing allows malicious websites to     force the browser to upload local files to the server,     which could lead to information disclosure.

  - CVE-2008-2807     Daniel Glazman discovered that a programming error in     the code for parsing .properties files could lead to     memory content being exposed to addons, which could lead     to information disclosure.

  - CVE-2008-2808     Masahiro Yamada discovered that file URLS in directory     listings were insufficiently escaped.

  - CVE-2008-2809     John G. Myers, Frank Benkstein and Nils Toedtmann     discovered that alternate names on self-signed     certificates were handled insufficiently, which could     lead to spoofings secure connections.

  - CVE-2008-2811     Greg McManus discovered a crash in the block reflow     code, which might allow the execution of arbitrary code.

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs :

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (CVE-2008-2798 / CVE-2008-2799 / MFSA 2008-21)

  - Mozilla contributor moz_bug_r_a4 submitted a set of     vulnerabilities which allow scripts from one document to     be executed in the context of a different document.
    These vulnerabilities could be used by an attacker to     violate the same-origin policy and perform an XSS     attack. (CVE-2008-2800 / MFSA 2008-22)

  - Security researcher Collin Jackson reported a series of     vulnerabilities which allow JavaScript to be injected     into signed JARs and executed under the context of the     JAR's signer. This could allow an attacker to run     JavaScript in a victim's browser with the privileges of     a different website, provided the attacker possesses a     JAR signed by the other website. (CVE-2008-2801 / MFSA     2008-23)

  - Mozilla contributor moz_bug_r_a4 reported a     vulnerability that allowed non-priviliged XUL documents     to load chrome scripts from the fastload file. This     could allow an attacker to run arbitrary JavaScript code     with chrome privileges. (CVE-2008-2802 / MFSA 2008-24)

  - Mozilla contributor moz_bug_r_a4 reported a     vulnerability which allows arbitrary JavaScript to be     executed with chrome privileges. The privilege     escalation was possible because JavaScript loaded via     mozIJSSubScriptLoader.loadSubScript() was not using     XPCNativeWrappers when accessing content. This could     allow an attacker to overwrite trusted objects with     arbitrary code which would be executed with chrome     privileges when the trusted objects were called by the     browser. (CVE-2008-2803 / MFSA 2008-25)

  - Opera developer Claudio Santambrogio reported a     vulnerability which allows malicious content to force     the browser into uploading local files to the remote     server. This could be used by an attacker to steal     arbitrary files from a victim's computer. (CVE-2008-2805     / MFSA 2008-27)

  - Security researcher Gregory Fleischer reported a     vulnerability in the way Mozilla indicates the origin of     a document to the Java plugin. This vulnerability could     allow a malicious Java applet to bypass the same-origin     policy and create arbitrary socket connections to other     domains. (CVE-2008-2806 / MFSA 2008-28)

  - Mozilla developer Daniel Glazman demonstrated that an     improperly encoded .properties file in an add-on can     result in uninitialized memory being used. This could     potentially result in small chunks of data from other     programs being exposed in the browser. (CVE-2008-2807 /     MFSA 2008-29)

  - Mozilla contributor Masahiro Yamada reported that file     URLs in directory listings were not being HTML escaped     properly when the filenames contained particular     characters. This resulted in files from directory     listings being opened in unintended ways or files not     being able to be opened by the browser altogether.
    (CVE-2008-2808 / MFSA 2008-30)

  - Mozilla developer John G. Myers reported a weakness in     the trust model used by Mozilla regarding alternate     names on self-signed certificates. A user could be     prompted to accept a self-signed certificate from a     website which includes alt-name entries. If the user     accepted the certificate, they would also extend trust     to any alternate domains listed in the certificate,     despite not being prompted about the additional domains.
    This technique could be used by an attacker to     impersonate another server. (CVE-2008-2809 / MFSA     2008-31)

  - Mozilla community member Geoff reported a vulnerability     in the way Mozilla opens URL files sent directly to the     browser. He demonstrated that such files were opened     with local file privileges, giving the remote content     access to read from the local filesystem. If a user     opened a bookmark to a malicious page in this manner,     the page could potentially read from other local files     on the user's computer. (CVE-2008-2810 / MFSA 2008-32)

  - Security research firm Astabis, via the iSIGHT Partners     GVP Program, reported a vulnerability in Mozilla's block     reflow code. This vulnerablitity could be used by an     attacker to crash the browser and run arbitrary code on     the victim's computer. (CVE-2008-2811 / MFSA 2008-33)

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808)

A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

An updated firefox package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808)

A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

All Mozilla Firefox users should upgrade to this updated package, which contains backported patches that correct these issues.

Updated firefox packages that fix several security issues are now available for Fedora 8. This update has been rated as having critical security impact by the Fedora Security Response Team. Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2801, CVE-2008-2802, CVE-2008-2803) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2798, CVE-2008-2799, CVE-2008-2811) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800) Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810) A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807) A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808) A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809) Updated packages update Mozilla Firefox to upstream version 2.0.0.15 to address these flaws:
http://www.mozilla.org/projects/security/known- vulnerabilities.html#firefox2.0.0.15 This update also contains blam, chmsee, devhelp, epiphany, epiphany-extensions, galeon, gnome-python2-extras, gnome-web- photo, gtkmozembedmm, kazehakase, liferea, Miro, openvrml, ruby-gnome2 and yelp packages rebuilt against new Firefox / Gecko libraries.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2008:0549 :

An updated firefox package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808)

A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

All Mozilla Firefox users should upgrade to this updated package, which contains backported patches that correct these issues.

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.15 (CVE-2008-2798, CVE-2008-2799, CVE-2008-2800, CVE-2008-2801, CVE-2008-2802, CVE-2008-2803, CVE-2008-2805, CVE-2008-2807, CVE-2008-2808, CVE-2008-2809, CVE-2008-2811).

This update provides the latest Firefox to correct these issues.

ID	Name	Product	Family	Published	Updated	Severity
33466	Slackware 11.0 / 12.0 / 12.1 / current : seamonkey (SSA:2008-191-03)	Nessus	Slackware Local Security Checks	7/10/2008	1/14/2021	critical
33394	SeaMonkey < 1.1.10 Multiple Vulnerabilities	Nessus	Windows	7/2/2008	5/27/2026	high
33425	RHEL 5 : firefox (RHSA-2008:0569)	Nessus	Red Hat Local Security Checks	7/8/2008	1/14/2021	critical
33491	Debian DSA-1607-1 : iceweasel - several vulnerabilities	Nessus	Debian Local Security Checks	7/15/2008	1/4/2021	critical
33498	SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5405)	Nessus	SuSE Local Security Checks	7/15/2008	1/14/2021	critical
60434	Scientific Linux Security Update : firefox on SL 5.2 i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	critical
33400	CentOS 4 : firefox (CESA-2008:0549)	Nessus	CentOS Local Security Checks	7/8/2008	1/4/2021	critical
33416	Fedora 8 : Miro-1.2.3-2.fc8 / blam-1.8.3-16.fc8 / chmsee-1.0.0-2.31.fc8 / devhelp-0.16.1-8.fc8 / etc (2008-6127)	Nessus	Fedora Local Security Checks	7/8/2008	1/11/2021	critical
33424	RHEL 4 : firefox (RHSA-2008:0549)	Nessus	Red Hat Local Security Checks	7/8/2008	1/14/2021	critical
67714	Oracle Linux 4 : firefox (ELSA-2008-0549)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	critical
37211	Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:136)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical