Several remote vulnerabilities have been discovered in Iceape an unbranded version of the SeaMonkey internet suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0016     Justin Schuh, Tom Cross and Peter Williams discovered a     buffer overflow in the parser for UTF-8 URLs, which may     lead to the execution of arbitrary code. (MFSA 2008-37)

  - CVE-2008-0304     It was discovered that a buffer overflow in MIME     decoding can lead to the execution of arbitrary code.
    (MFSA 2008-26)

  - CVE-2008-2785     It was discovered that missing boundary checks on a     reference counter for CSS objects can lead to the     execution of arbitrary code. (MFSA 2008-34)

  - CVE-2008-2798     Devon Hubbard, Jesse Ruderman and Martijn Wargers     discovered crashes in the layout engine, which might     allow the execution of arbitrary code. (MFSA 2008-21)

  - CVE-2008-2799     Igor Bukanov, Jesse Ruderman and Gary Kwong discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code. (MFSA 2008-21)

  - CVE-2008-2800     'moz_bug_r_a4' discovered several cross-site scripting     vulnerabilities. (MFSA 2008-22)

  - CVE-2008-2801     Collin Jackson and Adam Barth discovered that JavaScript     code could be executed in the context or signed JAR     archives. (MFSA 2008-23)

  - CVE-2008-2802     'moz_bug_r_a4' discovered that XUL documements can     escalate privileges by accessing the pre-compiled     'fastload' file. (MFSA 2008-24)

  - CVE-2008-2803     'moz_bug_r_a4' discovered that missing input sanitising     in the mozIJSSubScriptLoader.loadSubScript() function     could lead to the execution of arbitrary code. Iceape     itself is not affected, but some addons are. (MFSA     2008-25)

  - CVE-2008-2805     Claudio Santambrogio discovered that missing access     validation in DOM parsing allows malicious websites to     force the browser to upload local files to the server,     which could lead to information disclosure. (MFSA     2008-27)

  - CVE-2008-2807     Daniel Glazman discovered that a programming error in     the code for parsing .properties files could lead to     memory content being exposed to addons, which could lead     to information disclosure. (MFSA 2008-29)

  - CVE-2008-2808     Masahiro Yamada discovered that file URLs in directory     listings were insufficiently escaped. (MFSA 2008-30)

  - CVE-2008-2809     John G. Myers, Frank Benkstein and Nils Toedtmann     discovered that alternate names on self-signed     certificates were handled insufficiently, which could     lead to spoofings of secure connections. (MFSA 2008-31)

  - CVE-2008-2810     It was discovered that URL shortcut files could be used     to bypass the same-origin restrictions. This issue does     not affect current Iceape, but might occur with     additional extensions installed. (MFSA 2008-32)

  - CVE-2008-2811     Greg McManus discovered a crash in the block reflow     code, which might allow the execution of arbitrary code.
    (MFSA 2008-33)

  - CVE-2008-2933     Billy Rios discovered that passing an URL containing a     pipe symbol to Iceape can lead to Chrome privilege     escalation. (MFSA 2008-35)

  - CVE-2008-3835     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLDocument::OnChannelRedirect() could be bypassed.
    (MFSA 2008-38)

  - CVE-2008-3836     'moz_bug_r_a4' discovered that several vulnerabilities     in feedWriter could lead to Chrome privilege escalation.
    (MFSA 2008-39)

  - CVE-2008-3837     Paul Nickerson discovered that an attacker could move     windows during a mouse click, resulting in unwanted     action triggered by drag-and-drop. (MFSA 2008-40)

  - CVE-2008-4058     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4059     'moz_bug_r_a4' discovered a vulnerability which can     result in Chrome privilege escalation through     XPCNativeWrappers. (MFSA 2008-41)

  - CVE-2008-4060     Olli Pettay and 'moz_bug_r_a4' discovered a Chrome     privilege escalation vulnerability in XSLT handling.
    (MFSA 2008-41)

  - CVE-2008-4061     Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4062     Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine     Labour discovered crashes in the JavaScript engine,     which might allow the execution of arbitrary code. (MFSA     2008-42)

  - CVE-2008-4065     Dave Reed discovered that some Unicode byte order marks     are stripped from JavaScript code before execution,     which can result in code being executed, which were     otherwise part of a quoted string. (MFSA 2008-43)

  - CVE-2008-4067     Boris Zbarsky discovered that resource: URLs allow     directory traversal when using URL-encoded slashes.
    (MFSA 2008-44)

  - CVE-2008-4068     Georgi Guninski discovered that resource: URLs could     bypass local access restrictions. (MFSA 2008-44)

  - CVE-2008-4069     Billy Hoffman discovered that the XBM decoder could     reveal uninitialised memory. (MFSA 2008-45)

  - CVE-2008-4070     It was discovered that a buffer overflow could be     triggered via a long header in a news article, which     could lead to arbitrary code execution. (MFSA 2008-46)

  - CVE-2008-5012     Georgi Guninski, Michal Zalewski and Chris Evan     discovered that the canvas element could be used to     bypass same-origin restrictions. (MFSA 2008-48)

  - CVE-2008-5013     It was discovered that insufficient checks in the Flash     plugin glue code could lead to arbitrary code execution.
    (MFSA 2008-49)

  - CVE-2008-5014     Jesse Ruderman discovered that a programming error in     the window.__proto__.__proto__ object could lead to     arbitrary code execution. (MFSA 2008-50)

  - CVE-2008-5017     It was discovered that crashes in the layout engine     could lead to arbitrary code execution. (MFSA 2008-52)

  - CVE-2008-0017     Justin Schuh discovered that a buffer overflow in     http-index-format parser could lead to arbitrary code     execution. (MFSA 2008-54)

  - CVE-2008-5021     It was discovered that a crash in the nsFrameManager     might lead to the execution of arbitrary code. (MFSA     2008-55)

  - CVE-2008-5022     'moz_bug_r_a4' discovered that the same-origin check in     nsXMLHttpRequest::NotifyEventListeners() could be     bypassed. (MFSA 2008-56)

  - CVE-2008-5024     Chris Evans discovered that quote characters were     improperly escaped in the default namespace of E4X     documents. (MFSA 2008-58)

  - CVE-2008-4582     Liu Die Yu discovered an information leak through local     shortcut files. (MFSA 2008-59)

  - CVE-2008-5500     Jesse Ruderman discovered that the layout engine is     vulnerable to DoS attacks that might trigger memory     corruption and an integer overflow. (MFSA 2008-60)

  - CVE-2008-5503     Boris Zbarsky discovered that an information disclosure     attack could be performed via XBL bindings. (MFSA     2008-61)

  - CVE-2008-5506     Marius Schilder discovered that it is possible to obtain     sensible data via a XMLHttpRequest. (MFSA 2008-64)

  - CVE-2008-5507     Chris Evans discovered that it is possible to obtain     sensible data via a JavaScript URL. (MFSA 2008-65)

  - CVE-2008-5508     Chip Salzenberg discovered possible phishing attacks via     URLs with leading whitespaces or control characters.
    (MFSA 2008-66)

  - CVE-2008-5511     It was discovered that it is possible to perform     cross-site scripting attacks via an XBL binding to an     'unloaded document.' (MFSA 2008-68)

  - CVE-2008-5512     It was discovered that it is possible to run arbitrary     JavaScript with chrome privileges via unknown vectors.
    (MFSA 2008-68)

Various flaws were discovered in the browser engine. By tricking a user into opening a malicious web page, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2798, CVE-2008-2799)

Several problems were discovered in the JavaScript engine. If a user were tricked into opening a malicious web page, an attacker could perform cross-site scripting attacks. (CVE-2008-2800)

Collin Jackson discovered various flaws in the JavaScript engine which allowed JavaScript to be injected into signed JAR files. If a user were tricked into opening malicious web content, an attacker may be able to execute arbitrary code with the privileges of a different website or link content within the JAR file to an attacker-controlled JavaScript file. (CVE-2008-2801)

It was discovered that Firefox would allow non-privileged XUL documents to load chrome scripts from the fastload file. This could allow an attacker to execute arbitrary JavaScript code with chrome privileges. (CVE-2008-2802)

A flaw was discovered in Firefox that allowed overwriting trusted objects via mozIJSSubScriptLoader.loadSubScript(). If a user were tricked into opening a malicious web page, an attacker could execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2803)

Claudio Santambrogio discovered a vulnerability in Firefox which could lead to stealing of arbitrary files. If a user were tricked into opening malicious content, an attacker could force the browser into uploading local files to the remote server. (CVE-2008-2805)

Gregory Fleischer discovered a flaw in Java LiveConnect. An attacker could exploit this to bypass the same-origin policy and create arbitrary socket connections to other domains. (CVE-2008-2806)

Daniel Glazman found that an improperly encoded .properties file in an add-on can result in uninitialized memory being used. If a user were tricked into installing a malicious add-on, the browser may be able to see data from other programs. (CVE-2008-2807)

Masahiro Yamada discovered that Firefox did not properly sanitize file URLs in directory listings, resulting in files from directory listings being opened in unintended ways or not being able to be opened by the browser at all. (CVE-2008-2808)

John G. Myers discovered a weakness in the trust model used by Firefox regarding alternate names on self-signed certificates. If a user were tricked into accepting a certificate containing alternate name entries, an attacker could impersonate another server. (CVE-2008-2809)

A flaw was discovered in the way Firefox opened URL files. If a user were tricked into opening a bookmark to a malicious web page, the page could potentially read from local files on the user's computer.
(CVE-2008-2810)

A vulnerability was discovered in the block reflow code of Firefox.
This vulnerability could be used by an attacker to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2811).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-2785     It was discovered that missing boundary checks on a     reference counter for CSS objects can lead to the     execution of arbitrary code.

  - CVE-2008-2798     Devon Hubbard, Jesse Ruderman and Martijn Wargers     discovered crashes in the layout engine, which might     allow the execution of arbitrary code.

  - CVE-2008-2799     Igor Bukanov, Jesse Ruderman and Gary Kwong discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2008-2800     'moz_bug_r_a4' discovered several cross-site scripting     vulnerabilities.

  - CVE-2008-2801     Collin Jackson and Adam Barth discovered that JavaScript     code could be executed in the context of signed JAR     archives.

  - CVE-2008-2802     'moz_bug_r_a4' discovered that XUL documents can     escalate privileges by accessing the pre-compiled     'fastload' file.

  - CVE-2008-2803     'moz_bug_r_a4' discovered that missing input sanitising     in the mozIJSSubScriptLoader.loadSubScript() function     could lead to the execution of arbitrary code. Iceweasel     itself is not affected, but some addons are.

  - CVE-2008-2805     Claudio Santambrogio discovered that missing access     validation in DOM parsing allows malicious websites to     force the browser to upload local files to the server,     which could lead to information disclosure.

  - CVE-2008-2807     Daniel Glazman discovered that a programming error in     the code for parsing .properties files could lead to     memory content being exposed to addons, which could lead     to information disclosure.

  - CVE-2008-2808     Masahiro Yamada discovered that file URLs in directory     listings were insufficiently escaped.

  - CVE-2008-2809     John G. Myers, Frank Benkstein and Nils Toedtmann     discovered that alternate names on self-signed     certificates were handled insufficiently, which could     lead to spoofing of secure connections.

  - CVE-2008-2811     Greg McManus discovered a crash in the block reflow     code, which might allow the execution of arbitrary code.

  - CVE-2008-2933     Billy Rios discovered that passing an URL containing a     pipe symbol to Iceweasel can lead to Chrome privilege     escalation.

Updated thunderbird packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed HTML content.
An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed HTML content was displayed. An HTML mail containing specially crafted content could, potentially, trick a Thunderbird user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Thunderbird. An HTML mail containing malicious content could cause Thunderbird to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Thunderbird. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Thunderbird escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Thunderbird. (CVE-2008-2808)

A flaw was found in the way Thunderbird displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

Note: JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2008:0616 :

Updated thunderbird packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed HTML content.
An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed HTML content was displayed. An HTML mail containing specially crafted content could, potentially, trick a Thunderbird user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Thunderbird. An HTML mail containing malicious content could cause Thunderbird to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Thunderbird. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Thunderbird escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Thunderbird. (CVE-2008-2808)

A flaw was found in the way Thunderbird displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

Note: JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated SeaMonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in SeaMonkey. A web page containing malicious content could cause SeaMonkey to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by SeaMonkey. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way SeaMonkey escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running SeaMonkey. (CVE-2008-2808)

A flaw was found in the way SeaMonkey displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated seamonkey packages that fix several security issues are now available for Fedora 9. SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite. Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2798, CVE-2008-2799, CVE-2008-2811) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800) Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810) A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807) A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808) A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809) Updated packages update SeaMonkey to upstream version 1.1.10 to address these flaws:
http://www.mozilla.org/projects/security/known- vulnerabilities.html#seamonkey1.1.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated seamonkey packages that fix several security issues are now available for Fedora 8. SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite. Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2798, CVE-2008-2799, CVE-2008-2811) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800) Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810) A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807) A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808) A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809) Updated packages update SeaMonkey to upstream version 1.1.10 to address these flaws:
http://www.mozilla.org/projects/security/known- vulnerabilities.html#seamonkey1.1.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808)

A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed HTML content.
An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed HTML content was displayed. An HTML mail containing specially crafted content could, potentially, trick a Thunderbird user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Thunderbird. An HTML mail containing malicious content could cause Thunderbird to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Thunderbird. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Thunderbird escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Thunderbird. (CVE-2008-2808)

A flaw was found in the way Thunderbird displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

Note: JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable unless JavaScript is enabled.

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs :

CVE-2008-2798 CVE-2008-2799 MFSA-2008-21: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

CVE-2008-2800 MFSA-2008-22: Mozilla contributor moz_bug_r_a4 submitted a set of vulnerabilities which allow scripts from one document to be executed in the context of a different document. These vulnerabilities could be used by an attacker to violate the same-origin policy and perform an XSS attack.

CVE-2008-2801 MFSA-2008-23: Security researcher Collin Jackson reported a series of vulnerabilities which allow JavaScript to be injected into signed JARs and executed under the context of the JAR's signer. This could allow an attacker to run JavaScript in a victim's browser with the privileges of a different website, provided the attacker possesses a JAR signed by the other website.

CVE-2008-2802 MFSA-2008-24: Mozilla contributor moz_bug_r_a4 reported a vulnerability that allowed non-priviliged XUL documents to load chrome scripts from the fastload file. This could allow an attacker to run arbitrary JavaScript code with chrome privileges.

CVE-2008-2803 MFSA-2008-25: Mozilla contributor moz_bug_r_a4 reported a vulnerability which allows arbitrary JavaScript to be executed with chrome privileges. The privilege escalation was possible because JavaScript loaded via mozIJSSubScriptLoader.loadSubScript() was not using XPCNativeWrappers when accessing content. This could allow an attacker to overwrite trusted objects with arbitrary code which would be executed with chrome privileges when the trusted objects were called by the browser.

CVE-2008-2805 MFSA-2008-27: Opera developer Claudio Santambrogio reported a vulnerability which allows malicious content to force the browser into uploading local files to the remote server. This could be used by an attacker to steal arbitrary files from a victim's computer.

CVE-2008-2806 MFSA-2008-28: Security researcher Gregory Fleischer reported a vulnerability in the way Mozilla indicates the origin of a document to the Java plugin. This vulnerability could allow a malicious Java applet to bypass the same-origin policy and create arbitrary socket connections to other domains.

CVE-2008-2807 MFSA-2008-29: Mozilla developer Daniel Glazman demonstrated that an improperly encoded .properties file in an add-on can result in uninitialized memory being used. This could potentially result in small chunks of data from other programs being exposed in the browser.

CVE-2008-2808 MFSA-2008-30: Mozilla contributor Masahiro Yamada reported that file URLs in directory listings were not being HTML escaped properly when the filenames contained particular characters.
This resulted in files from directory listings being opened in unintended ways or files not being able to be opened by the browser altogether.

CVE-2008-2809 MFSA-2008-31: Mozilla developer John G. Myers reported a weakness in the trust model used by Mozilla regarding alternate names on self-signed certificates. A user could be prompted to accept a self-signed certificate from a website which includes alt-name entries. If the user accepted the certificate, they would also extend trust to any alternate domains listed in the certificate, despite not being prompted about the additional domains. This technique could be used by an attacker to impersonate another server.

CVE-2008-2810 MFSA-2008-32: Mozilla community member Geoff reported a vulnerability in the way Mozilla opens URL files sent directly to the browser. He demonstrated that such files were opened with local file privileges, giving the remote content access to read from the local filesystem. If a user opened a bookmark to a malicious page in this manner, the page could potentially read from other local files on the user's computer.

CVE-2008-2811 MFSA 2008-33: Security research firm Astabis, via the iSIGHT Partners GVP Program, reported a vulnerability in Mozilla's block reflow code. This vulnerablitity could be used by an attacker to crash the browser and run arbitrary code on the victim's computer.

ID	Name	Product	Family	Published	Updated	Severity
35314	Debian DSA-1697-1 : iceape - several vulnerabilities	Nessus	Debian Local Security Checks	1/8/2009	1/4/2021	critical
33436	Ubuntu 6.06 LTS / 7.04 / 7.10 : firefox vulnerabilities (USN-619-1)	Nessus	Ubuntu Local Security Checks	7/8/2008	1/19/2021	critical
33567	Debian DSA-1615-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	7/24/2008	1/4/2021	critical
33571	RHEL 4 / 5 : thunderbird (RHSA-2008:0616)	Nessus	Red Hat Local Security Checks	7/24/2008	1/14/2021	critical
67731	Oracle Linux 4 : thunderbird (ELSA-2008-0616)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	critical
33399	CentOS 3 / 4 : seamonkey (CESA-2008:0547)	Nessus	CentOS Local Security Checks	7/8/2008	1/4/2021	critical
33454	Fedora 9 : seamonkey-1.1.10-1.fc9 (2008-6193)	Nessus	Fedora Local Security Checks	7/10/2008	1/11/2021	critical
33455	Fedora 8 : seamonkey-1.1.10-1.fc8 (2008-6196)	Nessus	Fedora Local Security Checks	7/10/2008	1/11/2021	critical
60433	Scientific Linux Security Update : firefox on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	critical
60449	Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	critical
33499	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5411)	Nessus	SuSE Local Security Checks	7/15/2008	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical