USN-645-1 fixed vulnerabilities in Firefox and xulrunner for Ubuntu 7.04, 7.10 and 8.04 LTS. This provides the corresponding update for Ubuntu 6.06 LTS.

Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016)

It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website.
(CVE-2008-3835)

Several problems were discovered in the JavaScript engine.
This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836)

Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837)

Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060)

Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064)

Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065)

Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066)

Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068)

Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues :

  - XBM image uninitialized memory reading. (MFSA 2008-45 /     CVE-2008-4069)

  - resource: traversal vulnerabilities. (MFSA 2008-44 /     CVE-2008-4067 / CVE-2008-4068)

  - BOM characters stripped from JavaScript before execution     CVE-2008-4065: Stripped BOM characters bug     CVE-2008-4066: HTML escaped low surrogates bug. (MFSA     2008-43)

  - Crashes with evidence of memory corruption     (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman     reported a crash in the layout engine. CVE-2008-4062:
    Igor Bukanov, Philip Taylor, Georgi Guninski, and     Antoine Labour reported crashes in the JavaScript     engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and     Martijn Wargers reported crashes in the layout engine     which only affected Firefox 3. CVE-2008-4064: David     Maciejak and Drew Yao reported crashes in graphics     rendering which only affected Firefox 3. (MFSA 2008-42)

  - Privilege escalation via XPCnativeWrapper pollution     CVE-2008-4058: XPCnativeWrapper pollution bugs     CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2)     CVE-2008-4060: Documents without script handling     objects. (MFSA 2008-41)

  - Forced mouse drag. (MFSA 2008-40 / CVE-2008-3837)

  - Privilege escalation using feed preview page and XSS     flaw. (MFSA 2008-39 / CVE-2008-3836)

  - nsXMLDocument::OnChannelRedirect() same-origin     violation. (MFSA 2008-38 / CVE-2008-3835)

  - UTF-8 URL stack buffer overflow. (MFSA 2008-37 /     CVE-2008-0016)

For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefo x20.html

This update brings Mozilla Thunderbird to version 2.0.0.17.

It contains the following security fixes: MFSA 2008-46 / CVE-2008-4070: Heap overflow when canceling a newsgroup message

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059:
XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

For more details:
http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.ht ml

This patch updates SeaMonkey to version 1.1.12, fixing security and other bugs :

MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059:
XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects

MFSA 2008-40 / CVE-2008-3837: Forced mouse drag

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

Details can be found here:
http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html

This update brings mozilla-xulrunner181 to security fix version 1.8.1.17.

It contains the following security fixes: MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution CVE-2008-4065: Stripped BOM characters bug CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17): CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine. CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski, and Antoine Labour reported crashes in the JavaScript engine. CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers reported crashes in the layout engine which only affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution CVE-2008-4058: XPCnativeWrapper pollution bugs CVE-2008-4059:
XPCnativeWrapper pollution (Firefox 2) CVE-2008-4060: Documents without script handling objects

MFSA 2008-40 / CVE-2008-3837: Forced mouse drag

MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefox20.html

Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016)

It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in the context of a different website. (CVE-2008-3835)

Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836)

Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations.
(CVE-2008-3837)

Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges.
(CVE-2008-4058, CVE-2008-4059, CVE-2008-4060)

Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064)

Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks.
(CVE-2008-4065)

Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks.
(CVE-2008-4066)

Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068)

Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash.
(CVE-2008-4069).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Versions of Firefox 3.x prior to 3.0.2 are affected by various security issues : 

 - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40).
 - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA 2008-41).
 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption (MFSA 2008-42).
 - Certain BOM characters and low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is executed, which could allow for cross-site scripting attacks (MFSA 2008-43).
 - The 'resource: ' protocol allows directory traversal on Linux when using URL-encoded slashes, and it can by used to bypass restrictions on local HTML files (MFSA 2008-44).

Versions of Firefox prior to 2.0.0.17 are affected by various security issues : 

 - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37).
 - It is possible to bypass the same-origin check in 'nsXMLDocument: : OnChannelRedirect()' (MFSA 2008-38).
 - There are a series of vulnerabilities in 'feedWriter' that allow scripts from page content to run with chrome privileges (MFSA 2008-39).
 - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40).
 - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA 2008-41).
 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption (MFSA 2008-42).
 - Certain BOM characters and low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is executed, which could allow for cross-site scripting attacks (MFSA 2008-43).
 - The 'resource: ' protocol allows directory traversal on Linux when using URL-encoded slashes, and it can be used to bypass restrictions on local HTML files (MFSA 2008-44).
 - A bug in the XBM decoder allows random small chunks of uninitialized memory to be read (MFSA 2008-45).

 The installed version of SeaMonkey is affected by various security issues : 

  - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37).
  - It is possible to bypass the same-origin check in 'nsXMLDocument: : OnChannelRedirect()' (MFSA 2008-38).
  - An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40).
  - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA 2008-41).
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption (MFSA 2008-42).
  - Certain BOM characters and low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is executed, which could allow for cross-site scripting attacks (MFSA 2008-43).
  - The 'resource: ' protocol allows directory traversal on Linux when using URL-encoded slashes, and it can by used to bypass restrictions on local HTML files (MFSA 2008-44).
  - A bug in the XBM decoder allows random small chunks of uninitialized memory to be read (MFSA 2008-45).

Versions of Mozilla Thunderbird prior to 2.0.0.17 are affected by the following vulnerabilities :

 - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA 2008-37).
 - It is possible to bypass the same-origin check in 'nsXMLDocument::OnChannelRedirect()' (MFSA 2008-38).
 - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA 2008-41).
 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption (MFSA 2008-42).
 - Certain BOM characters and low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is executed, which could allow for cross-site scripting attacks (MFSA 2008-43).
 - The 'resource:' protocol allows directory traversal on Linux when using URL-encoded slashes, and it can by used to bypass restrictions on local HTML files (MFSA 2008-44).
 - There is a heap buffer overflow that can be triggered when canceling a newsgroup message (MFSA 2008-46).

The installed version of Firefox is affected by various security issues : 

- An attacker can cause the content window to move while the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA 2008-40).
  - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA 2008-41).
  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption (MFSA 2008-42).
  - Certain BOM characters and low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is executed, which could allow for cross-site scripting attacks (MFSA 2008-43).
  - The 'resource: ' protocol allows directory traversal on Linux when using URL-encoded slashes, and it can by used to bypass restrictions on local HTML files (MFSA 2008-44).

ID	Name	Product	Family	Published	Updated	Severity
65110	Ubuntu 6.06 LTS : firefox vulnerabilities (USN-645-2)	Nessus	Ubuntu Local Security Checks	3/9/2013	1/19/2021	critical
34319	SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)	Nessus	SuSE Local Security Checks	10/1/2008	1/14/2021	critical
34345	openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5655)	Nessus	SuSE Local Security Checks	10/6/2008	1/14/2021	critical
34360	openSUSE 10 Security Update : seamonkey (seamonkey-5657)	Nessus	SuSE Local Security Checks	10/7/2008	1/14/2021	critical
34367	openSUSE 10 Security Update : mozilla-xulrunner181 (mozilla-xulrunner181-5656)	Nessus	SuSE Local Security Checks	10/8/2008	1/14/2021	critical
36243	Ubuntu 7.04 / 7.10 / 8.04 LTS : firefox, firefox-3.0, xulrunner-1.9 vulnerabilities (USN-645-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	12/5/2022	critical
4691	Mozilla Firefox < 3.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/24/2008	3/6/2019	medium
4692	Mozilla Firefox < 2.0.0.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/24/2008	3/6/2019	medium
4693	SeaMonkey < 1.1.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/24/2008	3/6/2019	medium
4696	Mozilla Thunderbird < 2.0.0.17 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	9/26/2008	3/6/2019	medium
800756	Firefox < 3.0.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

high