The Mozilla Firefox browser was updated to version 3.0.0.15 to fix various bugs and security issues.

Following security issues have been fixed: MFSA 2009-52 / CVE-2009-3370: Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to theft. A malicious web page could synthesize events such as mouse focus and key presses on behalf of the victim and trick the browser into auto-filling the form fields with history entries and then reading the entries.

MFSA 2009-53 / CVE-2009-3274: Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer and knew the name of a file the victim intended to open through the Download Manager, he could use this vulnerability to place a malicious file in the world-writable directory used to save temporary downloaded files and cause the browser to choose the incorrect file when opening it. Since this attack requires local access to the victim's machine, the severity of this vulnerability was determined to be low.

MFSA 2009-54 / CVE-2009-3371: Security researcher Orlando Berrera of Sec Theory reported that recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. These conditions often result in a crash which could potentially be used by an attacker to run arbitrary code on a victim's computer.

MFSA 2009-55 / CVE-2009-3372: Security researcher Marco C. reported a flaw in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. In certain cases this flaw could be used by an attacker to crash a victim's browser and run arbitrary code on their computer. Since this vulnerability requires the victim to have PAC configured in their environment with specific regular expresssions which can trigger the crash, the severity of the issue was determined to be moderate.

MFSA 2009-56 / CVE-2009-3373: Security research firm iDefense reported that researcher regenrecht discovered a heap-based buffer overflow in Mozilla's GIF image parser. This vulnerability could potentially be used by an attacker to crash a victim's browser and run arbitrary code on their computer.

MFSA 2009-57 / CVE-2009-3374: Mozilla security researcher moz_bug_r_a4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web content, potentially executing malicious JavaScript code with chrome privileges.

MFSA 2009-59 / CVE-2009-1563: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer.

MFSA 2009-61 / CVE-2009-3375: Security researcher Gregory Fleischer reported that text within a selection on a web page can be read by JavaScript in a different domain using the document.getSelection function, violating the same-origin policy. Since this vulnerability requires user interaction to exploit, its severity was determined to be moderate.

MFSA 2009-62 / CVE-2009-3376: Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file.

MFSA 2009-64 / CVE-2009-3380 / CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383: Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3380     Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers,     Daniel Banchero, David Keeler and Boris Zbarsky reported     crashes in layout engine, which might allow the     execution of arbitrary code.

  - CVE-2009-3382     Carsten Book reported a crash in the layout engine,     which might allow the execution of arbitrary code.

  - CVE-2009-3376     Jesse Ruderman and Sid Stamm discovered spoofing     vulnerability in the file download dialog.

  - CVE-2009-3375     Gregory Fleischer discovered a bypass of the same-origin     policy using the document.getSelection() function.

  - CVE-2009-3374     'moz_bug_r_a4' discovered a privilege escalation to     Chrome status in the XPCOM utility     XPCVariant::VariantDataToJS.

  - CVE-2009-3373     'regenrecht' discovered a buffer overflow in the GIF     parser, which might lead to the execution of arbitrary     code.

  - CVE-2009-3372     Marco C. discovered that a programming error in the     proxy auto configuration code might lead to denial of     service or the execution of arbitrary code.

  - CVE-2009-3274     Jeremy Brown discovered that the filename of a     downloaded file which is opened by the user is     predictable, which might lead to tricking the user into     a malicious file if the attacker has local access to the     system.

  - CVE-2009-3370     Paul Stone discovered that history information from web     forms could be stolen.

From Red Hat Security Advisory 2009:1531 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

A flaw was found in the way SeaMonkey creates temporary file names for downloaded files. If a local attacker knows the name of a file SeaMonkey is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274)

A heap-based buffer overflow flaw was found in the SeaMonkey string to floating point conversion routines. A web page containing malicious JavaScript could crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey.
(CVE-2009-1563)

A flaw was found in the way SeaMonkey handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375)

A flaw was found in the way SeaMonkey displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3380)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1530 advisory.

    Mozilla Firefox is an open source Web browser. XULRunner provides the XUL     Runtime environment for Mozilla Firefox. nspr provides the Netscape     Portable Runtime (NSPR).

    A flaw was found in the way Firefox handles form history. A malicious web     page could steal saved form data by synthesizing input events, causing the     browser to auto-fill form fields (which could then be read by an attacker).
    (CVE-2009-3370)

    A flaw was found in the way Firefox creates temporary file names for     downloaded files. If a local attacker knows the name of a file Firefox is     going to download, they can replace the contents of that file with     arbitrary contents. (CVE-2009-3274)

    A flaw was found in the Firefox Proxy Auto-Configuration (PAC) file     processor. If Firefox loads a malicious PAC file, it could crash Firefox     or, potentially, execute arbitrary code with the privileges of the user     running Firefox. (CVE-2009-3372)

    A heap-based buffer overflow flaw was found in the Firefox GIF image     processor. A malicious GIF image could crash Firefox or, potentially,     execute arbitrary code with the privileges of the user running Firefox.
    (CVE-2009-3373)

    A heap-based buffer overflow flaw was found in the Firefox string to     floating point conversion routines. A web page containing malicious     JavaScript could crash Firefox or, potentially, execute arbitrary code with     the privileges of the user running Firefox. (CVE-2009-1563)

    A flaw was found in the way Firefox handles text selection. A malicious     website may be able to read highlighted text in a different domain (e.g.
    another website the user is viewing), bypassing the same-origin policy.
    (CVE-2009-3375)

    A flaw was found in the way Firefox displays a right-to-left override     character when downloading a file. In these cases, the name displayed in     the title bar differs from the name displayed in the dialog body. An     attacker could use this flaw to trick a user into downloading a file that     has a file name or extension that differs from what the user expected.
    (CVE-2009-3376)

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Firefox to crash or,     potentially, execute arbitrary code with the privileges of the user running     Firefox. (CVE-2009-3374, CVE-2009-3380, CVE-2009-3382)

    For technical details regarding these flaws, refer to the Mozilla security     advisories for Firefox 3.0.15. You can find a link to the Mozilla     advisories in the References section of this errata.

    All Firefox users should upgrade to these updated packages, which contain     Firefox version 3.0.15, which corrects these issues. After installing the     update, Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1531 advisory.

    SeaMonkey is an open source Web browser, email and newsgroup client, IRC     chat client, and HTML editor.

    A flaw was found in the way SeaMonkey creates temporary file names for     downloaded files. If a local attacker knows the name of a file SeaMonkey is     going to download, they can replace the contents of that file with     arbitrary contents. (CVE-2009-3274)

    A heap-based buffer overflow flaw was found in the SeaMonkey string to     floating point conversion routines. A web page containing malicious     JavaScript could crash SeaMonkey or, potentially, execute arbitrary code     with the privileges of the user running SeaMonkey. (CVE-2009-1563)

    A flaw was found in the way SeaMonkey handles text selection. A malicious     website may be able to read highlighted text in a different domain (e.g.
    another website the user is viewing), bypassing the same-origin policy.
    (CVE-2009-3375)

    A flaw was found in the way SeaMonkey displays a right-to-left override     character when downloading a file. In these cases, the name displayed in     the title bar differs from the name displayed in the dialog body. An     attacker could use this flaw to trick a user into downloading a file that     has a file name or extension that differs from what the user expected.
    (CVE-2009-3376)

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause SeaMonkey to crash or,     potentially, execute arbitrary code with the privileges of the user running     SeaMonkey. (CVE-2009-3380)

    All SeaMonkey users should upgrade to these updated packages, which correct     these issues. After installing the update, SeaMonkey must be restarted for     the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

A flaw was found in the way SeaMonkey creates temporary file names for downloaded files. If a local attacker knows the name of a file SeaMonkey is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274)

A heap-based buffer overflow flaw was found in the SeaMonkey string to floating point conversion routines. A web page containing malicious JavaScript could crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey.
(CVE-2009-1563)

A flaw was found in the way SeaMonkey handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375)

A flaw was found in the way SeaMonkey displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3380)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The Mozilla Firefox browser was updated to version 3.5.4 to fix various bugs and security issues.

The following security issues have been fixed :

  - Security researcher Paul Stone reported that a user's     form history, both from web content as well as the smart     location bar, was vulnerable to theft. A malicious web     page could synthesize events such as mouse focus and key     presses on behalf of the victim and trick the browser     into auto-filling the form fields with history entries     and then reading the entries. (MFSA 2009-52 /     CVE-2009-3370)

  - Security researcher Jeremy Brown reported that the file     naming scheme used for downloading a file which already     exists in the downloads folder is predictable. If an     attacker had local access to a victim's computer and     knew the name of a file the victim intended to open     through the Download Manager, he could use this     vulnerability to place a malicious file in the     world-writable directory used to save temporary     downloaded files and cause the browser to choose the     incorrect file when opening it. Since this attack     requires local access to the victim's machine, the     severity of this vulnerability was determined to be low.
    (MFSA 2009-53 / CVE-2009-3274)

  - Security researcher Orlando Berrera of Sec Theory     reported that recursive creation of JavaScript     web-workers can be used to create a set of objects whose     memory could be freed prior to their use. These     conditions often result in a crash which could     potentially be used by an attacker to run arbitrary code     on a victim's computer. (MFSA 2009-54 / CVE-2009-3371)

  - Security researcher Marco C. reported a flaw in the     parsing of regular expressions used in Proxy     Auto-configuration (PAC) files. In certain cases this     flaw could be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. Since     this vulnerability requires the victim to have PAC     configured in their environment with specific regular     expresssions which can trigger the crash, the severity     of the issue was determined to be moderate. (MFSA     2009-55 / CVE-2009-3372)

  - Security research firm iDefense reported that researcher     regenrecht discovered a heap-based buffer overflow in     Mozilla's GIF image parser. This vulnerability could     potentially be used by an attacker to crash a victim's     browser and run arbitrary code on their computer. (MFSA     2009-56 / CVE-2009-3373)

  - Mozilla security researcher moz_bug_r_a4 reported that     the XPCOM utility XPCVariant::VariantDataToJS unwrapped     doubly-wrapped objects before returning them to chrome     callers. This could result in chrome privileged code     calling methods on an object which had previously been     created or modified by web content, potentially     executing malicious JavaScript code with chrome     privileges. (MFSA 2009-57 / CVE-2009-3374)

  - Security researcher Alin Rad Pop of Secunia Research     reported a heap-based buffer overflow in Mozilla's     string to floating point number conversion routines.
    Using this vulnerability an attacker could craft some     malicious JavaScript code containing a very long string     to be converted to a floating point number which would     result in improper memory allocation and the execution     of an arbitrary memory location. This vulnerability     could thus be leveraged by the attacker to run arbitrary     code on a victim's computer. (MFSA 2009-59 /     CVE-2009-1563)

  - Security researcher Gregory Fleischer reported that text     within a selection on a web page can be read by     JavaScript in a different domain using the     document.getSelection function, violating the     same-origin policy. Since this vulnerability requires     user interaction to exploit, its severity was determined     to be moderate. (MFSA 2009-61 / CVE-2009-3375)

  - Mozilla security researchers Jesse Ruderman and Sid     Stamm reported that when downloading a file containing a     right-to-left override character (RTL) in the filename,     the name displayed in the dialog title bar conflicts     with the name of the file shown in the dialog body. An     attacker could use this vulnerability to obfuscate the     name and file extension of a file to be downloaded and     opened, potentially causing a user to run an executable     file when they expected to open a non-executable file.
    (MFSA 2009-62 / CVE-2009-3376)

  - Mozilla upgraded several thirdparty libraries used in     media rendering to address multiple memory safety and     stability bugs identified by members of the Mozilla     community. Some of the bugs discovered could potentially     be used by an attacker to crash a victim's browser and     execute arbitrary code on their computer. liboggz,     libvorbis, and liboggplay were all upgraded to address     these issues. Audio and video capabilities were added in     Firefox 3.5 so prior releases of Firefox were not     affected. Georgi Guninski reported a crash in liboggz.
    (CVE-2009-3377), Lucas Adamski, Matthew Gregan, David     Keeler, and Dan Kaminsky reported crashes in libvorbis.
    (CVE-2009-3379), Juan Becerra reported a crash in     liboggplay. (CVE-2009-3378). (MFSA 2009-63 /     CVE-2009-3377 / CVE-2009-3379 / CVE-2009-3378)

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-64 / CVE-2009-3380 /     CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383)

ID	Name	Product	Family	Published	Updated	Severity
42391	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1499)	Nessus	SuSE Local Security Checks	11/5/2009	1/14/2021	critical
44787	Debian DSA-1922-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2/24/2010	1/4/2021	critical
67949	Oracle Linux 3 / 4 : seamonkey (ELSA-2009-1531)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	critical
42287	RHEL 4 / 5 : firefox (RHSA-2009:1530)	Nessus	Red Hat Local Security Checks	10/28/2009	9/24/2025	critical
42288	RHEL 4 : seamonkey (RHSA-2009:1531)	Nessus	Red Hat Local Security Checks	10/28/2009	9/24/2025	critical
42296	CentOS 3 / 4 : seamonkey (CESA-2009:1531)	Nessus	CentOS Local Security Checks	10/29/2009	1/4/2021	critical
42363	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1488)	Nessus	SuSE Local Security Checks	11/4/2009	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical