The Mozilla Firefox was updated to version 3.5.6, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3980/CVE-2009-3982     Crashes with evidence of memory corruption (rv:1.9.1.6)

  - MFSA 2009-66/CVE-2009-3388 (bmo#504843,bmo#523816)     Memory safety fixes in liboggplay media library

  - MFSA 2009-67/CVE-2009-3389 (bmo#515882,bmo#504613)     Integer overflow, crash in libtheora video library

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

The Mozilla SeaMonkey browser suite was updated to version 2.0.1, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3981 Crashes with     evidence of memory corruption (1.9.0.16)

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

  - MFSA 2009-71/CVE-2009-3987: COM object enumeration only     affects Windows operating systems.

The installed version of SeaMonkey is earlier than 2.0.1.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code execution.     (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay' can lead to     arbitrary code execution. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library can     lead to a crash or the execution of arbitrary code.
    (MFSA 2009-67)

  - The NTLM implementation is vulnerable to reflection     attacks in which NTLM credentials from one application     can be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities exist.
    (MFSA 2009-69)

  - A content window which is opened by a chrome window     retains a reference to the chrome window via the     'window.opener' property, which can lead to privilege     escalation. (MFSA 2009-70)

  - The exception messages generated by the     'GeckoActiveXObject' differ based on whether or not the     requested COM object's ProgID is present in the system     registry. (MFSA 2009-71)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-445:05 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    Security bugs fixed with this release:
    CVE-2009-3979     CVE-2009-3981     CVE-2009-3983     CVE-2009-3984     CVE-2009-3985     CVE-2009-3986     No description available at the time of writing, please see CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-873-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream changes introduced a regression when using NTLM authentication. This update fixes the problem and adds additional stability fixes.

We apologize for the inconvenience.

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3979, CVE-2009-3981, CVE-2009-3986)

Takehiro Takahashi discovered flaws in the NTLM implementation in Firefox. If an NTLM authenticated user visited a malicious website, a remote attacker could send requests to other applications, authenticated as the user.
(CVE-2009-3983)

Jonathan Morgan discovered that Firefox did not properly display SSL indicators under certain circumstances. This could be used by an attacker to spoof an encrypted page, such as in a phishing attack. (CVE-2009-3984)

Jordi Chancel discovered that Firefox did not properly display invalid URLs for a blank page. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. (CVE-2009-3985).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3986 :
    David James discovered that the window.opener property     allows Chrome privilege escalation.

  - CVE-2009-3985 :
    Jordi Chanel discovered a spoofing vulnerability of the     URL location bar using the document.location property.

  - CVE-2009-3984 :
    Jonathan Morgan discovered that the icon indicating a     secure connection could be spoofed through the     document.location property.

  - CVE-2009-3983 :
    Takehiro Takahashi discovered that the NTLM     implementation is vulnerable to reflection attacks.

  - CVE-2009-3981 :
    Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code.

  - CVE-2009-3979 :
    Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel     and Olli Pettay discovered crashes in the layout engine,     which might allow the execution of arbitrary code.

The Mozilla XULRunner engine was updated to version 1.9.0.16, fixing lots of bugs and various security issues.

The following issues were fixed :

  - Crashes with evidence of memory corruption (1.9.0.16).
    (MFSA 2009-65 / CVE-2009-3979 / CVE-2009-3981)

  - (bmo#487872) NTLM reflection vulnerability. (MFSA     2009-68 / CVE-2009-3983)

  - (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities. (MFSA 2009-69 / CVE-2009-3984 /     CVE-2009-3985)

  - (bmo#522430) Privilege escalation via chrome     window.opener. (MFSA 2009-70 / CVE-2009-3986)

ID	Name	Product	Family	Published	Updated	Severity
43383	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1708)	Nessus	SuSE Local Security Checks	12/22/2009	1/14/2021	high
43619	openSUSE Security Update : seamonkey (seamonkey-1738)	Nessus	SuSE Local Security Checks	1/3/2010	1/14/2021	high
43175	SeaMonkey < 2.0.1 Multiple Vulnerabilities	Nessus	Windows	12/16/2009	5/27/2026	high
284100	MiracleLinux 3 : firefox-3.0.16-1.1AXS3 (AXSA:2009-445:05)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
43823	Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 regression (USN-877-1)	Nessus	Ubuntu Local Security Checks	1/8/2010	9/19/2019	high
44821	Debian DSA-1956-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2/24/2010	1/4/2021	high
49898	SuSE 10 Security Update : XULRunner (ZYPP Patch Number 6734)	Nessus	SuSE Local Security Checks	10/11/2010	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high