Update to new upstream SeaMonkey version 2.0.5, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.5 CVE-2010-1121 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-0183 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to version 3.5.10, fixing various bugs and security issues.

MFSA 2010-33 / CVE-2008-5913: Security researcher Amit Klein reported that it was possible to reverse engineer the value used to seed Math.random(). Since the pseudo-random number generator was only seeded once per browsing session, this seed value could be used as a unique token to identify and track users across different websites.

MFSA 2010-32 / CVE-2010-1197: Security researcher Ilja van Sprundel of IOActive reported that the Content-Disposition: attachment HTTP header was ignored when Content-Type: multipart was also present. This issue could potentially lead to XSS problems in sites that allow users to upload arbitrary files and specify a Content-Type but rely on Content-Disposition: attachment to prevent the content from being displayed inline.

MFSA 2010-31 / CVE-2010-1125: Google security researcher Michal Zalewski reported that focus() could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location. This behaviour was also present across origins when content from one domain was embedded within another via an iframe. A malicious web page could use this behaviour to steal keystrokes from a victim while they were typing sensitive information such as a password.

MFSA 2010-30 / CVE-2010-1199: Security researcher Martin Barbella reported via TippingPoint's Zero Day Initiative that an XSLT node sorting routine contained an integer overflow vulnerability. In cases where one of the nodes to be sorted contained a very large text value, the integer used to allocate a memory buffer to store its value would overflow, resulting in too small a buffer being created. An attacker could use this vulnerability to write data past the end of the buffer, causing the browser to crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-29 / CVE-2010-1196: Security researcher Nils of MWR InfoSecurity reported that the routine for setting the text value for certain types of DOM nodes contained an integer overflow vulnerability. When a very long string was passed to this routine, the integer value used in creating a new memory buffer to hold the string would overflow, resulting in too small a buffer being allocated. An attacker could use this vulnerability to write data past the end of the buffer, causing a crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-28 / CVE-2010-1198: Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first plugin would contain a pointer to freed memory which, if accessed, could be used by an attacker to execute arbitrary code on a victim's computer.

MFSA 2010-27 / CVE-2010-0183: Security researcher wushi of team509 reported that the frame construction process for certain types of menus could result in a menu containing a pointer to a previously freed menu item. During the cycle collection process, this freed item could be accessed, resulting in the execution of a section of code potentially controlled by an attacker.

MFSA 2010-26 / CVE-2010-1200 / CVE-2010-1201 / CVE-2010-1202 / CVE-2010-1203: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2010-25 / CVE-2010-1121: A memory corruption flaw leading to code execution was reported by security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own contest sponsored by TippingPoint's Zero Day Initiative. By moving DOM nodes between documents Nils found a case where the moved node incorrectly retained its old scope. If garbage collection could be triggered at the right time then Firefox would later use this freed object. The contest winning exploit only affects Firefox 3.6 and not earlier versions. Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and Thunderbird 3.0 based on earlier versions of the browser engine were patched just in case there is an alternate way of triggering the underlying flaw.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Mozilla Firefox has been updated to version 3.5.10, fixing various bugs and security issues.

  - Security researcher Amit Klein reported that it was     possible to reverse engineer the value used to seed     Math.random(). Since the pseudo-random number generator     was only seeded once per browsing session, this seed     value could be used as a unique token to identify and     track users across different web sites. (MFSA 2010-33/     CVE-2008-5913)

  - Security researcher Ilja van Sprundel of IOActive     reported that the Content-Disposition: attachment HTTP     header was ignored when `Content-Type: multipart` was     also present. This issue could potentially lead to XSS     problems in sites that allow users to upload arbitrary     files and specify a content type but rely on     Content-Disposition: attachment to prevent the content     from being displayed inline. (MFSA 2010-32/     CVE-2010-1197)

  - Google security researcher Michal Zalewski reported that     focus() could be used to change a user's cursor focus     while they are typing, potentially directing their     keyboard input to an unintended location. This behaviour     was also present across origins when content from one     domain was embedded within another via an iframe. A     malicious web page could use this behaviour to steal     keystrokes from a victim while they were typing     sensitive information such as a password. (MFSA 2010-31/     CVE-2010-1125)

  - Security researcher Martin Barbella reported via     TippingPoint's Zero Day Initiative that an XSLT node     sorting routine contained an integer overflow     vulnerability. In cases where one of the nodes to be     sorted contained a very large text value, the integer     used to allocate a memory buffer to store its value     would overflow, resulting in too small a buffer being     created. An attacker could use this vulnerability to     write data past the end of the buffer, causing the     browser to crash and potentially running arbitrary code     on a victim's computer. (MFSA 2010-30/ CVE-2010-1199)

  - Security researcher Nils of MWR InfoSecurity reported     that the routine for setting the text value for certain     types of DOM nodes contained an integer overflow     vulnerability. When a very long string was passed to     this routine, the integer value used in creating a new     memory buffer to hold the string would overflow,     resulting in too small a buffer being allocated. An     attacker could use this vulnerability to write data past     the end of the buffer, causing a crash and potentially     running arbitrary code on a victim's computer. (MFSA     2010-29/ CVE-2010-1196)

  - Microsoft Vulnerability Research reported that two     plugin instances could interact in a way in which one     plugin gets a reference to an object owned by a second     plugin and continues to hold that reference after the     second plugin is unloaded and its object is destroyed.
    In these cases, the first plugin would contain a pointer     to freed memory which, if accessed, could be used by an     attacker to execute arbitrary code on a victim's     computer. (MFSA 2010-28/ CVE-2010-1198)

  - Security researcher Wushi of Team509 reported that the     frame construction process for certain types of menus     could result in a menu containing a pointer to a     previously freed menu item. During the cycle collection     process, this freed item could be accessed, resulting in     the execution of a section of code potentially     controlled by an attacker. (MFSA 2010-27/ CVE-2010-0183)

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-26/ CVE-2010-1200 / CVE-2010-1201 /     CVE-2010-1202 / CVE-2010-1203)

  - A memory corruption flaw leading to code execution was     reported by security researcher Nils of MWR InfoSecurity     during the 2010 Pwn2Own contest sponsored by     TippingPoint's Zero Day Initiative. By moving DOM nodes     between documents, Nils found a case where the moved     node incorrectly retained its old scope. If garbage     collection could be triggered at the right time then     Firefox would later use this freed object. The exploit     only affects Firefox 3.6 and not earlier versions.
    Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and     Thunderbird 3.0 based on earlier versions of the browser     engine were patched just in case there is an alternate     way of triggering the underlying flaw. (MFSA 2010-25/     CVE-2010-1121)

Update to new upstream Firefox version 3.6.4, fixing a security issue detailed in the upstream advisory:
http://www.mozilla.org/security/known- vulnerabilities/firefox36.html#firefox3.6.4 Update also includes packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2010-1200 CVE-2010-1202 CVE-2010-1203 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
47222	Fedora 12 : seamonkey-2.0.5-1.fc12 (2010-10329)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical
47226	Fedora 13 : seamonkey-2.0.5-1.fc13 (2010-10363)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical
47689	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	7/9/2010	1/14/2021	critical
47788	CentOS 3 / 4 : seamonkey (CESA-2010:0499)	Nessus	CentOS Local Security Checks	7/22/2010	1/4/2021	critical
50873	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 2608 / 2609)	Nessus	SuSE Local Security Checks	12/2/2010	1/14/2021	critical
47225	Fedora 13 : firefox-3.6.4-1.fc13 / galeon-2.0.7-29.fc13 / gnome-python2-extras-2.25.3-19.fc13 / etc (2010-10361)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical