Mozilla XULRunner 1.9.1 has been updated to version 1.9.1.17, fixing the following security issues :

  - Several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products have been     identified and fixed. Some of these bugs showed evidence     of memory corruption under certain circumstances, and it     is assumed that with enough effort at least some of     these could be exploited to run arbitrary code. (MFSA     2010-74 / CVE-2010-3777)

  - Several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products have been     identified and fixed. Some of these bugs showed evidence     of memory corruption under certain circumstances, and it     is assumed that with enough effort at least some of     these could be exploited to run arbitrary code. (MFSA     2011-01 / CVE-2011-0053 / CVE-2011-0062)

  - A recursive call to eval() wrapped in a try/catch     statement places the browser into a inconsistent state.
    Any dialog box opened in this state is displayed without     text and with non-functioning buttons. Closing the     window causes the dialog to evaluate to true. An     attacker could use this issue to force a user into     accepting any dialog, such as one granting elevated     privileges to the page presenting the dialog. (MFSA     2011-02 / CVE-2011-0051)

  - A method used by JSON.stringify contains a     use-after-free error in which a currently in-use pointer     was freed and subsequently dereferenced. This could lead     to arbitrary code execution if an attacker is able to     store malicious code in the freed section of memory.
    (MFSA 2011-03 / CVE-2011-0055)

  - The JavaScript engine's internal memory mapping of     non-local JS variables contains a buffer overflow which     could potentially be used by an attacker to run     arbitrary code on a victim's computer. (MFSA 2011-04 /     CVE-2011-0054)

  - The JavaScript engine's internal mapping of string     values contains an error in cases where the number of     values being stored is above 64K. In such cases an     offset pointer is manually moved forwards and backwards     to access the larger address space. If an exception is     thrown between the time that the offset pointer was     moved forward and the time it gets reset, the exception     object would be read from an invalid memory address,     potentially executing attacker-controlled memory. (MFSA     2011-05 / CVE-2011-0056)

  - A JavaScript Worker could be used to keep a reference to     an object that could be freed during garbage collection.
    Subsequent calls through this deleted reference could     cause attacker-controlled memory to be executed on a     victim's computer. (MFSA 2011-06 / CVE-2011-0057)

  - When very long strings are constructed and inserted into     an HTML document, the browser incorrectly constructs the     layout objects used to display the text. Under such     conditions an incorrect length would be calculated for a     text run resulting in too small of a memory buffer being     allocated to store the text. This issue could be used by     an attacker to write data past the end of the buffer and     execute malicious code on a victim's computer. It     affects only Mozilla browsers on Windows. (MFSA 2011-07     / CVE-2011-0058)

  - ParanoidFragmentSink, a class used to sanitize     potentially unsafe HTML for display, allows javascript:
    URLs and other inline JavaScript when the embedding     document is a chrome document. While there are no unsafe     uses of this class in any released products, extension     code could potentially use it in an unsafe manner. (MFSA     2011-08 / CVE-2010-1585)

  - When plugin-initiated requests receive a 307 redirect     response, the plugin is not notified and the request is     forwarded to the new location. This is true even for     cross-site redirects, so any custom headers that were     added as part of the initial request would be forwarded     intact across origins. This poses a CSRF risk for web     applications that rely on custom headers only being     present in requests from their own origin. (MFSA 2011-10     / CVE-2011-0059)

MozillaThunderbird was updated to version 3.1.8, fixing various security issues.

Following security issues were fixed: MFSA 2011-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous reported memory safety problems that affected Firefox 3.6 and Firefox 3.5.
(CVE-2011-0053)

Igor Bukanov and Gary Kwong reported memory safety problems that affected Firefox 3.6 only. (CVE-2011-0062)

MFSA 2011-08 / CVE-2010-1585: Mozilla security developer Roberto Suggi Liverani reported that ParanoidFragmentSink, a class used to sanitize potentially unsafe HTML for display, allows javascript: URLs and other inline JavaScript when the embedding document is a chrome document.
While there are no unsafe uses of this class in any released products, extension code could have potentially used it in an unsafe manner.

MFSA 2011-09 / CVE-2011-0061: Security researcher Jordi Chancel reported that a JPEG image could be constructed that would be decoded incorrectly, causing data to be written past the end of a buffer created to store the image. An attacker could potentially craft such an image that would cause malicious code to be stored in memory and then later executed on a victim's computer.

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

A flaw was found in the way SeaMonkey handled dialog boxes. An attacker could use this flaw to create a malicious web page that would present a blank dialog box that has non-functioning buttons. If a user closes the dialog box window, it could unexpectedly grant the malicious web page elevated privileges. (CVE-2011-0051)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2011-0053)

A flaw was found in the way SeaMonkey handled plug-ins that perform HTTP requests. If a plug-in performed an HTTP request, and the server sent a 307 redirect response, the plug-in was not notified, and the HTTP request was forwarded. The forwarded request could contain custom headers, which could result in a Cross Site Request Forgery attack.
(CVE-2011-0059)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

The installed version of Firefox 3.5 is earlier than 3.5.17.  Such versions are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption errors exist and may lead to     arbitrary code execution. (MFSA 2010-74, MFSA 2011-01)

  - An error exists in the processing of recursive calls to     'eval()' when the call is wrapped in a try/catch     statement. This error causes dialog boxes to be     displayed with no content and non-functioning buttons.
    Closing the dialog results in default acceptance of the     dialog. (MFSA 2011-02)

  - A use-after-free error exists in a method used by     'JSON.stringify' and can allow arbitrary code     execution. (MFSA 2011-03)

  - A buffer overflow vulnerability exists in the JavaScript     engine's internal memory mapping of non-local     variables and may lead to code execution. (MFSA 2011-04)

  - A buffer overflow vulnerability exists in the JavaScript     engine's internal mapping of string values and may lead     to code execution. (MFSA 2011-05)

  - A use-after-free error exists such that a JavaScript     'Worker' can be used to keep a reference to an object     which can be freed during garbage collection. This     vulnerability may lead to arbitrary code execution.
    (MFSA 2011-06)

  - A buffer overflow error exists related to the creation     very long strings and the insertion of those strings     into an HTML document. This vulnerability may lead to     arbitrary code execution. (MFSA 2011-07)

  - An input validation error exists in the class,     'ParanoidFragmentSink', which allows inline JavaScript     and 'javascript:' URLs in a chrome document. Note that     no unsafe usage occurs in Mozilla products, however     community generated extensions could.(MFSA 2011-08)

  - A cross-site request forgery (CSRF) vulnerability     exists when an HTTP 307 redirect is received in response     to a plugin's request. The request is forwarded to the     new location without the plugin's knowledge and with     custom headers intact, even across origins.     (MFSA 2011-10)

The installed version of Firefox 3.6 is earlier than 3.6.14.  Such versions are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption errors exist and may lead to     arbitrary code execution. (MFSA 2011-01)

  - An error exists in the processing of recursive calls to     'eval()' when the call is wrapped in a try/catch     statement. This error causes dialog boxes to be     displayed with no content and non-functioning buttons.
    Closing the dialog results in default acceptance of the     dialog. (MFSA 2011-02)

  - A use-after-free error exists in a method used by     'JSON.stringify' and can allow arbitrary code     execution. (MFSA 2011-03)

  - A buffer overflow vulnerability exists in the JavaScript     engine's internal memory mapping of non-local     variables and may lead to code execution. (MFSA 2011-04)

  - A buffer overflow vulnerability exists in the JavaScript     engine's internal mapping of string values and may lead     to code execution. (MFSA 2011-05)

  - A use-after-free error exists such that a JavaScript     'Worker' can be used to keep a reference to an object     which can be freed during garbage collection. This     vulnerability may lead to arbitrary code execution.
    (MFSA 2011-06)

  - A buffer overflow error exists related to the creation     very long strings and the insertion of those strings     into an HTML document. This vulnerability may lead to     arbitrary code execution. (MFSA 2011-07)

  - An input validation error exists in the class,     'ParanoidFragmentSink', which allows inline JavaScript     and 'javascript:' URLs in a chrome document. Note that     no unsafe usage occurs in Mozilla products, however     community generated extensions could.(MFSA 2011-08)

  - A buffer overflow exists related to JPEG decoding and     may lead to arbitrary code execution. (MFSA 2011-09)

  - A cross-site request forgery (CSRF) vulnerability     exists when an HTTP 307 redirect is received in response     to a plugin's request. The request is forwarded to the     new location without the plugin's knowledge and with     custom headers intact, even across origins.     (MFSA 2011-10)

ID	Name	Product	Family	Published	Updated	Severity
52651	SuSE 11.1 Security Update : mozilla-xulrunner191 (SAT Patch Number 4085)	Nessus	SuSE Local Security Checks	3/14/2011	1/19/2021	critical
53774	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-4070)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	critical
52509	CentOS 4 : seamonkey (CESA-2011:0313)	Nessus	CentOS Local Security Checks	3/3/2011	1/4/2021	critical
52530	Firefox 3.5 < 3.5.17 Multiple Vulnerabilities	Nessus	Windows	3/3/2011	6/23/2026	high
52531	Firefox 3.6 < 3.6.14 Multiple Vulnerabilities	Nessus	Windows	3/3/2011	6/23/2026	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

high