The Mozilla Project reports :

MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)

MFSA 2012-02 Overly permissive IPv6 literal syntax

MFSA 2012-03 iframe element exposed across domains via name attribute

MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes

MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks

MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure

MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files

MFSA 2012-08 Crash with malformed embedded XSLT stylesheets

MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission

Changes in MozillaFirefox :

  - update to Firefox 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - KDE integration has been disabled since it needs     refactoring

  - removed obsolete ppc64 patch

  - Disable neon for arm as it doesn't build correctly

Changes in MozillaThunderbird :

  - update to version 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - update enigmail to 1.3.5

  - added mozilla-disable-neon-option.patch to be able to     disable neon on ARM

  - removed obsolete PPC64 patch

Changes in seamonkey :

  - update to SeaMonkey 2.7 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

Changes in xulrunner :

  - update to version 10.0 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-03/CVE-2012-0445 (bmo#701071) <iframe> element     exposed across domains via name attribute

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-05/CVE-2012-0446 (bmo#705651) Frame scripts     calling into untrusted objects bypass security checks

  - MFSA 2012-06/CVE-2012-0447 (bmo#710079) Uninitialized     memory appended when encoding icon images may cause     information disclosure

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

  - removed obsolete ppc64 patch

  - disable neon for ARM as it doesn't build correctly

Changes in mozilla-xulrunner192 :

  - security update to 1.9.2.26 (bnc#744275)

  - MFSA 2012-01/CVE-2012-0442/CVE-2012-0443 Miscellaneous     memory safety hazards

  - MFSA 2012-02/CVE-2011-3670 (bmo#504014)

  - MFSA 2012-04/CVE-2011-3659 (bmo#708198) Child nodes from     nsDOMAttribute still accessible after removal of nodes

  - MFSA 2012-07/CVE-2012-0444 (bmo#719612) Potential Memory     Corruption When Decoding Ogg Vorbis files

  - MFSA 2012-08/CVE-2012-0449 (bmo#701806, bmo#702466)     Crash with malformed embedded XSLT stylesheets

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
57785	FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	2/2/2012	1/6/2021	critical
74833	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / chmsee / etc (openSUSE-2012-83)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	10/6/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical