Mozilla Project reports :

MFSA 2010-33 User tracking across sites using Math.random()

MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type:
multipart also present

MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes

MFSA 2010-30 Integer Overflow in XSLT Node Sorting

MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal

MFSA 2010-28 Freed object reuse across plugin instances

MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()

MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

MFSA 2010-25 Re-use of freed object due to scope confusion

Update to new upstream SeaMonkey version 2.0.5, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.5 CVE-2010-1121 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-0183 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream Firefox version 3.6.4, fixing a security issue detailed in the upstream advisory:
http://www.mozilla.org/security/known- vulnerabilities/firefox36.html#firefox3.6.4 Update also includes packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2010-1200 CVE-2010-1202 CVE-2010-1203 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox has been updated to version 3.5.10, fixing various bugs and security issues.

  - Security researcher Amit Klein reported that it was     possible to reverse engineer the value used to seed     Math.random(). Since the pseudo-random number generator     was only seeded once per browsing session, this seed     value could be used as a unique token to identify and     track users across different web sites. (MFSA 2010-33/     CVE-2008-5913)

  - Security researcher Ilja van Sprundel of IOActive     reported that the Content-Disposition: attachment HTTP     header was ignored when `Content-Type: multipart` was     also present. This issue could potentially lead to XSS     problems in sites that allow users to upload arbitrary     files and specify a content type but rely on     Content-Disposition: attachment to prevent the content     from being displayed inline. (MFSA 2010-32/     CVE-2010-1197)

  - Google security researcher Michal Zalewski reported that     focus() could be used to change a user's cursor focus     while they are typing, potentially directing their     keyboard input to an unintended location. This behaviour     was also present across origins when content from one     domain was embedded within another via an iframe. A     malicious web page could use this behaviour to steal     keystrokes from a victim while they were typing     sensitive information such as a password. (MFSA 2010-31/     CVE-2010-1125)

  - Security researcher Martin Barbella reported via     TippingPoint's Zero Day Initiative that an XSLT node     sorting routine contained an integer overflow     vulnerability. In cases where one of the nodes to be     sorted contained a very large text value, the integer     used to allocate a memory buffer to store its value     would overflow, resulting in too small a buffer being     created. An attacker could use this vulnerability to     write data past the end of the buffer, causing the     browser to crash and potentially running arbitrary code     on a victim's computer. (MFSA 2010-30/ CVE-2010-1199)

  - Security researcher Nils of MWR InfoSecurity reported     that the routine for setting the text value for certain     types of DOM nodes contained an integer overflow     vulnerability. When a very long string was passed to     this routine, the integer value used in creating a new     memory buffer to hold the string would overflow,     resulting in too small a buffer being allocated. An     attacker could use this vulnerability to write data past     the end of the buffer, causing a crash and potentially     running arbitrary code on a victim's computer. (MFSA     2010-29/ CVE-2010-1196)

  - Microsoft Vulnerability Research reported that two     plugin instances could interact in a way in which one     plugin gets a reference to an object owned by a second     plugin and continues to hold that reference after the     second plugin is unloaded and its object is destroyed.
    In these cases, the first plugin would contain a pointer     to freed memory which, if accessed, could be used by an     attacker to execute arbitrary code on a victim's     computer. (MFSA 2010-28/ CVE-2010-1198)

  - Security researcher Wushi of Team509 reported that the     frame construction process for certain types of menus     could result in a menu containing a pointer to a     previously freed menu item. During the cycle collection     process, this freed item could be accessed, resulting in     the execution of a section of code potentially     controlled by an attacker. (MFSA 2010-27/ CVE-2010-0183)

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-26/ CVE-2010-1200 / CVE-2010-1201 /     CVE-2010-1202 / CVE-2010-1203)

  - A memory corruption flaw leading to code execution was     reported by security researcher Nils of MWR InfoSecurity     during the 2010 Pwn2Own contest sponsored by     TippingPoint's Zero Day Initiative. By moving DOM nodes     between documents, Nils found a case where the moved     node incorrectly retained its old scope. If garbage     collection could be triggered at the right time then     Firefox would later use this freed object. The exploit     only affects Firefox 3.6 and not earlier versions.
    Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and     Thunderbird 3.0 based on earlier versions of the browser     engine were patched just in case there is an alternate     way of triggering the underlying flaw. (MFSA 2010-25/     CVE-2010-1121)

Versions of SeaMonkey earlier than 2.0.5 are potentially affected by multiple vulnerabilities :

  A re-use of a freed object due to scope confusion. (MFSA 2010-25)

  - Multiple crashes can result in code execution. (MFSA 2010-26)

  - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)

  - Freed object reuse across plugin instances. (MFSA 2010-28)

  - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)

  - An integer overflow in XSLT node sorting. (MFSA 2010-30)

  The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

Versions of Firefox 3.6.x prior to 3.6.4 are potentially affected by multiple vulnerabilities :

 - Multiple crashes can result in code execution. (MFSA 2010-26)
 - Freed object reuse across plugin instances. (MFSA 2010-28)
 - A heap buffer overflow in 'nsGenericDOMDataNode::SetTextInternal'. (MFSA 2010-29)
 - An integer overflow in XSLT node sorting. (MFSA 2010-30)
 - The 'focus()' behavior can be used to inject or steal keystrokes. (MFSA 2010-31)
 - The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)
 - It is possible to reverse engineer the value used to seed 'Math.random()'. (MFSA 2008-33)

Versions of Firefox earlier than 3.5.10 are potentially affected by multiple vulnerabilities :

 - A re-use of a freed object due to scope confusion. (MFSA 2010-25)
 - Multiple crashes can result in code execution. (MFSA 2010-26)
 - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)
 - Freed object reuse across plugin instances. (MFSA 2010-28)
 - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)
 - An integer overflow in XSLT node sorting. (MFSA 2010-30)
 The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

Versions of Firefox 3.6.x earlier than 3.6.4 are potentially affected by multiple vulnerabilities :

  - Multiple crashes can result in code execution. (MFSA 2010-26)

  - Freed object reuse across plugin instances. (MFSA 2010-28)

  - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)

  - An integer overflow in XSLT node sorting. (MFSA 2010-30)

  The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

Versions of Firefox earlier than 3.5.10 are potentially affected by multiple vulnerabilities :

  - A re-use of a freed object due to scope confusion. (MFSA 2010-25)

  - Multiple crashes can result in code execution. (MFSA 2010-26)

  - A use-after-free error in nsCycleCollector::MarkRoots(). (MFSA 2010-27)

  - Freed object reuse across plugin instances. (MFSA 2010-28)

  - A heap buffer overflow in nsGenericDOMDataNode::SetTextInternal. (MFSA 2010-29)

  - An integer overflow in XSLT node sorting. (MFSA 2010-30)

  The focus() behavior can be used to inject or steal keystrokes. (MFSA 2010-31)

- The 'Content-Disposition: attachment' HTTP header is ignored when 'Content-Type: multipart' is also present. (MFSA 2010-32)

It is possible to reverse engineer the value used to seed Math.random(). (MFSA 2008-33)

ID	Name	Product	Family	Published	Updated	Severity
47130	FreeBSD : mozilla -- multiple vulnerabilities (99858b7c-7ece-11df-a007-000f20797ede)	Nessus	FreeBSD Local Security Checks	6/25/2010	1/6/2021	critical
47222	Fedora 12 : seamonkey-2.0.5-1.fc12 (2010-10329)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical
47225	Fedora 13 : firefox-3.6.4-1.fc13 / galeon-2.0.7-29.fc13 / gnome-python2-extras-2.25.3-19.fc13 / etc (2010-10361)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	critical
50873	SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 2608 / 2609)	Nessus	SuSE Local Security Checks	12/2/2010	1/14/2021	critical
5581	SeaMonkey < 2.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/23/2010	3/6/2019	medium
5580	Mozilla Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/23/2010	3/6/2019	medium
5579	Mozilla Firefox < 3.5.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/23/2010	3/6/2019	medium
800742	Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	6/23/2010		high
800758	Firefox < 3.5.10 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	6/23/2010		high
800874	SeaMonkey < 2.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	6/23/2010		high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium

medium

medium

high

high

high