Mozilla SeaMonkey 已更新到版本 2.0.12，修复了各种安全问题。

修复了以下安全问题：MFSA 2011-01：Mozilla 开发人员发现并修复了 Firefox 和其他基于 Mozilla 的产品所使用的浏览器引擎中的多个内存安全缺陷。这些缺陷中的一部分在特定情况下可导致内存损坏，我们推测只要通过足够的手段，至少能利用其中部分缺陷来运行任意代码。

Jesse Ruderman、Igor Bukanov、Olli Pettay、Gary Kwong、Jeff Walden、Henry Sivonen、Martijn Wargers、David Baron 和 Marcia Knous 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。
(CVE-2011-0053)

Igor Bukanov 和 Gary Kwong 报告了仅影响 Firefox 3.6 的内存安全问题。(CVE-2011-0062)

MFSA 2011-02 / CVE-2011-0051：据安全研究人员 Zach Hoffman 报告，对 try/catch 语句中封装的 eval() 进行递归调用使浏览器处于不一致状态。在此状态下打开的任何对话框不显示任何文本，而且按钮丧失功能。关闭窗口将导致对话框评估为 true。攻击者可利用此问题强制用户接受任何对话框，例如向呈现对话框的页面授予更高权限的对话框。

MFSA 2011-03 / CVE-2011-0055：安全研究人员 regenrecht 通过 TippingPoint 零日计划报告，JSON.stringify 使用的方法包含一个释放后使用错误，其中释放了当前正在使用的指针并随后取消引用该指针。如果攻击者能够在释放的内存部分中存储恶意代码，这可导致执行任意代码。

在收到初始报告之后两周，Mozilla 开发人员 Igor Bukanov 也独立发现并报告了此问题。

MFSA 2011-04 / CVE-2011-0054：据安全研究人员 Christian Holler 报告，JavaScript 引擎的非本地 JS 变量的内部内存映射包含缓冲区溢出，这可能被攻击者用于在受害者的计算机上运行任意代码。

MFSA 2011-05 / CVE-2011-0056：据安全研究人员 Christian Holler 报告，JavaScript 引擎的字符串值的内部映射包含一个错误，其中存储的值数大于 64K。在此类情况下，偏移指针被手动向前和向后移动，以便访问更大的地址空间。如果在向前移动偏移指针和重置偏移指针的时间之间抛出异常，则将从无效的内存地址读取异常对象，从而可能执行攻击者控制的内存。

MFSA 2011-06 / CVE-2011-0057：据 Daniel Kozlowski 报告，JavaScript Worker 可用于保持对在垃圾回收期间释放的对象的引用。通过这一被删除的引用进行后续调用可导致在受害者的计算机上执行攻击者控制的内存。

MFSA 2011-07 / CVE-2011-0058：Alex Miller 报告称，如果构造极长字符串并插入 HTML 文档中，浏览器不能正确构造用于显示文本的布局对象。在此类情况下，将为文本运行计算出不正确的长度，从而导致为存储文本而分配的内存缓冲区过小。攻击者可利用此问题将数据写过缓冲区尾部，并在受害者的计算机上执行恶意代码。此问题仅影响 Windows 上的 Mozilla 浏览器。

MFSA 2011-08 / CVE-2010-1585：Mozilla 安全开发人员 Roberto Suggi Liverani 报告称，当嵌入文档为 chrome 文档时，ParanoidFragmentSink 类（用于审查可能不安全的 HTML 是否可显示）允许 javascript: URL 和其他内联 JavaScript。
尽管发行的任何产品中不存在对该类不安全的使用，扩展代码可能以不安全的方式使用该类。

MFSA 2011-09 / CVE-2011-0061：安全研究人员 Jordi Chancel 报告称，可构造无法正确解码的 JPEG 图像，从而导致将数据写过为存储该图像而创建的缓冲区的尾部。攻击者可能可以构建符合以下条件的图像：导致将恶意代码存储到内存中，然后在受害者的计算机上执行。

MFSA 2011-10 / CVE-2011-0059：Adobe 安全研究人员 Peleus Uhley 报告称，当插件发起的请求收到 307 重定向响应时，不通知插件，并将请求转发到新位置。这即使对跨站重定向也成立，所以作为初始请求一部分添加的任何自定义标头在保持不变的情况下转发过原始位置。如果 Web 应用程序依赖于仅在来自其原始位置的请求中存在的自定义标头，则此类应用程序面临 CSRF 风险。

MozillaThunderbird 已更新到版本 3.1.8，修复了各种安全问题。

修复了以下安全问题：MFSA 2011-01：Mozilla 开发人员发现并修复了 Firefox 和其他基于 Mozilla 的产品所使用的浏览器引擎中的多个内存安全缺陷。这些缺陷中的一部分在特定情况下可导致内存损坏，我们推测只要通过足够的手段，至少能利用其中部分缺陷来运行任意代码。

Jesse Ruderman、Igor Bukanov、Olli Pettay、Gary Kwong、Jeff Walden、Henry Sivonen、Martijn Wargers、David Baron 和 Marcia Knous 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。
(CVE-2011-0053)

Igor Bukanov 和 Gary Kwong 报告了仅影响 Firefox 3.6 的内存安全问题。(CVE-2011-0062)

MFSA 2011-08 / CVE-2010-1585：Mozilla 安全开发人员 Roberto Suggi Liverani 报告称，当嵌入文档为 chrome 文档时，ParanoidFragmentSink 类（用于审查可能不安全的 HTML 是否可显示）允许 javascript: URL 和其他内联 JavaScript。
尽管发行的任何产品中不存在对该类不安全的使用，扩展代码可能以不安全的方式使用该类。

MFSA 2011-09 / CVE-2011-0061：安全研究人员 Jordi Chancel 报告称，可构造无法正确解码的 JPEG 图像，从而导致将数据写过为存储该图像而创建的缓冲区的尾部。攻击者可能可以构建符合以下条件的图像：导致将恶意代码存储到内存中，然后在受害者的计算机上执行。

Versions of SeaMonkey 2.0.x earlier than 2.0.12 are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption issues exists which could lead to arbitrary code execution. (MFSA 2011-01)

  - An error exists in the processing of recusrive calls to 'eval()' when the call is wrapped in a try/catch statement.  This error causes dialog boxes to be displayed with no content and non-functioning buttons.  Closing the dialog results in default acceptance of the dialog. (MFSA 2011-02)

  - A use-after-free error exists in a method used by 'JSON.stringify' and can allow arbitrary code execution. (MFSA 2011-03)

  - A buffer-overflow vulnerability exists in the JavaScript engine's internal memory mapping of non-local variables and may lead to cde execution. (MFSA 2011-04)

  - A buffer overflow vulnerability exists in the JavaScript engine's internal mapping of string values and may lead to code execution. (MFSA 2011-05)

  - A use-after-free error exists such that a JavaScript 'Worker' can be used to keep a reference to an object which can be freed during garbage collection. This vulnerability may lead to arbitrary code execution. (MFSA 2011-06)

  - A buffer overflow error exists related to the creation of very long strings and the insertion of those strings into an HTML document.  This vulnerability may lead to arbitrary code execution. (MFSA 2011-07)

  - An input validation error exists int he class, 'ParanoidFragmentSink', which allows inline JavaScript and 'javascript:' URLs in a chrome document.  Note that no unsafe usage occurs in Mozilla products, however community generated extensions could. (MFSA 2011-08)

  - A cross-site request forgery (CSRF) vulnerability exists when an HTTP 307 redirect is received in response to a plugin's request.  The request is forwarded to the new location without the plugin's knowledge and with custom headers intact, even across origins. (MFSA 2011-10)

Versions of Firefox 3.6.x earlier than 3.6.14 are potentially affected by multiple vulnerabilities :

 - Multiple memory corruption issues exists which could lead to arbitrary code execution. (MFSA 2011-01)
 - An error exists in the processing of recusrive calls to 'eval()' when the call is wrapped in a try/catch statement.  This error causes dialog boxes to be displayed with no content and non-functioning buttons.  Closing the dialog results in default acceptance of the dialog. (MFSA 2011-02)
 - A use-after-free error exists in a method used by 'JSON.stringify' and can allow arbitrary code execution. (MFSA 2011-03)
 - A buffer-overflow vulnerability exists in the JavaScript engine's internal memory mapping of non-local variables and may lead to cde execution. (MFSA 2011-04)
 - A buffer overflow vulnerability exists in the JavaScript engine's internal mapping of string values and may lead to code execution. (MFSA 2011-05)
 - A use-after-free error exists such that a JavaScript 'Worker' can be used to keep a reference to an object which can be freed during garbage collection. This vulnerability may lead to arbitrary code execution. (MFSA 2011-06)
 - A buffer overflow error exists related to the creation of very long strings and the insertion of those strings into an HTML document.  This vulnerability may lead to arbitrary code execution. (MFSA 2011-07)
 - An input validation error exists int he class, 'ParanoidFragmentSink', which allows inline JavaScript and 'javascript:' URLs in a chrome document.  Note that no unsafe usage occurs in Mozilla products, however community generated extensions could. (MFSA 2011-08)
 - A buffer overflow exist related to JPEG decoding and may lead to arbitrary code execution. (MFSA 2011-09)
 - A cross-site request forgery (CSRF) vulnerability exists when an HTTP 307 redirect is received in response to a plugin's request.  The request is forwarded to the new location without the plugin's knowledge and with custom headers intact, even across origins. (MFSA 2011-10)

Versions of Mozilla Thunderbird 3.1.x prior to 3.1.8 are affected by the following vulnerabilities :

 - Multiple memory corruption issues exists which could lead to arbitrary code execution. (MFSA 2011-01)
 - An input validation error exists int he class, 'ParanoidFragmentSink', which allows inline JavaScript and 'javascript:' URLs in a chrome document. Note that no unsafe usage occurs in Mozilla products, however community generated extensions could. (MFSA 2011-08)
 - A buffer overflow exist related to JPEG decoding and may lead to arbitrary code execution. (MFSA 2011-09)

Versions of Firefox 3.6.x earlier than 3.6.14 are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption issues exists which could lead to arbitrary code execution. (MFSA 2011-01)

  - An error exists in the processing of recusrive calls to 'eval()' when the call is wrapped in a try/catch statement.  This error causes dialog boxes to be displayed with no content and non-functioning buttons.  Closing the dialog results in default acceptance of the dialog. (MFSA 2011-02)

  - A use-after-free error exists in a method used by 'JSON.stringify' and can allow arbitrary code execution. (MFSA 2011-03)

  - A buffer-overflow vulnerability exists in the JavaScript engine's internal memory mapping of non-local variables and may lead to cde execution. (MFSA 2011-04)

  - A buffer overflow vulnerability exists in the JavaScript engine's internal mapping of string values and may lead to code execution. (MFSA 2011-05)

  - A use-after-free error exists such that a JavaScript 'Worker' can be used to keep a reference to an object which can be freed during garbage collection. This vulnerability may lead to arbitrary code execution. (MFSA 2011-06)

  - A buffer overflow error exists related to the creation of very long strings and the insertion of those strings into an HTML document.  This vulnerability may lead to arbitrary code execution. (MFSA 2011-07)

  - An input validation error exists int he class, 'ParanoidFragmentSink', which allows inline JavaScript and 'javascript:' URLs in a chrome document.  Note that no unsafe usage occurs in Mozilla products, however community generated extensions could. (MFSA 2011-08)

  - A buffer overflow exist related to JPEG decoding and may lead to arbitrary code execution. (MFSA 2011-09)

  - A cross-site request forgery (CSRF) vulnerability exists when an HTTP 307 redirect is received in response to a plugin's request.  The request is forwarded to the new location without the plugin's knowledge and with custom headers intact, even across origins. (MFSA 2011-10)

Versions of Thunderbird 3.1.x earlier than 3.1.8 are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption issues exists which could lead to arbitrary code execution. (MFSA 2011-01)

  - An input validation error exists int he class, 'ParanoidFragmentSink', which allows inline JavaScript and 'javascript:' URLs in a chrome document.  Note that no unsafe usage occurs in Mozilla products, however community generated extensions could. (MFSA 2011-08)

  - A buffer overflow exist related to JPEG decoding and may lead to arbitrary code execution. (MFSA 2011-09)

ID	Name	Product	Family	Published	Updated	Severity
75736	openSUSE 安全更新：seamonkey (seamonkey-4074)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
75963	openSUSE 安全更新：MozillaThunderbird (MozillaThunderbird-4149)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
5811	SeaMonkey 2.0.x < 2.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/7/2011	3/6/2019	high
5808	Mozilla Firefox 3.6.x < 3.6.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/7/2011	3/6/2019	high
5810	Mozilla Thunderbird 3.1.x < 3.1.8 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	3/7/2011	3/6/2019	high
801270	Mozilla Firefox 3.6.x < 3.6.14 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	3/7/2011		high
801234	Mozilla Thunderbird 3.1.x < 3.1.8 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	3/7/2011		high
801265	Mozilla SeaMonkey 2.0.x < 2.0.12 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	3/7/2011		high

Detections

Analytics

Plugins Search

critical

critical

high

high

high

high

high

high