Versions of Firefox 3.x prior to 3.0.5 are affected by the following security issues : 

 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2008-60)
 - XBL bindings can be used to read data from other domains. (MFSA 2008-61)
 - The feed preview still allows for JavaScript privilege escalation. (MFSA 2008-62)
 - Sensitive data may be disclosed in an XHR response when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a different domain. (MFSA 2008-64)
 - A website may be able to access a limited amount of data from a different domain by loading a same-domain JavaScript URL which redirects to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA 2008-65)
 - Errors arise when parsing URLs with leading whitespace and control characters. (MFSA 2008-66)
 - An escaped null byte is ignored by the CSS parser and treated as if it was not present in the CSS input string. (MFSA 2008-67)
 - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)
 - XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin policy and performing an XSS attack or running arbitrary JavaScript with chrome privileges. (MFSA 2008-69)
 - A denial of service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

遠端主機受到 GLSA-201301-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 與 XULRunner 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者或許能夠執行攔截式攻擊、取得敏感資訊、繞過限制及保護機制、強制檔案下載、發動 XML 插入攻擊、發動 XSS 攻擊、繞過同源原則、偽造 URL 以發動網路釣魚攻擊、觸發垂直捲動、偽造位置列、偽造 SSL 指示器、修改瀏覽器的字型、發動點擊劫持攻擊，或造成其他不明的影響。
 本機攻擊者可取得提升的權限、取得敏感資訊，或取代任意下載檔案。
 因應措施：

目前尚無已知的因應措施。

远程主机受到 GLSA-201301-01 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 和 XULRunner 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、绕过限制和保护机制、强制文件下载，进行 XML 注入攻击、进行 XSS 攻击、绕过同源策略、欺骗 URL 进行钓鱼攻击、触发垂直滚动、欺骗位置栏、欺骗 SSL 标识符、修改浏览器的字体、进行点击劫持攻击或者造成其他不明影响。
 本地攻击者可获得经提升的权限、获取敏感信息或替换任意已下载的文件。
 变通方案：

目前无任何已知的变通方案。

リモートホストは、GLSA-201301-01 で説明されている脆弱性の影響を受けます（Mozilla 製品：複数の脆弱性）

Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat、および XULRunner に、複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

リモートの攻撃者が、ユーザーを誘導し、特別に細工された Web ページやメールを表示させることができた場合、任意のコードを実行したり、サービス拒否状態を発生させたりする可能性があります。さらに、リモートの攻撃者が中間者攻撃の実行、機密情報の取得、制限および保護メカニズムのバイパス、ファイルダウンロードの強制、XML インジェクション攻撃の実行、XSS 攻撃の実行、同一生成元ポリシーのバイパス、フィッシング攻撃のための URL の偽装、縦スクロールの誘発、ロケーションバーの偽装、SSL インジケーターの偽装、ブラウザのフォントの変更、クリックジャッキング攻撃の実行を引き起こしたり、またはその他の詳細不明な影響を与えたりする可能性があります。
 ローカルの攻撃者が、昇格された権限を取得したり、機密情報を取得したり、またはダウンロードされた任意のファイルを置き換えたりする可能性があります。
 回避策：

現時点で、既知の回避策はありません。

The installed version of Firefox 3.0 is earlier than 3.0.5.  Such versions are potentially affected by the following security issues :

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-60)

  - The 'persist' attribute in XUL elements can be used to     store cookie-like information on a user's computer.
    (MFSA 2008-63)

  - Sensitive data may be disclosed in an XHR response when     an XMLHttpRequest is made to a same-origin resource,     which 302 redirects to a resource in a different     domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of     data from a different domain by loading a same-domain     JavaScript URL that redirects to an off-domain target     resource containing data which is not parsable as     JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace     and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and     treated as if it was not present in the CSS input     string. (MFSA 2008-67)

  - XSS and JavaScript privilege escalation are possible.
    (MFSA 2008-68)

  - XSS vulnerabilities in SessionStore may allow for     violating the browser's same-origin policy and     performing an XSS attack or running arbitrary     JavaScript with chrome privileges. (MFSA 2008-69)

  - Creating a Select object with a very large length can     result in memory exhaustion, causing a denial of     service. (CVE-2009-2535)

The installed version of Firefox is earlier than 2.0.0.19.  Such versions are potentially affected by the following security issues :

  - There are several stability bugs in the browser engine     that may lead to crashes with evidence of memory     corruption. (MFSA 2008-60)

  - XBL bindings can be used to read data from other     domains. (MFSA 2008-61)

  - The feed preview still allows for JavaScript privilege     escalation. (MFSA 2008-62)

  - Sensitive data may be disclosed in an XHR response when     an XMLHttpRequest is made to a same-origin resource,     which 302 redirects to a resource in a different     domain. (MFSA 2008-64)

  - A website may be able to access a limited amount of     data from a different domain by loading a same-domain     JavaScript URL which redirects to an off-domain target     resource containing data which is not parsable as     JavaScript. (MFSA 2008-65)

  - Errors arise when parsing URLs with leading whitespace     and control characters. (MFSA 2008-66)

  - An escaped null byte is ignored by the CSS parser and     treated as if it was not present in the CSS input     string. (MFSA 2008-67)

  - Cross-site scripting and JavaScript privilege escalation     are possible. (MFSA 2008-68)

  - Cross-site scripting vulnerabilities in SessionStore may     allow for violating the browser's same-origin policy and     performing an XSS attack or running arbitrary     JavaScript with chrome privileges. (MFSA 2008-69)

  - Creating a Select object with a very large length can     result in memory exhaustion, causing a denial of     service. (CVE-2009-2535)

Note that Mozilla is not planning further security / stability updates for Firefox 2.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
4793	Mozilla Firefox 3.x < 3.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	12/17/2008	3/6/2019	medium
63402	GLSA-201301-01：Mozilla 產品：多個弱點 (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	10/6/2025	critical
63402	GLSA-201301-01：Mozilla 产品：多种漏洞 (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	10/6/2025	critical
63402	GLSA-201301-01：Mozilla 製品：複数の脆弱性（BEAST）	Nessus	Gentoo Local Security Checks	1/8/2013	10/6/2025	critical
35219	Firefox 3.0.x < 3.0.5 Multiple Vulnerabilities	Nessus	Windows	12/17/2008	6/23/2026	high
35218	Firefox < 2.0.0.19 / 3.0.5 Multiple Vulnerabilities	Nessus	Windows	12/17/2008	6/23/2026	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	10/6/2025	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical

high

high

critical