Several flaws were discovered in the browser engine of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0159)

Orlando Barrera II discovered a flaw in the Web Workers implementation of Firefox. If a user were tricked into posting to a malicious website, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0160)

Alin Rad Pop discovered that Firefox's HTML parser would incorrectly free memory under certain circumstances. If the browser could be made to access these freed memory objects, an attacker could exploit this to execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1571)

Hidetake Jo discovered that the showModalDialog in Firefox did not always honor the same-origin policy. An attacker could exploit this to run untrusted JavaScript from other domains. (CVE-2009-3988)

Georgi Guninski discovered that the same-origin check in Firefox could be bypassed by utilizing a crafted SVG image. If a user were tricked into viewing a malicious website, an attacker could exploit this to read data from other domains. (CVE-2010-0162).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was upgraded to version 3.5.8, fixing various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-01 / CVE-2010-0159)

  - Security researcher Orlando Barrera II reported via     TippingPoint's Zero Day Initiative that Mozilla's     implementation of Web Workers contained an error in its     handling of array data types when processing posted     messages. This error could be used by an attacker to     corrupt heap memory and crash the browser, potentially     running arbitrary code on a victim's computer. (MFSA     2010-02 / CVE-2010-0160)

  - Security researcher Alin Rad Pop of Secunia Research     reported that the HTML parser incorrectly freed used     memory when insufficient space was available to process     remaining input. Under such circumstances, memory     occupied by in-use objects was freed and could later be     filled with attacker-controlled text. These conditions     could result in the execution or arbitrary code if     methods on the freed objects were subsequently called.
    (MFSA 2010-03 / CVE-2009-1571)

  - Security researcher Hidetake Jo of Microsoft     Vulnerability Research reported that the properties set     on an object passed to showModalDialog were readable by     the document contained in the dialog, even when the     document was from a different domain. This is a     violation of the same-origin policy and could result in     a website running untrusted JavaScript if it assumed the     dialogArguments could not be initialized by another     site. (MFSA 2010-04 / CVE-2009-3988)

An anonymous security researcher, via TippingPoint's Zero Day Initiative, also independently reported this issue to Mozilla.

  - Mozilla security researcher Georgi Guninski reported     that when a SVG document which is served with     Content-Type: application/octet-stream is embedded into     another document via an embed tag with     type='image/svg+xml', the Content-Type is ignored and     the SVG document is processed normally. A website which     allows arbitrary binary data to be uploaded but which     relies on Content-Type: application/octet-stream to     prevent script execution could have such protection     bypassed. An attacker could upload a SVG document     containing JavaScript as a binary file to a website,     embed the SVG document into a malicous page on another     site, and gain access to the script environment from the     SVG-serving site, bypassing the same-origin policy.
    (MFSA 2010-05 / CVE-2010-0162)

Update to new upstream Firefox version 3.5.8, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox35.html#firefox3.5.8 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla XUL Runner engine 1.9.0 was upgraded to version 1.9.0.8, fixing various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-01 / CVE-2010-0159)

  - Security researcher Orlando Barrera II reported via     TippingPoint's Zero Day Initiative that Mozilla's     implementation of Web Workers contained an error in its     handling of array data types when processing posted     messages. This error could be used by an attacker to     corrupt heap memory and crash the browser, potentially     running arbitrary code on a victim's computer. (MFSA     2010-02 / CVE-2010-0160)

  - Security researcher Alin Rad Pop of Secunia Research     reported that the HTML parser incorrectly freed used     memory when insufficient space was available to process     remaining input. Under such circumstances, memory     occupied by in-use objects was freed and could later be     filled with attacker-controlled text. These conditions     could result in the execution or arbitrary code if     methods on the freed objects were subsequently called.
    (MFSA 2010-03 / CVE-2009-1571)

  - Security researcher Hidetake Jo of Microsoft     Vulnerability Research reported that the properties set     on an object passed to showModalDialog were readable by     the document contained in the dialog, even when the     document was from a different domain. This is a     violation of the same-origin policy and could result in     a website running untrusted JavaScript if it assumed the     dialogArguments could not be initialized by another     site. (MFSA 2010-04 / CVE-2009-3988)

An anonymous security researcher, via TippingPoint's Zero Day Initiative, also independently reported this issue to Mozilla.

  - Mozilla security researcher Georgi Guninski reported     that when a SVG document which is served with     Content-Type: application/octet-stream is embedded into     another document via an tag with type='image/svg+xml',     the Content-Type is ignored and the SVG document is     processed normally. A website which allows arbitrary     binary data to be uploaded but which relies on     Content-Type: application/octet-stream to prevent script     execution could have such protection bypassed. An     attacker could upload a SVG document containing     JavaScript as a binary file to a website, embed the SVG     document into a malicous page on another site, and gain     access to the script environment from the SVG-serving     site, bypassing the same-origin policy. (MFSA 2010-05 /     CVE-2010-0162)

The installed version of Firefox is 3.5.x earlier than 3.5.8.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code execution.
    (MFSA 2010-01)

  - The implementation of 'Web Workers' contained an error     in its handling of array data types when processing     posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when     insufficient space is available to process remaining     input. (MFSA 2010-03)

  - A cross-site scripting issue exists due to     'window.dialogArguments' being readable cross-domain.
    (MFSA 2010-04)

  - A cross-site scripting issue exists when using SVG     documents and binary Content-Type. (MFSA 2010-05)     
  - Multiple crashes can result in arbitrary code execution.
    (MFSA 2010-11)

  - A cross-site scripting issue when using     'addEventListener' and 'setTimeout' on a wrapped object.
    (MFSA 2010-12)

  - It is possible to corrupt a user's XUL cache.     (MFSA 2010-14)

  - The XMLHttpRequestSpy module in the Firebug add-on     exposes an underlying chrome privilege escalation     vulnerability. (MFSA 2010-21)

The installed version of SeaMonkey is earlier than 2.0.3.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code execution.
    (MFSA 2010-01)

  - The implementation of 'Web Workers' contained an error     in its handling of array data types when processing     posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when     insufficient space is available to process remaining     input. (MFSA 2010-03)

  - A cross-site scripting issue exists due to     'window.dialogArguments' being readable cross-domain.
    (MFSA 2010-04)

  - A cross-site scripting issue exists when using SVG     documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution.
    (MFSA 2010-11)

  - A cross-site scripting issue when using     'addEventListener' and 'setTimeout' on a wrapped object.
    (MFSA 2010-12)

  - It is possible to corrupt a user's XUL cache.     (MFSA 2010-14)     
  - The XMLHttpRequestSpy module in the Firebug add-on     exposes an underlying chrome privilege escalation     vulnerability. (MFSA 2010-21)

Mozilla Project reports :

MFSA 2010-05 XSS hazard using SVG document and binary Content-Type

MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain

MFSA 2010-03 Use-after-free crash in HTML parser

MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability

MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1571     Alin Rad Pop discovered that incorrect memory handling     in the HTML parser could lead to the execution of     arbitrary code.

  - CVE-2009-3988     Hidetake Jo discovered that the same-origin policy can     be bypassed through window.dialogArguments.

  - CVE-2010-0159     Henri Sivonen, Boris Zbarsky, Zack Weinberg, Bob Clary,     Martijn Wargers and Paul Nickerson reported crashes in     layout engine, which might allow the execution of     arbitrary code.

  - CVE-2010-0160     Orlando Barrera II discovered that incorrect memory     handling in the implementation of the web worker API     could lead to the execution of arbitrary code.

  - CVE-2010-0162     Georgi Guninski discovered that the same origin policy     can be bypassed through specially crafted SVG documents.

Update to new upstream SeaMonkey version 2.0.3, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream Firefox version 3.5.8, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox35.html#firefox3.5.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was upgraded to version 3.5.8, fixing various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-01 / CVE-2010-0159)

  - Security researcher Orlando Barrera II reported via     TippingPoint's Zero Day Initiative that Mozilla's     implementation of Web Workers contained an error in its     handling of array data types when processing posted     messages. This error could be used by an attacker to     corrupt heap memory and crash the browser, potentially     running arbitrary code on a victim's computer. (MFSA     2010-02 / CVE-2010-0160)

  - Security researcher Alin Rad Pop of Secunia Research     reported that the HTML parser incorrectly freed used     memory when insufficient space was available to process     remaining input. Under such circumstances, memory     occupied by in-use objects was freed and could later be     filled with attacker-controlled text. These conditions     could result in the execution or arbitrary code if     methods on the freed objects were subsequently called.
    (MFSA 2010-03 / CVE-2009-1571)

  - Security researcher Hidetake Jo of Microsoft     Vulnerability Research reported that the properties set     on an object passed to showModalDialog were readable by     the document contained in the dialog, even when the     document was from a different domain. This is a     violation of the same-origin policy and could result in     a website running untrusted JavaScript if it assumed the     dialogArguments could not be initialized by another     site. (MFSA 2010-04 / CVE-2009-3988)

An anonymous security researcher, via TippingPoint's Zero Day Initiative, also independently reported this issue to Mozilla.

  - Mozilla security researcher Georgi Guninski reported     that when a SVG document which is served with     Content-Type: application/octet-stream is embedded into     another document via an tag with type='image/svg+xml',     the Content-Type is ignored and the SVG document is     processed normally. A website which allows arbitrary     binary data to be uploaded but which relies on     Content-Type: application/octet-stream to prevent script     execution could have such protection bypassed. An     attacker could upload a SVG document containing     JavaScript as a binary file to a website, embed the SVG     document into a malicous page on another site, and gain     access to the script environment from the SVG-serving     site, bypassing the same-origin policy. (MFSA 2010-05 /     CVE-2010-0162)

The remote host is running a version of Mozilla Firefox earlier than 3.0.18, 3.5.8, 3.6.  Such versions are potentially affected by multiple vulnerabilities : 

 - Several crashes can result in arbitrary code execution. (MFSA 2010-01)
 - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)
 - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)
 - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)
 - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)
 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-011)
 - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)
 - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

The remote host is running a version of SeaMonkey earlier than 2.0.3.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

The remote host is running a version of Mozilla Firefox earlier than 3.0.18, 3.5.8, 3.6.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-011)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

  - It is possible to corrupt a user's XUL cache. (MFSA 2010-14)

The remote host is running a version of Mozilla SeaMonkey earlier than 2.0.3.  Such versions are potentially affected by multiple vulnerabilities : 

  - Several crashes can result in arbitrary code execution. (MFSA 2010-01)

  - The implementation of 'Web Workers' contains an error in its handling of array data types when processing posted messages. (MFSA 2010-02)

  - The HTML parser incorrectly frees used memory when insufficient space is available to process remaining input. (MFSA 2010-03)

  - A cross-site scripting issue due to 'window.dialogArguments' being readable cross-domain. (CVE-2010-04)

  - A cross-site scripting issue when using SVG documents and binary Content-Type. (MFSA 2010-05)

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-11)

  - A cross-site scripting issue when using 'addEventListener' and 'setTimeout' on a wrapped object. (MFSA 2010-12)

ID	名稱	產品	系列	已發布	已更新	嚴重性
44655	Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-895-1)	Nessus	Ubuntu Local Security Checks	2010/2/18	2019/9/19	critical
44907	SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 2025)	Nessus	SuSE Local Security Checks	2010/2/25	2021/1/14	critical
47268	Fedora 12 : blam-1.8.5-22.fc12 / firefox-3.5.8-1.fc12 / galeon-2.0.7-20.fc12 / etc (2010-1727)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
49900	SuSE 10 Security Update : Mozilla XULRunner (ZYPP Patch Number 6866)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	critical
44659	Firefox 3.5 < 3.5.8 Multiple Vulnerabilities	Nessus	Windows	2010/2/18	2018/7/16	high
44660	SeaMonkey < 2.0.3 Multiple Vulnerabilities	Nessus	Windows	2010/2/18	2018/7/27	high
44661	FreeBSD : mozilla -- multiple vulnerabilities (f82c85d8-1c6e-11df-abb2-000f20797ede)	Nessus	FreeBSD Local Security Checks	2010/2/19	2021/1/6	critical
44863	Debian DSA-1999-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	critical
44909	SuSE 11 Security Update : Mozilla XULRunner (SAT Patch Number 2033)	Nessus	SuSE Local Security Checks	2010/2/25	2021/1/14	critical
47285	Fedora 12 : seamonkey-2.0.3-1.fc12 (2010-1932)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
47288	Fedora 11 : Miro-2.5.4-2.fc11 / blam-1.8.5-18.fc11 / chmsee-1.0.1-15.fc11 / eclipse-3.4.2-20.fc11 / etc (2010-1936)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
49891	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6867)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	critical
5342	Mozilla Firefox < 3.0.18 / 3.5.8 / 3.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2010/2/18	2019/3/6	medium
5343	SeaMonkey < 2.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2010/2/18	2019/3/6	medium
801279	Mozilla Firefox < 3.0.18 / 3.5.8 / 3.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2010/2/18		high
801219	Mozilla SeaMonkey < 2.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2010/2/18		high

偵測

搜尋 Plugin

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

medium

medium

high

high