Mozilla Firefox was updated to the 10.0.9ESR security release which fixes bugs and security issues :

  - Security researchers Thai Duong and Juliano Rizzo     reported that SPDY's request header compression leads to     information leakage, which can allow the extraction of     private data such as session cookies, even over an     encrypted SSL connection. (This does not affect Firefox     10 as it does not feature the SPDY extension. It was     silently fixed for Firefox 15.). (MFSA 2012-73 /     CVE-2012-3977)

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-74)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

  - Henrik Skupin, Jesse Ruderman and moz_bug_r_a4 reported     memory safety problems and crashes that affect Firefox     15. (CVE-2012-3983)

  - Christian Holler and Jesse Ruderman reported memory     safety problems and crashes that affect Firefox ESR 10     and Firefox 15. (CVE-2012-3982)

  - Security researcher David Bloom of Cue discovered that     'select' elements are always-on-top chromeless windows     and that navigation away from a page with an active     'select' menu does not remove this window.When another     menu is opened programmatically on a new page, the     original 'select' menu can be retained and arbitrary     HTML content within it rendered, allowing an attacker to     cover arbitrary portions of the new page through     absolute positioning/scrolling, leading to spoofing     attacks. Security researcher Jordi Chancel found a     variation that would allow for click-jacking attacks was     well. (MFSA 2012-75 / CVE-2012-3984)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Navigation away from a page with an active 'select'     dropdown menu can be used for URL spoofing, other evil

    Firefox 10.0.1 : Navigation away from a page with     multiple active 'select' dropdown menu can be used for     Spoofing And ClickJacking with XPI using window.open and     geolocalisation

  - Security researcher Collin Jackson reported a violation     of the HTML5 specifications for document.domain     behavior. Specified behavior requires pages to only have     access to windows in a new document.domain but the     observed violation allowed pages to retain access to     windows from the page's initial origin in addition to     the new document.domain. This could potentially lead to     cross-site scripting (XSS) attacks. (MFSA 2012-76 /     CVE-2012-3985)

  - Mozilla developer Johnny Stenback discovered that     several methods of a feature used for testing     (DOMWindowUtils) are not protected by existing security     checks, allowing these methods to be called through     script by web pages. This was addressed by adding the     existing security checks to these methods. (MFSA 2012-77     / CVE-2012-3986)

  - Security researcher Warren He reported that when a page     is transitioned into Reader Mode in Firefox for Android,     the resulting page has chrome privileges and its content     is not thoroughly sanitized. A successful attack     requires user enabling of reader mode for a malicious     page, which could then perform an attack similar to     cross-site scripting (XSS) to gain the privileges     allowed to Firefox on an Android device. This has been     fixed by changing the Reader Mode page into an     unprivileged page. (MFSA 2012-78 / CVE-2012-3987)

    This vulnerability only affects Firefox for Android.

  - Security researcher Soroush Dalili reported that a     combination of invoking full screen mode and navigating     backwards in history could, in some circumstances, cause     a hang or crash due to a timing dependent use-after-free     pointer reference. This crash may be potentially     exploitable. (MFSA 2012-79 / CVE-2012-3988)

  - Mozilla community member Ms2ger reported a crash due to     an invalid cast when using the instanceof operator on     certain types of JavaScript objects. This can lead to a     potentially exploitable crash. (MFSA 2012-80 /     CVE-2012-3989)

  - Mozilla community member Alice White reported that when     the GetProperty function is invoked through JSAPI,     security checking can be bypassed when getting     cross-origin properties. This potentially allowed for     arbitrary code execution. (MFSA 2012-81 / CVE-2012-3991)

  - Security researcher Mariusz Mlynski reported that the     location property can be accessed by binary plugins     through top.location and top can be shadowed by     Object.defineProperty as well. This can allow for     possible cross-site scripting (XSS) attacks through     plugins. (MFSA 2012-82 / CVE-2012-3994)

  - Security researcher Mariusz Mlynski reported that when     InstallTrigger fails, it throws an error wrapped in a     Chrome Object Wrapper (COW) that fails to specify     exposed properties. These can then be added to the     resulting object by an attacker, allowing access to     chrome privileged functions through script. (MFSA     2012-83)

    While investigating this issue, Mozilla security     researcher moz_bug_r_a4 found that COW did not disallow     accessing of properties from a standard prototype in     some situations, even when the original issue had been     fixed.

    These issues could allow for a cross-site scripting     (XSS) attack or arbitrary code execution.

  - XrayWrapper pollution via unsafe COW. (CVE-2012-3993)

  - ChromeObjectWrapper is not implemented as intended.
    (CVE-2012-4184)

  - Security researcher Mariusz Mlynski reported an issue     with spoofing of the location property. In this issue,     writes to location.hash can be used in concert with     scripted history navigation to cause a specific website     to be loaded into the history object. The baseURI can     then be changed to this stored site, allowing an     attacker to inject a script or intercept posted data     posted to a location specified with a relative path.
    (MFSA 2012-84 / CVE-2012-3992)

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team discovered a series of     use-after-free, buffer overflow, and out of bounds read     issues using the Address Sanitizer tool in shipped     software. These issues are potentially exploitable,     allowing for remote code execution. We would also like     to thank Abhishek for reporting two additional     use-after-free flaws introduced during Firefox 16     development and fixed before general release. (MFSA     2012-85)

  - Out of bounds read in IsCSSWordSpacingSpace.
    (CVE-2012-3995)

  - Heap-use-after-free in     nsHTMLCSSUtils::CreateCSSPropertyTxn. (CVE-2012-4179)

  - Heap-buffer-overflow in     nsHTMLEditor::IsPrevCharInNodeWhitespace.
    (CVE-2012-4180)

  - Heap-use-after-free in     nsSMILAnimationController::DoSample. (CVE-2012-4181)

  - Heap-use-after-free in nsTextEditRules::WillInsert.
    (CVE-2012-4182)

  - Heap-use-after-free in DOMSVGTests::GetRequiredFeatures.
    (CVE-2012-4183)

  - Security researcher Atte Kettunen from OUSPG reported     several heap memory corruption issues found using the     Address Sanitizer tool. These issues are potentially     exploitable, allowing for remote code execution. (MFSA     2012-86)

  - Global-buffer-overflow in nsCharTraits::length.
    (CVE-2012-4185)

  - Heap-buffer-overflow in nsWaveReader::DecodeAudioData.
    (CVE-2012-4186)

  - Crash with ASSERTION: insPos too small. (CVE-2012-4187)

  - Heap-buffer-overflow in Convolve3x3. (CVE-2012-4188)

  - Security researcher miaubiz used the Address Sanitizer     tool to discover a use-after-free in the IME State     Manager code. This could lead to a potentially     exploitable crash. (MFSA 2012-87 / CVE-2012-3990)

  - Mozilla security researcher moz_bug_r_a4 reported a     regression where security wrappers are unwrapped without     doing a security check in defaultValue(). This can allow     for improper access access to the Location object. In     versions 15 and earlier of affected products, there was     also the potential for arbitrary code execution. (MFSA     2012-89 / CVE-2012-4192 / CVE-2012-4193)

The Mozilla suite received following security updates (bnc#783533) :

Mozilla Firefox was updated to 16.0.1. Mozilla SeaMonkey was updated to 2.13.1. Mozilla Thunderbird was updated to 16.0.1. Mozilla XULRunner was updated to 16.0.1.

  - MFSA 2012-88/CVE-2012-4191 (bmo#798045) Miscellaneous     memory safety hazards

  - MFSA 2012-89/CVE-2012-4192/CVE-2012-4193 (bmo#799952,     bmo#720619) defaultValue security checks not applied

  - MFSA 2012-74/CVE-2012-3982/CVE-2012-3983 Miscellaneous     memory safety hazards

  - MFSA 2012-75/CVE-2012-3984 (bmo#575294) select element     persistance allows for attacks

  - MFSA 2012-76/CVE-2012-3985 (bmo#655649) Continued access     to initial origin after setting document.domain

  - MFSA 2012-77/CVE-2012-3986 (bmo#775868) Some     DOMWindowUtils methods bypass security checks

  - MFSA 2012-79/CVE-2012-3988 (bmo#725770) DOS and crash     with full screen and history navigation

  - MFSA 2012-80/CVE-2012-3989 (bmo#783867) Crash with     invalid cast when using instanceof operator

  - MFSA 2012-81/CVE-2012-3991 (bmo#783260) GetProperty     function can bypass security checks

  - MFSA 2012-82/CVE-2012-3994 (bmo#765527) top object and     location property accessible by plugins

  - MFSA 2012-83/CVE-2012-3993/CVE-2012-4184 (bmo#768101,     bmo#780370) Chrome Object Wrapper (COW) does not     disallow access to privileged functions or properties

  - MFSA 2012-84/CVE-2012-3992 (bmo#775009) Spoofing and     script injection through location.hash

  - MFSA 2012-85/CVE-2012-3995/CVE-2012-4179/CVE-2012-4180/     CVE-2012-4181/CVE-2012-4182/CVE-2012-4183     Use-after-free, buffer overflow, and out of bounds read     issues found using Address Sanitizer

  - MFSA 2012-86/CVE-2012-4185/CVE-2012-4186/CVE-2012-4187/     CVE-2012-4188 Heap memory corruption issues found using     Address Sanitizer

  - MFSA 2012-87/CVE-2012-3990 (bmo#787704)

Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program. (CVE-2012-3982, CVE-2012-3983, CVE-2012-3988, CVE-2012-3989, CVE-2012-4191)

David Bloom and Jordi Chancel discovered that Thunderbird did not always properly handle the <select> element. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. (CVE-2012-3984)

Collin Jackson discovered that Thunderbird did not properly follow the HTML5 specification for document.domain behavior. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution. (CVE-2012-3985)

Johnny Stenback discovered that Thunderbird did not properly perform security checks on test methods for DOMWindowUtils. (CVE-2012-3986)

Alice White discovered that the security checks for GetProperty could be bypassed when using JSAPI. If a user were tricked into opening a specially crafted web page and had JavaScript enabled, a remote attacker could exploit this to execute arbitrary code as the user invoking the program. (CVE-2012-3991)

Mariusz Mlynski discovered a history state error in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to spoof the location property to inject script or intercept posted data. (CVE-2012-3992)

Mariusz Mlynski and others discovered several flaws in Thunderbird that allowed a remote attacker to conduct cross-site scripting (XSS) attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page and had JavaScript enabled, a remote attacker could exploit these to modify the contents, or steal confidential data, within the same domain. (CVE-2012-3993, CVE-2012-3994, CVE-2012-4184)

Abhishek Arya, Atte Kettunen and others discovered several memory flaws in Thunderbird when using the Address Sanitizer tool. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the context of another website or execute arbitrary code as the user invoking the program. (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188)

It was discovered that Thunderbird allowed improper access to the Location object. An attacker could exploit this to obtain sensitive information. Under certain circumstances, a remote attacker could use this vulnerability to potentially execute arbitrary code as the user invoking the program. (CVE-2012-4192, CVE-2012-4193).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 16.0 and thus, is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The installed version of SeaMonkey is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

ID	名稱	產品	系列	已發布	已更新	嚴重性
64133	SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 6951)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	critical
74779	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1345-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
62548	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1611-1)	Nessus	Ubuntu Local Security Checks	2012/10/15	2019/9/19	critical
62576	Firefox < 16.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2012/10/17	2026/3/3	critical
62583	SeaMonkey < 2.13 Multiple Vulnerabilities	Nessus	Windows	2012/10/17	2026/5/27	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical