已安装的 Thunderbird ESR 17.x 版本可能受到以下安全问题的影响：

- 存在大量内存安全错误。(CVE-2013-0783)

- 存在与 Chrome 对象封装程序 (COW) 或仅系统封装程序 (SOW) 相关的错误，这可允许发生安全绕过。(CVE-2013-0773)

- 活动浏览器配置文件的文件系统位置可在进一步的攻击中泄露和使用。
 (CVE-2013-0774)

- 函数“nsImageLoadingContent”中存在一个释放后使用错误。(CVE-2013-0775)

- 可能因与代理“407”响应及嵌入式脚本代码相关的错误而冒充 HTTPS URL。
 (CVE-2013-0776)

- 函数“nsOverflowContinuationTracker::Finish”中存在基于堆的释放后使用错误。(CVE-2013-0780)

- 函数“nsSaveAsCharset::DoCharsetConversion”中存在基于堆的缓冲区溢出错误。
 (CVE-2013-0782)

来自 Red Hat 安全公告 2013:0271：

更新后的 firefox 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux 5 和 6。

Red Hat 安全响应团队已将此更新评级为具有严重安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Mozilla Firefox 是一款开源 Web 浏览器。XULRunner 提供用于 Mozilla Firefox 的 XUL Runtime 环境。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。（CVE-2013-0775、CVE-2013-0780、CVE-2013-0782、CVE-2013-0783）

已发现在取消代理服务器的认证提示后，地址栏仍然显示所请求的网站地址。攻击者可利用此缺陷，通过诱骗用户相信他们正在查看的站点受信任，从而执行钓鱼攻击。
(CVE-2013-0776)

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢这些问题的原始报告者 Nils、Abhishek Arya、Olli Pettay、Christoph Diehl、Gary Kwong、Jesse Ruderman、Andrew McCreight、Joe Drew、Wayne Mery 和 Michal Zalewski。

有关这些缺陷的技术详细信息，请参阅 Firefox 17.0.3 ESR 的 Mozilla 安全公告。在本勘误表的“参考”部分可以找到 Mozilla 公告的链接。

请注意，由于 Kerberos 凭据更改，在对企业身份管理 (IPA) Web 接口使用 Firefox 17.0.3 ESR 时，可能需要执行以下配置步骤：

https://access.redhat.com/knowledge/solutions/294303

重要：Firefox 17 不完全后向兼容 Firefox 10.0 中适用的所有 Mozilla 附加组件和 Firefox 插件。
Firefox 17 会在首次启动时检查兼容性，并且可能会禁用所述附加组件和插件（具体取决于个人的配置和已安装的附加组件和插件），或尝试检查并升级更新。可能需要手动更新附加组件和插件。

所有 Firefox 用户应升级这些更新后的程序包，其中包含已修正了这些问题的 Firefox 版本 17.0.3 ESR。安装更新后，必须重新启动 Firefox 才能使更改生效。

已在 Iceweasel（Debian 版本的 Mozilla Firefox Web 浏览器）中发现多种安全问题：多种内存安全错误、缺少输入审查漏洞、释放后使用漏洞、缓冲区溢出和其他编程错误，这些安全问题可能导致任意代码执行、权限升级、信息泄漏或跨站脚本。

我们正在改变稳定更新中的 Iceweasel、Icedove 和 Iceape 的安全更新的方法：我们现在不向后移植安全补丁，而是提供基于 Extended Support Release 分支的版本。因此，此更新引入基于 Firefox 17 的程序包，在未来某时，一旦 ESR 17 结束生命周期，我们将切换到下一个 ESR 分支。

Debian 存档中当前打包的某些 Xul 扩展不兼容新浏览器引擎。可从 http://addons.mozilla.org 检索最新的可兼容版本，作为短期解决方案。仍在挑选用于让打包的扩展与这些 Mozilla 版本兼容的解决方案。

我们再也没有资源来将安全补丁向后移植到旧稳定安全中的 Iceweasel 版本。如果您胜任此任务，并且也愿意提供帮助，请联系 team@security.debian.org。否则，我们将宣布下一轮更新中停止为 Squeeze 中的 Ieweasel、Icedove 和 Iceape 提供安全支持。

远程主机受到 GLSA-201309-23 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可进行 XSS 攻击、欺骗 URL、绕过地址空间布局随机化、进行点击劫持攻击、获取潜在敏感信息、绕过访问限制、修改本地文件系统或进行其他不明攻击。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Thunderbird prior to 17.0.3 are affected by the following security issues :

- Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)
 - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)
 - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)
 - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)
 - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)
 - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)
 - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)
 - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)
 - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)
 - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)
 - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)
 - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)
 - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Firefox prior to 19.0 are potentially affected by the following security issues :

 - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)
 - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)
 - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)
 - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)
 - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)
 - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)
 - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)
 - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)
 - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)
 - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)
 - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)
 - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)
 - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of SeaMonkey earlier than 2.16 are potentially affected by multiple vulnerabilities :

  - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Thunderbird less than 17.0.3  are potentially affected by the following security issues :

- Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)



  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

Versions of Firefox 18.x and older are potentially affected by the following security issues :

  - Numerous memory safety errors exist. (CVE-2013-0783, CVE-2013-0784)

  - An out-of-bounds read error exists related to the handling of GIF images. (CVE-2013-0772)

  - An error exists related to 'WebIDL' object wrapping that has an unspecified impact. (CVE-2013-0765)

  - An error exists related to Chrome Object Wrappers (COW) or System Only Wrappers (SOW) that could allow security bypass. (CVE-2013-0773)

  - The file system location of the active browser profile could be disclosed and used in further attacks. (CVE-2013-0774)

  - A use-after-free error exists in the function 'nsImageLoadingContent'. (CVE-2013-0775)

  - Spoofing HTTPS URLs is possible due to an error related to proxy '407' responses and embedded script code. (CVE-2013-0776)

  - A heap-based use-after-free error exists in the function 'nsDisplayBoxShadowOuter::Paint'. (CVE-2013-0777)

  - An out-of-bounds read error exists in the function 'ClusterIterator::NextCluster'. (CVE-2013-0778)

  - An out-of-bounds read error exists in the function 'nsCodingStateMachine::NextState'. (CVE-2013-0779)

  - A heap-based use-after-free error exists in the function 'nsOverflowContinuationTracker::Finish'. (CVE-2013-0780)

  - A heap-based use-after-free error exists in the function 'nsPrintEngine::CommonPrint'. (CVE-2013-0781)

  - A heap-based buffer overflow error exists in the function 'nsSaveAsCharset::DoCharsetConversion'. (CVE-2013-0782)

ID	名稱	產品	系列	已發布	已更新	嚴重性
64725	Mozilla Thunderbird ESR 17.x < 17.0.3 多种漏洞	Nessus	Windows	2013/2/20	2019/12/4	critical
68732	Oracle Linux 5 / 6：firefox (ELSA-2013-0271)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	high
66766	Debian DSA-2699-1：iceweasel - 多个漏洞	Nessus	Debian Local Security Checks	2013/6/3	2024/6/18	critical
70183	GLSA-201309-23：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	2013/9/28	2022/3/29	critical
6692	Mozilla Thunderbird < 17.0.3 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2013/2/20	2019/3/6	high
6691	Mozilla Firefox < 19.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/2/20	2019/3/6	high
6693	SeaMonkey < 2.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/2/22	2019/3/6	high
801245	Mozilla Thunderbird 17.x < 17.0.3 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	2013/2/20		high
801233	Mozilla Firefox 18.x <= 18 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/2/20		high
801258	Mozilla SeaMonkey < 2.16 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/2/22		high

偵測

搜尋 Plugin

critical

high

critical

critical

high

high

high

high

high

high