已在 Iceweasel（Debian 版本的 Mozilla Firefox Web 浏览器）中发现多种安全问题：多种内存安全错误、缺少输入审查漏洞、释放后使用漏洞、缓冲区溢出和其他编程错误，这些安全问题可能导致任意代码执行、权限升级、信息泄漏或跨站脚本。

我们正在改变稳定更新中的 Iceweasel、Icedove 和 Iceape 的安全更新的方法：我们现在不向后移植安全补丁，而是提供基于 Extended Support Release 分支的版本。因此，此更新引入基于 Firefox 17 的程序包，在未来某时，一旦 ESR 17 结束生命周期，我们将切换到下一个 ESR 分支。

Debian 存档中当前打包的某些 Xul 扩展不兼容新浏览器引擎。可从 http://addons.mozilla.org 检索最新的可兼容版本，作为短期解决方案。仍在挑选用于让打包的扩展与这些 Mozilla 版本兼容的解决方案。

我们再也没有资源来将安全补丁向后移植到旧稳定安全中的 Iceweasel 版本。如果您胜任此任务，并且也愿意提供帮助，请联系 team@security.debian.org。否则，我们将宣布下一轮更新中停止为 Squeeze 中的 Ieweasel、Icedove 和 Iceape 提供安全支持。

安装的 Firefox 版本低于 21.0，因此可能受到多种漏洞的影响：

- 存在各种内存安全问题。（CVE-2013-0801、CVE-2013-1669）

- 可能调用内容级别构造函数，允许构造函数具有 chrome 特权访问权限。(CVE-2013-1670)

- 由于文件输入控制可访问完整路径，存在信息泄漏。(CVE-2013-1671)

- Mozilla Maintenance Service 中存在本地权限升级问题。(CVE-2013-1672)

- Windows 上的 Mozilla Maintenance Service 容易遭受之前已修复权限升级攻击的影响。请注意，版本 12 之后的 Firefox 新安装版本不会受到此问题的影响。（CVE-2013-1673、CVE-2012-1942）

- 在播放的同时调整视频大小时存在一个释放后使用漏洞。(CVE-2013-1674)

- 使用了某些未经正确初始化的“DOMSVGZoomEvent”函数，这可导致信息泄露。(CVE-2013-1675)

- 存在多种内存损坏问题。（CVE-2013-1676、CVE-2013-1677、CVE-2013-1678、CVE-2013-1679、CVE-2013-1680、CVE-2013-1681）

安装的 Thunderbird 版本低于 17.0.6，因此可能受以下漏洞影响：

- 存在各种内存安全问题。(CVE-2013-0801)

- 可能调用内容级别构造函数，允许构造函数具有 chrome 特权访问权限。(CVE-2013-1670)

- Mozilla Maintenance Service 中存在本地权限升级问题。(CVE-2013-1672)

- 在播放的同时调整视频大小时存在一个释放后使用漏洞。(CVE-2013-1674)

- 使用了某些未经正确初始化的“DOMSVGZoomEvent”函数，这可导致信息泄露。(CVE-2013-1675)

- 存在多种内存损坏问题。（CVE-2013-1676、CVE-2013-1677、CVE-2013-1678、CVE-2013-1679、CVE-2013-1680、CVE-2013-1681）

远程主机受到 GLSA-201309-23 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可进行 XSS 攻击、欺骗 URL、绕过地址空间布局随机化、进行点击劫持攻击、获取潜在敏感信息、绕过访问限制、修改本地文件系统或进行其他不明攻击。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Thunderbird 17.x prior to 17.0.6 are affected by the following vulnerabilites : 

 - Various memory safety issues exist. (CVE-2013-0801)
 - It is possible to call a content level constructor that allows for the constructor to have chrome privileged access. (CVE-2013-1670)
 - A local privilege escalation issues exists in the Mozilla Maintenance Service. (CVE-2013-1672)
 - A use-after-free vulnerability exists when resizing video while playing. (CVE-2013-1674)
 - Some 'DOMSVGZoomEvent' functions are used without being properly initialized which could lead to information disclosure. (CVE-2013-1675)
 - Multiple memory corruption issues exist. (CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Firefox prior to 21.0 are potentially affected by the following security issues :

 - An outdated MozillaMaintenance Service registry entry can trigger a trusted path privilege escalation (CVE-2013-1673)
 - An unspecified arbitrary code execution vulnerability within update service (CVE-2012-1942)
 - An arbitrary code execution vulnerability in Mozilla Maintenance Service with junctions (CVE-2013-1672)
 - Multiple memory corruption vulnerabilities exist that can lead to code execution (CVE-2013-0801, CVE-2013-1669)
 - The Chrome Object Wrapper (COW) does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (CVE-2013-1670)
 - File input control can disclose full path information, leading to information leakage that can be used for further attacks (CVE-2013-1671)
 - Some DOMSVGZoomEvent functions are used without being properly initialized, which can lead to information leakage in certain cases. (CVE-2013-1675)
 - A series of use-after-free, out of bounds read, and invalid write problems can be exploited for remote code execution (CVE-2013-1674, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Thunderbird 17.x prior to 17.0.6 are potentially affected by the following vulnerabilities : 

  - Various memory safety issues exist. (CVE-2013-0801)

  - It is possible to call a content level constructor that allows for the constructor to have chrome privileged access. (CVE-2013-1670)

  - A local privilege escalation issues exists in the Mozilla Maintenance Service. (CVE-2013-1672)

  - A use-after-free vulnerability exists when resizing video while playing. (CVE-2013-1674)

  - Some 'DOMSVGZoomEvent' functions are used without being properly initialized which could lead to information disclosure. (CVE-2013-1675)

  - Multiple memory corruption issues exist. (CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Firefox 20.x and older are potentially affected by the following security issues :

  - An outdated MozillaMaintenance Service registry entry can trigger a trusted path privilege escalation (CVE-2013-1673)

  - An unspecified arbitrary code execution vulnerability within update service (CVE-2012-1942)

  - An arbitrary code execution vulnerability in Mozilla Maintenance Service with junctions (CVE-2013-1672)

  - Multiple memory corruption vulnerabilities exist that can lead to code execution (CVE-2013-0801, CVE-2013-1669)

  - The Chrome Object Wrapper (COW) does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (CVE-2013-1670)

  - File input control can disclose full path information, leading to information leakage that can be used for further attacks (CVE-2013-1671)

  - Some DOMSVGZoomEvent functions are used without being properly initialized, which can lead to information leakage in certain cases. (CVE-2013-1675)

  - A series of use-after-free, out of bounds read, and invalid write problems can be exploited for remote code execution (CVE-2013-1674, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

ID	名稱	產品	系列	已發布	已更新	嚴重性
66766	Debian DSA-2699-1：iceweasel - 多个漏洞	Nessus	Debian Local Security Checks	2013/6/3	2024/6/18	critical
66476	Firefox < 21.0 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/5/16	2023/4/25	critical
66477	Thunderbird 17.x < 17.0.6 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/5/16	2023/4/25	critical
70183	GLSA-201309-23：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	2013/9/28	2022/3/29	critical
6822	Mozilla Thunderbird 17.x < 17.0.6 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2013/5/15	2019/3/6	high
6828	Mozilla Firefox < 21.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/5/16	2019/3/6	high
801314	Mozilla Thunderbird 17.x < 17.0.6 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	2013/5/15		high
801267	Mozilla Firefox 20.x <= 20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/5/16		medium

偵測

搜尋 Plugin

critical

critical

critical

critical

high

high

high

medium