Mozilla SeaMonkey 已更新到 2.0.14 安全版本。

MFSA 2011-12：Mozilla 开发人员发现并修复了 Firefox 和其他基于 Mozilla 的产品所使用的浏览器引擎中的多个内存安全缺陷。这些缺陷中的一部分在特定情况下可导致内存损坏，我们推测只要通过足够的手段，至少能利用其中部分缺陷来运行任意代码。鸣谢

Mozilla 开发人员 Scoobidiver 报告了影响 Firefox 4 和 Firefox 3.6 的内存安全问题 (CVE-2011-0081)

Alcidion 的 Web 开发团队报告了影响 Firefox 4、Firefox 3.6 和 Firefox 3.5 的崩溃。(CVE-2011-0069)

Ian Beer 报告了影响 Firefox 4、Firefox 3.6 和 Firefox 3.5 的崩溃。(CVE-2011-0070)

Mozilla 开发人员 Bob Clary、Henri Sivonen、Marco Bonardo、Mats Palmgren 和 Jesse Ruderman 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。(CVE-2011-0080)

Aki Helin 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。（CVE-2011-0074、CVE-2011-0075）

Ian Beer 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。（CVE-2011-0077、CVE-2011-0078）

Martin Barbella 报告了影响 Firefox 3.6 和 Firefox 3.5 的内存安全问题。(CVE-2011-0072)

MFSA 2011-13 / CVE-2011-0065 / CVE-2011-0066 / CVE-2011-0073：安全研究员 regenrecht 通过 TippingPoint 零日计划报告了数个悬摆指针漏洞。

MFSA 2011-14 / CVE-2011-0067：安全研究员 Paul Stone 报告 Java 小程序可被用于与表单自动填写控件进行模仿交互，并从表单历史记录中窃取条目。

远程主机受到 GLSA-201301-01 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 和 XULRunner 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、绕过限制和保护机制、强制文件下载，进行 XML 注入攻击、进行 XSS 攻击、绕过同源策略、欺骗 URL 进行钓鱼攻击、触发垂直滚动、欺骗位置栏、欺骗 SSL 标识符、修改浏览器的字体、进行点击劫持攻击或者造成其他不明影响。
 本地攻击者可获得经提升的权限、获取敏感信息或替换任意已下载的文件。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Thunderbird 3.1.x prior to 3.1.10 are affected by the following vulnerabilities :

 - Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)
 - The 'resource:' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)

Versions of Firefox earlier than 3.5.19 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)
 - Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)
 - A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)
 - The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of Firefox could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)
 - The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)
 - The XSLT 'generate-id()' function returns may return a string that reveals a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of Thunderbird 3.1.x earlier than 3.1.10 are potentially affected by multiple vulnerabilities :

  - Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)

  - The 'resource:' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)

Versions of Firefox 4.0.x earlier than 4.0.1 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)
 - Multiple vulnerabilities in the WebGL feature and WebGLES could be exploited to execute arbitrary code or bypass ASLR protection on Windows. (MFSA2011-17) - The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of Firefox 3.6.x earlier than 3.6.17 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)
 - Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)
 - A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)
 - The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of Firefox could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)
 - The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)
 - The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of SeaMonkey earlier than 2.0.14 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)

  - Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)

  - A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)

  - The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of SeaMonkey could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)

  - The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)

  - The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of Firefox 4.0.x earlier than 4.0.1 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)

  - Multiple vulnerabilities in the WebGL feature and WebGLES could be exploited to execute arbitrary code or bypass ASLR protection on Windows. (MFSA2011-17) - The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of Firefox 3.6.x earlier than 3.6.17 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)

  - Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)

  - A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)

  - The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of Firefox could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)

  - The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)

  - The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)

Versions of Firefox earlier than 3.5.19 are potentially affected by multiple vulnerabilities : 

Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)

  - Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)

  - A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)

  - The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of Firefox could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)

  - The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)

  - The XSLT 'generate-id()' function returns may return a string that reveals a specific valid address of an object on the memory heap. (MFSA2011-18)

ID	名稱	產品	系列	已發布	已更新	嚴重性
76019	openSUSE 安全更新：seamonkey (seamonkey-4462)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
63402	GLSA-201301-01：Mozilla 产品：多种漏洞 (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2022/12/5	critical
5903	Mozilla Thunderbird 3.1.x < 3.1.10 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2011/4/29	2019/3/6	high
5900	Mozilla Firefox < 3.5.19 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2011/4/29	2019/3/6	high
801271	Mozilla Thunderbird 3.1.x < 3.1.10 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	2011/4/29		high
5902	Mozilla Firefox 4.0.x < 4.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2011/4/29	2019/3/6	high
5901	Mozilla Firefox 3.6.x < 3.6.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2011/4/29	2019/3/6	high
5904	SeaMonkey < 2.0.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2011/3/25	2019/3/6	high
801264	Mozilla Firefox 4.0.x < 4.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2011/4/29		high
801238	Mozilla Firefox 3.6.x < 3.6.17 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2011/4/29		high
801247	Mozilla Firefox < 3.5.19 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2011/4/29		high
801324	Mozilla SeaMonkey < 2.0.14 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2011/3/25		high

偵測

搜尋 Plugin

critical

critical

high

high

high

high

high

high

high

high

high

high