A buffer overflow vulnerability exists in nss_ldap versions prior to 198. When nss_ldap is configured without a value for the 'host' keyword, it attempts to configure itself using SRV records stored in DNS. nss_ldap does not check that the data returned by the DNS query will fit into an internal buffer, thus exposing it to an overflow.

A similar issue exists in versions of nss_ldap prior to 199 where nss_ldap does not check that the data returned by the DNS query has not been truncated by the resolver libraries to avoid a buffer overflow. This can make nss_ldap attempt to parse more data than what is actually available, making it vulnerable to a read buffer overflow.

Finally, a format string bug in the logging function of pam_ldap prior to version 144 exist.

All users are recommended to upgrade to these updated packages. Note that the nss_ldap packages for 7.2, 8.0, and Single Network Firewall 7.2 contain the pam_ldap modules.

Numerous security fixes are available in Mozilla 1.0.1. For a detailed list, refer to the 'Recently fixed security issues' page on the Mozilla website (see the first reference). All users are encouraged to upgrade to this latest stable 1.0.x release of Mozilla.

Updated Mozilla packages are now available for Red Hat Linux Advanced Server. These new packages fix vulnerabilities in previous versions of Mozilla.

Mozilla is an open source Web browser. Versions of Mozilla prior to version 1.0.1 contain various security vulnerabilities. These vulnerabilities could be used by an attacker to read data off of the local hard drive, to gain information that should normally be kept private, and in some cases to execute arbitrary code. For more information on the specific vulnerabilities fixed please see the references below.

All users of Mozilla should update to these errata packages containing Mozilla version 1.0.1 which is not vulnerable to these issues.

在 Mozilla 1.0.1 中發現數個安全性修正。如需詳細清單，請參閱 Mozilla 網站上「近期修正的安全性問題」頁面 (請見第一個參照)。建議所有使用者皆升級至此最新的 Mozilla 1.0.x 穩定版本。

多数のセキュリティ修正が Mozilla 1.0.1 で利用可能です。詳細なリストについては、Mozilla Web サイトの「Recently fixed security issues」ページを参照してください（最初のリファレンスを参照）。全ユーザーは、この最新の安定版（stable）である Mozilla 1.0.x リリースにアップグレードにすることが推奨されます。

Mozilla 1.0.1 中提供多种安全补丁。有关详细列表，请参考 Mozilla 网站（参阅第一个引用）中的“最近修复的安全问题”页面。建议所有用户升级到此 Mozilla 最新稳定 1.0.x 版本。

Versions of Mozilla Firefox prior to 1.0rc2 may allow a rogue web server to determine the existence of files on the side of the client. 

The remote host is using the Mozilla web browser, which contains a built-in IRC client. There is a flaw in this version that may allow an attacker to execute arbitrary code on this host, provided the user uses it to go on IRC.

The remote host is running a version of the Mozilla browser that could allow a remote attacker to detect the existence of files on the local file system of the web client accessing the attackers page. The vulnerability is caused by improper handling of embedded Cascading Style-Sheet (CSS) <LINK> elements in the broswer.

The remote host is using the Netscape web browser, which contains a built-in IRC client. There is a flaw in this version that may allow an attacker to execute arbitrary code on this host, provided the user uses it to go on IRC.

The remote host is using a version of the Netscape web browser that may allow a rogue web server to determine the existence of files on the side of the client. 

The remote host is using a version of the Galeon web browser that may allow a rogue web server to determine the existence of files on the side of the client.

The remote host is running a version of the Mozilla browser that has a problem in its implementation of the JavaScript "onUnload" event handler that has the potential to leak sensitive information to websites. When other pages are launched using the event handler, the vulnerable client encapsulates the address of the next page that is visited in the HTTP referer field. The correct behavior is to include the address of the previously visited page in the HTTP referer field. Using this handler, a webpage can cause the browser to link information about the next page that was visited.

The remote host is running a version of the Mozilla browser that is vulnerable to a buffer overflow. Specifically the browser will crash when handling an exceptionally long request (32kb+) for a channel. The vulnerability may be used to crash the browser and/or allow the execution of arbitrary code on the client host. 

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
13974	Mandrake Linux Security Advisory : nss_ldap (MDKSA-2002:075)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	high
61919	Mandrake Linux Security Advisory : mozilla (MDKSA-2002:074)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
12361	RHEL 2.1 : mozilla (RHSA-2003:046)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	high
61919	Mandrake Linux 安全性公告：mozilla (MDKSA-2002:074)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
61919	Mandrake Linux セキュリティアドバイザリ：mozilla（MDKSA-2002:074）	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
61919	Mandrake Linux 安全公告：mozilla (MDKSA-2002:074)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
1748	Mozilla Firefox < 1.0rc2 Local File Detection	Nessus Network Monitor	Web Clients	2004/8/20	2019/3/6	medium
1751	Mozilla < 1.0rc2 IRC Client Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	2004/8/20	2018/9/16	medium
1311	Netscape/Mozilla/Galeon Local File Enumeration (deprecated)	Nessus Network Monitor	SMTP Clients	2004/8/20	2019/3/6	low
1752	Netscape < 6.2.3 IRC Client Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	2004/8/20	2018/9/16	medium
1749	Netscape < 6.2.3 Local File Detection	Nessus Network Monitor	Web Clients	2004/8/20	2019/3/6	medium
1750	Galeon < 1.2.2 Local File Detection	Nessus Network Monitor	Web Clients	2004/8/20	2019/3/6	medium
1316	Mozilla OnUnload Referer Information Leakage Race Condition Information Disclosure (deprecated)	Nessus Network Monitor	SMTP Clients	2004/8/20	2019/3/6	low
1327	Netscape/Mozilla/Galeon Long IRC Channel Name Overflow (deprecated)	Nessus Network Monitor	SMTP Clients	2004/8/20	2019/3/6	critical

检测

插件搜索

high

high

high

high

high

high

medium

medium

low

medium

medium

medium

low

critical