Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. (CVE-2007-3734, CVE-2007-3735, CVE-2007-3737, CVE-2007-3738)

Several content injection flaws were found in the way Firefox handled certain JavaScript code. A web page containing malicious JavaScript code could inject arbitrary content into other web pages.
(CVE-2007-3736, CVE-2007-3089)

A flaw was found in the way Firefox cached web pages on the local disk. A malicious web page may be able to inject arbitrary HTML into a browsing session if the user reloads a targeted site. (CVE-2007-3656)

Users of Firefox are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

From Red Hat Security Advisory 2007:0722 :

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-3734, CVE-2007-3735, CVE-2007-3737, CVE-2007-3738)

Several content injection flaws were found in the way SeaMonkey handled certain JavaScript code. A web page containing malicious JavaScript code could inject arbitrary content into other web pages.
(CVE-2007-3736, CVE-2007-3089)

A flaw was found in the way SeaMonkey cached web pages on the local disk. A malicious web page may be able to inject arbitrary HTML into a browsing session if the user reloads a targeted site. (CVE-2007-3656)

Users of SeaMonkey are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0724 advisory.

    [1.5.0.12-0.3.el4.0.1]
     - Add firefox-oracle-default-bookmarks.html and      firefox-oracle-default-prefs.js for errata rebuild

     [1.5.0.12-0.3.el4]
     - Add a patch to stick with major versions 1.5.0.12 / 1.8.0.12

     [1.5.0.12-0.2.el4]
     - Update to latest snapshot of Mozilla 1.8.0 branch
     - Include patches for Mozilla bugs 379245, 384925, 178993,        381300 (+382686), 358594 (+380933), 382532 (+382503)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Firefox is affected by various security issues, one of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-3734, CVE-2007-3735, CVE-2007-3737, CVE-2007-3738)

Several content injection flaws were found in the way SeaMonkey handled certain JavaScript code. A web page containing malicious JavaScript code could inject arbitrary content into other web pages.
(CVE-2007-3736, CVE-2007-3089)

A flaw was found in the way SeaMonkey cached web pages on the local disk. A malicious web page may be able to inject arbitrary HTML into a browsing session if the user reloads a targeted site. (CVE-2007-3656)

Users of SeaMonkey are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3089     Ronen Zilberman and Michal Zalewski discovered that a     timing race allows the injection of content into     about:blank frames.

  - CVE-2007-3656     Michal Zalewski discovered that same-origin policies for     wyciwyg:// documents are insufficiently enforced.

  - CVE-2007-3734     Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz,     Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats     Palmgren, Olli Pettay, Paul Nickerson and Vladimir     Sukhoy discovered crashes in the layout engine, which     might allow the execution of arbitrary code.

  - CVE-2007-3735     Asaf Romano, Jesse Ruderman and Igor Bukanov discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2007-3736     'moz_bug_r_a4' discovered that the addEventListener()     and setTimeout() functions allow cross-site scripting.

  - CVE-2007-3737     'moz_bug_r_a4' discovered that a programming error in     event handling allows privilege escalation.

  - CVE-2007-3738     'shutdown' and 'moz_bug_r_a4' discovered that the     XPCNativeWrapper allows the execution of arbitrary code.

The Mozilla products in the oldstable distribution (sarge) are no longer supported with security updates. You're strongly encouraged to upgrade to stable as soon as possible.

Updated firefox packages that fix several security bugs are now available for Fedora Core 7.

Users of epiphany are advised to upgrade to these erratum packages, which contain an update to epiphany built against the updated Firefox packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML email message containing JavaScript code could cause Thunderbird to crash or potentially execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; these issues are not exploitable unless the user has enabled JavaScript. (CVE-2007-3089, CVE-2007-3734, CVE-2007-3735, CVE-2007-3736, CVE-2007-3737, CVE-2007-3738)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
25741	CentOS 4 / 5 : firefox (CESA-2007:0724)	Nessus	CentOS Local Security Checks	2007/7/23	2021/1/4	high
67546	Oracle Linux 3 / 4 : seamonkey (ELSA-2007-0722)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67548	Oracle Linux 5 : Critical: / firefox (ELSA-2007-0724)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	medium
25735	Firefox < 2.0.0.5 Multiple Vulnerabilities	Nessus	Windows	2007/7/19	2026/6/23	high
25739	CentOS 3 / 4 : seamonkey (CESA-2007:0722)	Nessus	CentOS Local Security Checks	2007/7/23	2021/1/4	high
25801	Debian DSA-1339-1 : iceape - several vulnerabilities	Nessus	Debian Local Security Checks	2007/7/30	2021/1/4	high
27692	Fedora 7 : epiphany-2.18.3-2.fc7 (2007-1138)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	high
60230	Scientific Linux Security Update : thunderbird on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

high

high

medium

high

high

high

high

high