The remote host is affected by the vulnerability described in GLSA-200711-14 (Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Mozilla Firefox and     SeaMonkey. Various errors in the browser engine and the JavaScript     engine can be exploited to cause a memory corruption (CVE-2007-5339 and     CVE-2007-5340). Before being used in a request, input passed to the     user ID when making an HTTP request with digest authentication is not     properly sanitised (CVE-2007-2292). The titlebar can be hidden by a XUL     markup language document (CVE-2007-5334). Additionally, an error exists     in the handling of 'smb:' and 'sftp:' URI schemes on systems with     gnome-vfs support (CVE-2007-5337). An unspecified error in the handling     of 'XPCNativeWrappers' and not properly implementing JavaScript     onUnload() handlers may allow the execution of arbitrary JavaScript     code (CVE-2007-5338 and CVE-2007-1095). Another error is triggered by     using the addMicrosummaryGenerator sidebar method to access file: URIs     (CVE-2007-5335).
  Impact :

    A remote attacker could exploit these issues to execute arbitrary code,     gain the privileges of the user running the application, disclose     sensitive information, conduct phishing attacks, and read and     manipulate certain data.
  Workaround :

    There is no known workaround at this time.

The installed version of Firefox is affected by various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

- Fri Oct 19 2007 Christopher Aillon <caillon at     redhat.com> - 2.0.0.8-1

    - Update to 2.0.0.8

    - Tue Oct 16 2007 Martin Stransky <stransky at       redhat.com>

    - added fix for #246248 - firefox crashes when searching

    - Wed Jul 18 2007 Kai Engert <kengert at redhat.com> -       2.0.0.5-1

    - Update to 2.0.0.5

    - Fri Jun 29 2007 Martin Stransky <stransky at       redhat.com> 2.0.0.4-3

    - backported pango patches from FC6 (1.5.0.12)

    - Sun Jun 3 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-2

    - Properly clean up threads with newer NSPR

    - Wed May 30 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-1

    - Final version

    - Wed May 23 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-0.rc3

    - Update to 2.0.0.4 RC3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. (CVE-2007-5339, CVE-2007-5340)

Flaws were discovered in the file upload form control. By tricking a user into opening a malicious web page, an attacker could force arbitrary files from the user's computer to be uploaded without their consent. (CVE-2006-2894, CVE-2007-3511)

Michal Zalewski discovered that the onUnload event handlers were incorrectly able to access information outside the old page content. A malicious website could exploit this to modify the contents, or steal confidential data (such as passwords), of the next loaded web page.
(CVE-2007-1095)

Stefano Di Paola discovered that Thunderbird did not correctly request Digest Authentications. A malicious website could exploit this to inject arbitrary HTTP headers or perform session splitting attacks against proxies. (CVE-2007-2292)

Eli Friedman discovered that XUL could be used to hide a window's titlebar. A malicious website could exploit this to enhance their attempts at creating phishing websites. (CVE-2007-5334)

Georgi Guninski discovered that Thunderbird would allow file-system based web pages to access additional files. By tricking a user into opening a malicious web page from a gnome-vfs location, an attacker could steal arbitrary files from the user's computer. (CVE-2007-5337)

It was discovered that the XPCNativeWrappers were not safe in certain situations. By tricking a user into opening a malicious web page, an attacker could run arbitrary JavaScript with the user's privileges.
(CVE-2007-5338)

Please note that JavaScript is disabled by default for emails, and it is not recommended to enable it.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several flaws were found in the way in which Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)

Several flaws were found in the way in which Firefox displayed malformed web content. A web page containing specially crafted content could potentially trick a user into surrendering sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

A flaw was found in the Firefox sftp protocol handler. A malicious web page could access data from a remote sftp site, possibly stealing sensitive user data. (CVE-2007-5337)

A request-splitting flaw was found in the way in which Firefox generates a digest authentication request. If a user opened a specially crafted URL, it was possible to perform cross-site scripting attacks, web cache poisoning, or other, similar exploits.
(CVE-2007-2292)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0979 advisory.

    [1.5.0.12-0.7.el4.0.1]
     - Add firefox-oracle-default-bookmarks.html and      firefox-oracle-default-prefs.js for errata rebuild

     [1.5.0.12-0.7.el4]
     - Update to latest snapshot of Mozilla 1.8.0 branch

     [1.5.0.12-0.6.el4]
     - added pathes for Mozilla bugs 325761 and 392149

     [1.5.0.12-0.5.el4]
     - added pathes for Mozilla bugs 199088,267833,309322,345305,361745,        362901,372309,378787,381300,384105,386914,387033,387881,388121,388784        390078,393537,395942

     [1.5.0.12-0.4.el4]
     - Updated pango patches, added indic printing support (#129207)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update brings Mozilla Firefox to security update version 2.0.0.8

Following security problems were fixed :

  - MFSA 2007-26 / CVE-2007-3844: Privilege escalation     through chrome-loaded about:blank windows

    Mozilla researcher moz_bug_r_a4 reported that a flaw was     introduced by the fix for MFSA 2007-20 that could enable     privilege escalation attacks against addons that create     'about:blank' windows and populate them in certain ways     (including implicit 'about:blank' document creation     through data: or javascript: URLs in a new window).

  - MFSA 2007-29: Crashes with evidence of memory corruption     As part of the Firefox 2.0.0.8 update releases Mozilla     developers fixed many bugs to improve the stability of     the product. Some of these crashes showed evidence of     memory corruption under certain circumstances and we     presume that with enough effort at least some of these     could be exploited to run arbitrary code.

  - CVE-2007-5339 Browser crashes

  - CVE-2007-5340 JavaScript engine crashes

  - MFSA 2007-30 / CVE-2007-1095: onUnload Tailgating

    Michal Zalewski demonstrated that onUnload event     handlers had access to the address of the new page about     to be loaded, even if the navigation was triggered from     outside the page content such as by using a bookmark,     pressing the back button, or typing an address into the     location bar. If the bookmark contained sensitive     information in the URL the attacking page might be able     to take advantage of it. An attacking page would also be     able to redirect the user, perhaps to a phishing page     that looked like the site the user thought they were     about to visit.

  - MFSA 2007-31 / CVE-2007-2292: Digest authentication     request splitting

    Security researcher Stefano Di Paola reported that     Firefox did not properly validate the user ID when     making an HTTP request using Digest Authentication to     log into a website. A malicious page could abuse this to     inject arbitrary HTTP headers by including a newline     character in the user ID followed by the injected header     data. If the user were connecting through a proxy the     attacker could inject headers that a proxy would     interpret as two separate requests for different hosts.

  - MFSA 2007-32 / CVE-2007-3511 / CVE-2006-2894: File input     focus stealing vulnerability

    A user on the Sla.ckers.org forums named hong reported     that a file upload control could be filled     programmatically by switching page focus to the label     before a file upload form control for selected keyboard     events. An attacker could use this trick to steal files     from the users' computer if the attacker knew the full     pathnames to the desired fileis and could create a     pretext that would convince the user to type long enough     to produce all the necessary characters.

  - MFSA 2007-33 / CVE-2007-5334: XUL pages can hide the     window titlebar

    Mozilla developer Eli Friedman discovered that web pages     written in the XUL markup language (rather than the     usual HTML) can hide their window's titlebar. It may     have been possible to abuse this ability to create more     convincing spoof and phishing pages.

  - MFSA 2007-34 / CVE-2007-5337: Possible file stealing     through sftp protocol

    On Linux machines with gnome-vfs support the smb: and     sftp: URI schemes are available in Firefox. Georgi     Guninski showed that if an attacker can store the attack     page in a mutually accessible location on the target     server (/tmp perhaps) and lure the victim into loading     it, the attacker could potentially read any file owned     by the victim from known locations on that server.

  - MFSA 2007-35 / CVE-2007-5338: XPCNativeWraper pollution     using Script object

    Mozilla security researcher moz_bug_r_a4 reported that     it was possible to use the Script object to modify     XPCNativeWrappers in such a way that subsequent access     by the browser chrome--such as by right-clicking to open     a context menu--can cause attacker-supplied JavaScript     to run with the same privileges as the user. This is     similar to MFSA 2007-25 fixed in Firefox 2.0.0.5

Only Windows is affected by :

  - MFSA 2007-27 / CVE-2007-3845: Unescaped URIs passed to     external programs

    This problem affects Windows only due to their handling     of URI launchers. 

  - MFSA 2007-28 / CVE-2006-4965: Code execution via     QuickTime Media-link files

    Linux does not have .lnk files, nor Quicktime. Not     affected.

  - MFSA 2007-36 / CVE-2007-4841 URIs with invalid     %-encoding mishandled by Windows

    This problem does not affected Linux.

This update fixes several security issues in Mozilla SeaMonkey 1.1.5.

Following security problems were fixed :

  - MFSA 2007-26 / CVE-2007-3844: Privilege escalation     through chrome-loaded about:blank windows

    Mozilla researcher moz_bug_r_a4 reported that a flaw was     introduced by the fix for MFSA 2007-20 that could enable     privilege escalation attacks against addons that create     'about:blank' windows and populate them in certain ways     (including implicit 'about:blank' document creation     through data: or javascript: URLs in a new window).

  - MFSA 2007-29: Crashes with evidence of memory corruption     As part of the Firefox 2.0.0.8 update releases Mozilla     developers fixed many bugs to improve the stability of     the product. Some of these crashes showed evidence of     memory corruption under certain circumstances and we     presume that with enough effort at least some of these     could be exploited to run arbitrary code.

  - CVE-2007-5339 Browser crashes

  - CVE-2007-5340 JavaScript engine crashes

  - MFSA 2007-30 / CVE-2007-1095: onUnload Tailgating

    Michal Zalewski demonstrated that onUnload event     handlers had access to the address of the new page about     to be loaded, even if the navigation was triggered from     outside the page content such as by using a bookmark,     pressing the back button, or typing an address into the     location bar. If the bookmark contained sensitive     information in the URL the attacking page might be able     to take advantage of it. An attacking page would also be     able to redirect the user, perhaps to a phishing page     that looked like the site the user thought they were     about to visit.

  - MFSA 2007-31 / CVE-2007-2292: Digest authentication     request splitting

    Security researcher Stefano Di Paola reported that     Firefox did not properly validate the user ID when     making an HTTP request using Digest Authentication to     log into a website. A malicious page could abuse this to     inject arbitrary HTTP headers by including a newline     character in the user ID followed by the injected header     data. If the user were connecting through a proxy the     attacker could inject headers that a proxy would     interpret as two separate requests for different hosts.

  - MFSA 2007-32 / CVE-2007-3511 / CVE-2006-2894: File input     focus stealing vulnerability

    A user on the Sla.ckers.org forums named hong reported     that a file upload control could be filled     programmatically by switching page focus to the label     before a file upload form control for selected keyboard     events. An attacker could use this trick to steal files     from the users' computer if the attacker knew the full     pathnames to the desired fileis and could create a     pretext that would convince the user to type long enough     to produce all the necessary characters.

  - MFSA 2007-33 / CVE-2007-5334: XUL pages can hide the     window titlebar

    Mozilla developer Eli Friedman discovered that web pages     written in the XUL markup language (rather than the     usual HTML) can hide their window's titlebar. It may     have been possible to abuse this ability to create more     convincing spoof and phishing pages.

  - MFSA 2007-34 / CVE-2007-5337: Possible file stealing     through sftp protocol

    On Linux machines with gnome-vfs support the smb: and     sftp: URI schemes are available in Firefox. Georgi     Guninski showed that if an attacker can store the attack     page in a mutually accessible location on the target     server (/tmp perhaps) and lure the victim into loading     it, the attacker could potentially read any file owned     by the victim from known locations on that server.

  - MFSA 2007-35 / CVE-2007-5338: XPCNativeWraper pollution     using Script object

    Mozilla security researcher moz_bug_r_a4 reported that     it was possible to use the Script object to modify     XPCNativeWrappers in such a way that subsequent access     by the browser chrome--such as by right-clicking to open     a context menu--can cause attacker-supplied JavaScript     to run with the same privileges as the user. This is     similar to MFSA 2007-25 fixed in Firefox 2.0.0.5

Only Windows is affected by :

  - MFSA 2007-27 / CVE-2007-3845: Unescaped URIs passed to     external programs

    This problem affects Windows only due to their handling     of URI launchers. 

  - MFSA 2007-28 / CVE-2006-4965: Code execution via     QuickTime Media-link files

    Linux does not have .lnk files, nor Quicktime. Not     affected.

  - MFSA 2007-36 / CVE-2007-4841 URIs with invalid     %-encoding mishandled by Windows

    This problem does not affected Linux.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
28197	GLSA-200711-14 : Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/11/14	2021/1/6	high
27521	Firefox < 2.0.0.8 Multiple Vulnerabilities	Nessus	Windows	2007/10/19	2026/6/23	high
27786	Fedora 7 : firefox-2.0.0.8-1.fc7 (2007-2664)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	high
28142	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mozilla-thunderbird, thunderbird vulnerabilities (USN-536-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
60268	Scientific Linux Security Update : firefox on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67591	Oracle Linux 5 : Critical: / firefox (ELSA-2007-0979)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
27528	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-4572)	Nessus	SuSE Local Security Checks	2007/10/24	2021/1/14	high
27573	openSUSE 10 Security Update : seamonkey (seamonkey-4594)	Nessus	SuSE Local Security Checks	2007/10/25	2021/1/14	high

检测

插件搜索

high

high

high

high

high

medium

high

high