Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419)

Several flaws were found in the way Firefox displayed malformed web content. A webpage containing specially crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593)

A flaw was found in the way Firefox stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417)

A flaw was found in the way Firefox handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of Firefox. (CVE-2008-0418)

A flaw was found in the way Firefox saves certain text files. If a website offers a file of type 'plain/text', rather than 'text/plain', Firefox will not show future 'text/plain' content to the user in the browser, forcing them to save those files locally to view the content.
(CVE-2008-0592)

Users of firefox are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox.
(CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way Firefox displayed malformed web content. A web page containing specially crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593) A flaw was found in the way Firefox stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417) A flaw was found in the way Firefox handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of Firefox. (CVE-2008-0418) A flaw was found in the way Firefox saves certain text files. If a website offers a file of type 'plain/text', rather than 'text/plain', Firefox will not show future 'text/plain' content to the user in the browser, forcing them to save those files locally to view the content. (CVE-2008-0592) Users of firefox are advised to upgrade to these updated packages, which contain updated packages to resolve these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0412     Jesse Ruderman, Kai Engert, Martijn Wargers, Mats     Palmgren and Paul Nickerson discovered crashes in the     layout engine, which might allow the execution of     arbitrary code.

  - CVE-2008-0413     Carsten Book, Wesley Garland, Igor Bukanov,     'moz_bug_r_a4', 'shutdown', Philip Taylor and 'tgirmann'     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code.

  - CVE-2008-0414     'hong' and Gregory Fleischer discovered that file input     focus vulnerabilities in the file upload control could     allow information disclosure of local files.

  - CVE-2008-0415     'moz_bug_r_a4' and Boris Zbarsky discovered several     vulnerabilities in JavaScript handling, which could     allow privilege escalation.

  - CVE-2008-0417     Justin Dolske discovered that the password storage     mechanism could be abused by malicious websites to     corrupt existing saved passwords.

  - CVE-2008-0418     Gerry Eisenhaur and 'moz_bug_r_a4' discovered that a     directory traversal vulnerability in chrome: URI     handling could lead to information disclosure.

  - CVE-2008-0419     David Bloom discovered a race condition in the image     handling of designMode elements, which can lead to     information disclosure and potentially the execution of     arbitrary code.

  - CVE-2008-0591     Michal Zalewski discovered that timers protecting     security-sensitive dialogs (by disabling dialog elements     until a timeout is reached) could be bypassed by window     focus changes through JavaScript.

  - CVE-2008-0592     It was discovered that malformed content declarations of     saved attachments could prevent a user in the opening     local files with a '.txt' file name, resulting in minor     denial of service.

  - CVE-2008-0593     Martin Straka discovered that insecure stylesheet     handling during redirects could lead to information     disclosure.

  - CVE-2008-0594     Emil Ljungdahl and Lars-Olof Moilanen discovered that     phishing protections could be bypassed with <div>     elements.

The Mozilla products from the old stable distribution (sarge) are no longer supported with security updates.

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way Thunderbird displayed malformed HTML mail content. A HTML mail message containing specially crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593) A flaw was found in the way Thunderbird handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious HTML mail message to steal sensitive session data. Note: this flaw does not affect a default installation of Thunderbird. (CVE-2008-0418) Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled. A flaw was found in the way Thunderbird saves certain text files. If a remote site offers a file of type 'plain/text', rather than 'text/plain', Thunderbird will not show future 'text/plain' content to the user, forcing them to save those files locally to view the content.
(CVE-2008-0592) Users of thunderbird are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.12.

This update provides the latest Firefox to correct these issues.

This update brings Mozilla Firefox to security update version 2.0.0.12

Following security problems were fixed :

  - Web forgery overwrite with div overlay. (MFSA 2008-11 /     CVE-2008-0594)

  - URL token stealing via stylesheet redirect. (MFSA     2008-10 / CVE-2008-0593)

  - Mishandling of locally-saved plain text files. (MFSA     2008-09 / CVE-2008-0592)

  - File action dialog tampering. (MFSA 2008-08 /     CVE-2008-0591)

  - Web browsing history and forward navigation stealing.
    (MFSA 2008-06 / CVE-2008-0419)

  - Directory traversal via chrome: URI. (MFSA 2008-05 /     CVE-2008-0418)

  - Stored password corruption. (MFSA 2008-04 /     CVE-2008-0417)

  - Privilege escalation, XSS, Remote Code Execution. (MFSA     2008-03 / CVE-2008-0415)

  - Multiple file input focus stealing vulnerabilities.
    (MFSA 2008-02 / CVE-2008-0414)

  - Crashes with evidence of memory corruption     (rv:1.8.1.12). (MFSA 2008-01 / CVE-2008-0412)

The installed version of SeaMonkey is affected by various security issues :

  - Several stability bugs leading to crashes which, in     some cases, show traces of memory corruption

  - Several file input focus stealing vulnerabilities     that could result in uploading of arbitrary files     provided their full path and file names are known.

  - Several issues that allow scripts from page content     to escape from their sandboxed context and/or run     with chrome privileges, resulting in privilege     escalation, XSS, and/or remote code execution.

  - A directory traversal vulnerability via the     'chrome:' URI.

  - A vulnerability involving 'designMode' frames that     may result in web browsing history and forward     navigation stealing.

  - An information disclosure issue in the BMP     decoder.

  - Mis-handling of locally-saved plaintext files.

  - Possible disclosure of sensitive URL parameters,     such as session tokens, via the .href property of     stylesheet DOM nodes reflecting the final URI of     the stylesheet after following any 302 redirects.

  - A heap-based buffer overflow that can be triggered     when viewing an email with an external MIME     body.

  - Multiple cross-site scripting vulnerabilities     related to character encoding.

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0412     Jesse Ruderman, Kai Engert, Martijn Wargers, Mats     Palmgren and Paul Nickerson discovered crashes in the     layout engine, which might allow the execution of     arbitrary code.

  - CVE-2008-0413     Carsten Book, Wesley Garland, Igor Bukanov,     'moz_bug_r_a4', 'shutdown', Philip Taylor and 'tgirmann'     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code.

  - CVE-2008-0415     'moz_bug_r_a4' and Boris Zbarsky discovered several     vulnerabilities in JavaScript handling, which could     allow privilege escalation.

  - CVE-2008-0418     Gerry Eisenhaur and 'moz_bug_r_a4' discovered that a     directory traversal vulnerability in chrome: URI     handling could lead to information disclosure.

  - CVE-2008-0419     David Bloom discovered a race condition in the image     handling of designMode elements, which can lead to     information disclosure and potentially the execution of     arbitrary code.

  - CVE-2008-0591     Michal Zalewski discovered that timers protecting     security-sensitive dialogs (by disabling dialog elements     until a timeout is reached) could be bypassed by window     focus changes through JavaScript.

The Mozilla products from the old stable distribution (sarge) are no longer supported with security updates.

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0412     Jesse Ruderman, Kai Engert, Martijn Wargers, Mats     Palmgren and Paul Nickerson discovered crashes in the     layout engine, which might allow the execution of     arbitrary code.

  - CVE-2008-0413     Carsten Book, Wesley Garland, Igor Bukanov,     'moz_bug_r_a4', 'shutdown', Philip Taylor and 'tgirmann'     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code.

  - CVE-2008-0414     'hong' and Gregory Fleischer discovered that file input     focus vulnerabilities in the file upload control could     allow information disclosure of local files.

  - CVE-2008-0415     'moz_bug_r_a4' and Boris Zbarsky discovered several     vulnerabilities in JavaScript handling, which could     allow privilege escalation.

  - CVE-2008-0417     Justin Dolske discovered that the password storage     mechanism could be abused by malicious websites to     corrupt existing saved passwords.

  - CVE-2008-0418     Gerry Eisenhaur and 'moz_bug_r_a4' discovered that a     directory traversal vulnerability in chrome: URI     handling could lead to information disclosure.

  - CVE-2008-0419     David Bloom discovered a race condition in the image     handling of designMode elements, which can lead to     information disclosure and potentially the execution of     arbitrary code.

  - CVE-2008-0591     Michal Zalewski discovered that timers protecting     security-sensitive dialogs (by disabling dialog elements     until a timeout is reached) could be bypassed by window     focus changes through JavaScript.

  - CVE-2008-0592     It was discovered that malformed content declarations of     saved attachments could prevent a user from opening     local files with a '.txt' file name, resulting in minor     denial of service.

  - CVE-2008-0593     Martin Straka discovered that insecure stylesheet     handling during redirects could lead to information     disclosure.

  - CVE-2008-0594     Emil Ljungdahl and Lars-Olof Moilanen discovered that     phishing protections could be bypassed with <div>     elements.

The Mozilla products from the old stable distribution (sarge) are no longer supported with security updates.

This update backports changes to Mozilla SeaMonkey to the level of the security update version 1.8.1.12

Following security problems were fixed :

  - MFSA 2008-11/CVE-2008-0594 Web forgery overwrite with     div overlay

  - MFSA 2008-10/CVE-2008-0593 URL token stealing via     stylesheet redirect

  - MFSA 2008-09/CVE-2008-0592 Mishandling of locally-saved     plain text files

  - MFSA 2008-08/CVE-2008-0591 File action dialog tampering

  - MFSA 2008-06/CVE-2008-0419 Web browsing history and     forward navigation stealing

  - MFSA 2008-05/CVE-2008-0418 Directory traversal via     chrome: URI

  - MFSA 2008-04/CVE-2008-0417 Stored password corruption

  - MFSA 2008-03/CVE-2008-0415 Privilege escalation, XSS,     Remote Code Execution

  - MFSA 2008-02/CVE-2008-0414 Multiple file input focus     stealing vulnerabilities

  - MFSA 2008-01/CVE-2008-0412/CVE-2008-0413 Crashes with     evidence of memory corruption (rv:1.8.1.12)

The Mozilla XULRunner 1.8.1 engine was updated to security update version 1.8.1.12.

This includes fixes for the following security issues :

  - MFSA 2008-10/CVE-2008-0593 URL token stealing via     stylesheet redirect

  - MFSA 2008-09/CVE-2008-0592 Mishandling of locally-saved     plain text files

  - MFSA 2008-06/CVE-2008-0419 Web browsing history and     forward navigation stealing

  - MFSA 2008-05/CVE-2008-0418 Directory traversal via     chrome: URI

  - MFSA 2008-03/CVE-2008-0415 Privilege escalation, XSS,     Remote Code Execution

  - MFSA 2008-02/CVE-2008-0414 Multiple file input focus     stealing vulnerabilities

  - MFSA 2008-01/CVE-2008-0412 Crashes with evidence of     memory corruption (rv:1.8.1.12)

Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419)

Several flaws were found in the way SeaMonkey displayed malformed web content. A webpage containing specially crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593)

A flaw was found in the way SeaMonkey stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417)

A flaw was found in the way SeaMonkey handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of SeaMonkey. (CVE-2008-0418)

A flaw was found in the way SeaMonkey saves certain text files. If a website offers a file of type 'plain/text', rather than 'text/plain', SeaMonkey will not show future 'text/plain' content to the user in the browser, forcing them to save those files locally to view the content.
(CVE-2008-0592)

- Fri Feb 8 2008 Kai Engert <kengert at redhat.com> -     1.1.8-1

    - SeaMonkey 1.1.8

    - Sun Dec 2 2007 Kai Engert <kengert at redhat.com> -       1.1.7-1

    - SeaMonkey 1.1.7

    - Mon Nov 5 2007 Kai Engert <kengert at redhat.com> -       1.1.6-1

    - SeaMonkey 1.1.6

    - Fri Oct 19 2007 Kai Engert <kengert at redhat.com> -       1.1.5-1

    - SeaMonkey 1.1.5

    - Fri Jul 27 2007 Martin Stransky <stransky at       redhat.com> - 1.1.3-2

    - added pango patches

    - Fri Jul 20 2007 Kai Engert <kengert at redhat.com> -       1.1.3-1

    - SeaMonkey 1.1.3

    - Thu May 31 2007 Kai Engert <kengert at redhat.com>       1.1.2-1

    - SeaMonkey 1.1.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings Mozilla Thunderbird to security fix level of version 2.0.0.12

Following security problems were fixed :

  - MFSA 2008-11/CVE-2008-0594 Web forgery overwrite with     div overlay

  - MFSA 2008-10/CVE-2008-0593 URL token stealing via     stylesheet redirect

  - MFSA 2008-09/CVE-2008-0592 Mishandling of locally-saved     plain text files

  - MFSA 2008-08/CVE-2008-0591 File action dialog tampering

  - MFSA 2008-06/CVE-2008-0419 Web browsing history and     forward navigation stealing

  - MFSA 2008-05/CVE-2008-0418 Directory traversal via     chrome: URI

  - MFSA 2008-04/CVE-2008-0417 Stored password corruption

  - MFSA 2008-03/CVE-2008-0415 Privilege escalation, XSS,     Remote Code Execution

  - MFSA 2008-02/CVE-2008-0414 Multiple file input focus     stealing vulnerabilities

  - MFSA 2008-01/CVE-2008-0412 Crashes with evidence of     memory corruption (rv:1.8.1.12)

Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419)

Several flaws were found in the way Thunderbird displayed malformed HTML mail content. A HTML mail message containing specially crafted content could trick a user into surrendering sensitive information.
(CVE-2008-0591, CVE-2008-0593)

A flaw was found in the way Thunderbird handles certain chrome URLs.
If a user has certain extensions installed, it could allow a malicious HTML mail message to steal sensitive session data. Note: this flaw does not affect a default installation of Thunderbird. (CVE-2008-0418)

Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled.

A flaw was found in the way Thunderbird saves certain text files. If a remote site offers a file of type 'plain/text', rather than 'text/plain', Thunderbird will not show future 'text/plain' content to the user, forcing them to save those files locally to view the content. (CVE-2008-0592)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
30220	CentOS 4 / 5 : firefox (CESA-2008:0103)	Nessus	CentOS Local Security Checks	2008/2/11	2021/1/4	high
31067	Fedora 8 : Miro-1.1-3.fc8 / blam-1.8.3-13.fc8 / chmsee-1.0.0-1.28.fc8 / devhelp-0.16.1-5.fc8 / etc (2008-1535)	Nessus	Fedora Local Security Checks	2008/2/14	2021/1/11	high
31150	Debian DSA-1506-1 : iceape - several vulnerabilities	Nessus	Debian Local Security Checks	2008/2/25	2021/1/4	high
31314	Fedora 8 : thunderbird-2.0.0.12-1.fc8 (2008-2060)	Nessus	Fedora Local Security Checks	2008/2/29	2021/1/11	high
37189	Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:048)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	high
31087	SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5001)	Nessus	SuSE Local Security Checks	2008/2/14	2021/1/14	high
30210	SeaMonkey < 1.1.8 Multiple Vulnerabilities	Nessus	Windows	2008/2/8	2026/5/27	high
30225	Debian DSA-1485-2 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	2008/2/11	2021/1/4	high
30228	Debian DSA-1489-1 : iceweasel - several vulnerabilities	Nessus	Debian Local Security Checks	2008/2/11	2021/1/4	high
30245	RHEL 4 / 5 : firefox (RHSA-2008:0103)	Nessus	Red Hat Local Security Checks	2008/2/11	2021/1/14	high
31113	openSUSE 10 Security Update : seamonkey (seamonkey-5011)	Nessus	SuSE Local Security Checks	2008/2/18	2021/1/14	high
31622	openSUSE 10 Security Update : epiphany (epiphany-5102)	Nessus	SuSE Local Security Checks	2008/3/19	2021/1/14	high
60356	Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
31080	Fedora 7 : seamonkey-1.1.8-1.fc7 (2008-1669)	Nessus	Fedora Local Security Checks	2008/2/14	2021/1/11	high
31318	Fedora 7 : thunderbird-2.0.0.12-1.fc7 (2008-2118)	Nessus	Fedora Local Security Checks	2008/2/29	2021/1/11	high
31620	openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5095)	Nessus	SuSE Local Security Checks	2008/3/19	2021/1/14	high
60357	Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high