The installed version of Firefox is affected by various security issues :

  - Several stability bugs leading to crashes which, in     some cases, show traces of memory corruption     (MFSA 2008-21).

  - A vulnerability involving violation of the same-origin     policy could allow for cross-site scripting attacks     (MFSA 2008-22).

  - JavaScript can be injected into the context of signed     JARs and executed under the context of the JAR's signer     (MFSA 2008-23).

  - By taking advantage of the privilege level stored in     the pre-compiled 'fastload' file, an attacker may be     able to run arbitrary JavaScript code with chrome     privileges (MFSA 2008-24).

  - Arbitrary code execution is possible in     'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).

  - An attacker can steal files from known locations on a     victim's computer via originalTarget and DOM Range     (MFSA 2008-27).

  - It is possible for a malicious Java applet to bypass     the same-origin policy and create arbitrary socket     connections to other domains (MFSA 2008-28).

  - An improperly encoded '.properties' file in an add-on     can result in uninitialized memory being used, which     could lead to data formerly used by other programs     being exposed to the add-on code (MFSA 2008-29).

  - File URLs in directory listings are not properly HTML-     escaped when the filenames contained particular     characters (MFSA 2008-30).

  - A weakness in the trust model regarding alt names on     peer-trusted certs could lead to spoofing secure     connections to any other site (MFSA 2008-31).

  - URL shortcut files on Windows (for example, saved IE     favorites) could be interpreted as if they were in the     local file context when opened by Firefox, although     the referenced remote content would be downloaded and     displayed (MFSA 2008-32).

  - A crash in Mozilla's block reflow code could be used     by an attacker to crash the browser and run arbitrary     code on the victim's computer (MFSA 2008-33).

New seamonkey packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues.

From Red Hat Security Advisory 2008:0616 :

Updated thunderbird packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed HTML content.
An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed HTML content was displayed. An HTML mail containing specially crafted content could, potentially, trick a Thunderbird user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Thunderbird. An HTML mail containing malicious content could cause Thunderbird to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by Thunderbird. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Thunderbird escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Thunderbird. (CVE-2008-2808)

A flaw was found in the way Thunderbird displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

Note: JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

The installed version of SeaMonkey is affected by various security issues :

  - A stability problem that could result in a crash during     JavaScript garbage collection (MFSA 2008-20).

  - Several stability bugs leading to crashes which, in     some cases, show traces of memory corruption     (MFSA 2008-21).

  - A vulnerability involving violation of the same-origin     policy could allow for cross-site scripting attacks     (MFSA 2008-22).

  - JavaScript can be injected into the context of signed     JARs and executed under the context of the JAR's signer     (MFSA 2008-23).

  - By taking advantage of the privilege level stored in     the pre-compiled 'fastload' file. an attacker may be     able to run arbitrary JavaScript code with chrome     privileges (MFSA 2008-24).

  - Arbitrary code execution is possible in     'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).

  - Several function calls in the MIME handling code     use unsafe versions of string routines (MFSA 2008-26).

  - An attacker can steal files from known locations on a     victim's computer via originalTarget and DOM Range     (MFSA 2008-27).

  - It is possible for a malicious Java applet to bypass     the same-origin policy and create arbitrary socket     connections to other domains (MFSA 2008-28).

  - An improperly encoded '.properties' file in an add-on     can result in uninitialized memory being used, which     could lead to data formerly used by other programs     being exposed to the add-on code (MFSA 2008-29).

  - File URLs in directory listings are not properly HTML-     escaped when the filenames contained particular     characters (MFSA 2008-30).

  - A weakness in the trust model regarding alt names on     peer-trusted certs could lead to spoofing secure     connections to any other site (MFSA 2008-31).

  - URL shortcut files on Windows (for example, saved IE     favorites) could be interpreted as if they were in the     local file context when opened by SeaMonkey, although     the referenced remote content would be downloaded and     displayed (MFSA 2008-32).

  - A crash in Mozilla's block reflow code could be used     by an attacker to crash the browser and run arbitrary     code on the victim's computer (MFSA 2008-33).

Updated seamonkey packages that fix several security issues are now available for Fedora 8. SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite. Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803) Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2798, CVE-2008-2799, CVE-2008-2811) Several flaws were found in the way malformed web content was displayed. A web page containing specially crafted content could potentially trick a Firefox user into surrendering sensitive information. (CVE-2008-2800) Two local file disclosure flaws were found in Firefox. A web page containing malicious content could cause Firefox to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810) A flaw was found in the way a malformed .properties file was processed by Firefox. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807) A flaw was found in the way Firefox escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running Firefox. (CVE-2008-2808) A flaw was found in the way Firefox displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809) Updated packages update SeaMonkey to upstream version 1.1.10 to address these flaws:
http://www.mozilla.org/projects/security/known- vulnerabilities.html#seamonkey1.1.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Thunderbird prior to 2.0.0.16 are affected by the following vulnerabilities :

 - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption (MFSA 2008-21).
 - By taking advantage of the privilege level stored in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code with chrome privileges (MFSA 2008-24).
 - Arbitrary code execution is possible in 'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).
 - Several function calls in the MIME handling code use unsafe versions of string routines (MFSA 2008-26).
 - An improperly encoded '.properties' file in an add-on can result in uninitialized memory being used, which could lead to data formerly used by other programs being exposed to the add-on code (MFSA 2008-29).
 - A weakness in the trust model regarding alt names on peer-trusted certs could lead to spoofing secure connections to any other site (MFSA 2008-31).
 - A crash in Mozilla's block reflow code could be used by an attacker to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).
 - By creating a very large number of references to a common CSS object, an attacker can overflow the CSS reference counter, causing a crash when the browser attempts to free the CSS object while still in use and allowing for arbitrary code execution (MFSA 2008-34).

The installed version of SeaMonkey is affected by various security issues :

  - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption (MFSA 2008-21).
  - A vulnerability involving violation of the same-origin policy could allow for cross-site scripting attacks (MFSA 2008-22).
  - JavaScript can be injected into the context of signed JARs and executed under the context of the JAR's signer (MFSA 2008-23).
  - By taking advantage of the privilege level stored in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code with chrome privileges (MFSA 2008-24).
  - Arbitrary code execution is possible in 'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).
  - An attacker can steal files from known locations on a victim's computer via originalTarget and DOM Range (MFSA 2008-27).
  - It is possible for a malicious Java applet to bypass the same-origin policy and create arbitrary socket connections to other domains (MFSA 2008-28).
  - An improperly encoded '.properties' file in an add-on can result in uninitialized memory being used, which could lead to data formerly used by other programs being exposed to the add-on code (MFSA 2008-29).
  - File URLs in directory listings are not properly HTML-escaped when the filenames contained particular characters (MFSA 2008-30).
  - A weakness in the trust model regarding alt names on peer-trusted certs could lead to spoofing secure connections to any other site (MFSA 2008-31).
  - URL shortcut files on Windows (for example, saved IE favorites) could be interpreted as if they were in the local file context when opened by Seamonkey, although the referenced remote content would be downloaded and displayed (MFSA 2008-32).
  - A crash in Mozilla's block reflow code could be used by an attacker to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).

The installed version of Firefox is affected by various security issues :

 - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption (MFSA 2008-21).
  - A vulnerability involving violation of the same-origin policy could allow for cross-site scripting attacks (MFSA 2008-22).
  - JavaScript can be injected into the context of signed JARs and executed under the context of the JAR's signer (MFSA 2008-23).
  - By taking advantage of the privilege level stored in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code with chrome privileges (MFSA 2008-24).
  - Arbitrary code execution is possible in 'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).
  - An attacker can steal files from known locations on a victim's computer via originalTarget and DOM Range (MFSA 2008-27).
  - It is possible for a malicious Java applet to bypass the same-origin policy and create arbitrary socket connections to other domains (MFSA 2008-28).
  - An improperly encoded '.properties' file in an add-on can result in uninitialized memory being used, which could lead to data formerly used by other programs being exposed to the add-on code (MFSA 2008-29).
  - File URLs in directory listings are not properly HTML-escaped when the filenames contained particular characters (MFSA 2008-30).
  - A weakness in the trust model regarding alt names on peer-trusted certs could lead to spoofing secure connections to any other site (MFSA 2008-31).
  - URL shortcut files on Windows (for example, saved IE favorites) could be interpreted as if they were in the local file context when opened by Firefox, although the referenced remote content would be downloaded and displayed (MFSA 2008-32).
  - A crash in Mozilla's block reflow code could be used by an attacker to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).

The installed version of Thunderbird is affected by various security issues :


  - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption (MFSA 2008-21).

  - By taking advantage of the privilege level stored in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code with chrome privileges (MFSA 2008-24).

  - Arbitrary code execution is possible in 'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).

  - Several function calls in the MIME handling code use unsafe versions of string routines (MFSA 2008-26).

  - An improperly encoded '.properties' file in an add-on can result in uninitialized memory being used, which could lead to data formerly used by other programs being exposed to the add-on code (MFSA 2008-29).

  - A weakness in the trust model regarding alt names on peer-trusted certs could lead to spoofing secure connections to any other site (MFSA 2008-31).

  - A crash in Mozilla's block reflow code could be used by an attacker to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).

  - By creating a very large number of references to a common CSS object, an attacker can overflow the CSS reference counter, causing a crash when the browser attempts to free the CSS object while still in use and allowing for arbitrary code execution (MFSA 2008-34).

The installed version of Firefox is affected by various security issues :

  - Several stability bugs leading to crashes that, in some cases, show traces of memory corruption (MFSA 2008-21).
  - A vulnerability involving violation of the same-origin policy could allow for cross-site scripting attacks (MFSA 2008-22).
  - JavaScript can be injected into the context of signed JARs and executed under the context of the JAR's signer (MFSA 2008-23).
  - By taking advantage of the privilege level stored in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code with chrome privileges (MFSA 2008-24).
  - Arbitrary code execution is possible in 'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).
  - An attacker can steal files from known locations on a victim's computer via originalTarget and DOM Range (MFSA 2008-27).
  - It is possible for a malicious Java applet to bypass the same-origin policy and create arbitrary socket connections to other domains (MFSA 2008-28).
  - An improperly encoded '.properties' file in an add-on can result in uninitialized memory being used, which could lead to data formerly used by other programs being exposed to the add-on code (MFSA 2008-29).
  - File URLs in directory listings are not properly HTML-escaped when the filenames contained particular characters (MFSA 2008-30).
  - A weakness in the trust model regarding alt names on peer-trusted certs could lead to spoofing secure connections to any other site (MFSA 2008-31).
  - URL shortcut files on Windows (for example, saved IE favorites) could be interpreted as if they were in the local file context when opened by Firefox, although the referenced remote content would be downloaded and displayed (MFSA 2008-32).
  - A crash in Mozilla's block reflow code could be used by an attacker to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
33393	Firefox < 2.0.0.15 Multiple Vulnerabilities	Nessus	Windows	2008/7/2	2018/7/16	high
33466	Slackware 11.0 / 12.0 / 12.1 / current : seamonkey (SSA:2008-191-03)	Nessus	Slackware Local Security Checks	2008/7/10	2021/1/14	critical
67731	Oracle Linux 4 : thunderbird (ELSA-2008-0616)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
33394	SeaMonkey < 1.1.10 Multiple Vulnerabilities	Nessus	Windows	2008/7/2	2018/7/27	high
33455	Fedora 8 : seamonkey-1.1.10-1.fc8 (2008-6196)	Nessus	Fedora Local Security Checks	2008/7/10	2021/1/11	critical
4609	Mozilla Thunderbird < 2.0.0.16 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2008/7/25	2019/3/6	medium
4568	SeaMonkey < 1.1.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
4567	Mozilla Firefox < 2.0.0.15 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
801291	Mozilla Thunderbird < 2.0.0.16 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients			high
800753	Firefox < 2.0.0.15 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
800878	SeaMonkey < 1.1.10 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

检测

插件搜索

high

critical

critical

high

critical

medium

medium

medium

high

high

high