Mozilla Thunderbird was updated to the 2.0.0.22 security release. It fixes various bugs and security issues :

  - MFSA-2009-14/CVE-2009-1302/CVE-2009-1303/CVE-2009-1304     CVE-2009-1305 Crashes with evidence of memory corruption     (rv:1.9.0.9)

  - MFSA 2009-17/CVE-2009-1307 (bmo#481342) Same-origin     violations when Adobe Flash loaded via view-source:
    scheme

  - MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833     Crashes with evidence of memory corruption (rv:1.9.0.11)

  - MFSA 2009-27/CVE-2009-1836 (bmo#479880) SSL tampering     via non-200 responses to proxy CONNECT requests

  - MFSA 2009-29/CVE-2009-1838 (bmo#489131) Arbitrary code     execution using event listeners attached to an element     whose owner document is null

  - MFSA 2009-32/CVE-2009-1841 (bmo#479560) JavaScript     chrome privilege escalation

  - MFSA 2009-33 (bmo#495057) Crash viewing     multipart/alternative message with text/enhanced part

The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues :

  - Crashes with evidence of memory corruption     (rv:1.9.0.11). (MFSA 2009-24 / CVE-2009-1392 /     CVE-2009-1832 / CVE-2009-1833)

  - (bmo#479413) URL spoofing with invalid unicode     characters. (MFSA 2009-25 / CVE-2009-1834)

  - (bmo#491801) Arbitrary domain cookie access by local     file: resources. (MFSA 2009-26 / CVE-2009-1835)

  - (bmo#479880) SSL tampering via non-200 responses to     proxy CONNECT requests. (MFSA 2009-27 / CVE-2009-1836)

  - (bmo#486269) Race condition while accessing the private     data of a NPObject JS wrapper class object. (MFSA     2009-28 / CVE-2009-1837)

  - (bmo#489131) Arbitrary code execution using event     listeners attached to an element whose owner document is     null. (MFSA 2009-29 / CVE-2009-1838)

  - (bmo#479943) Incorrect principal set for file: resources     loaded via location bar. (MFSA 2009-30 / CVE-2009-1839)

  - (bmo#477979) XUL scripts bypass content-policy checks.
    (MFSA 2009-31 / CVE-2009-1840)

  - (bmo#479560) JavaScript chrome privilege escalation.
    (MFSA 2009-32 / CVE-2009-1841)

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841)

A flaw was found in the processing of malformed, local file content.
If a user loaded malicious, local content via the file:// URL, it was possible for that content to access other local data. (CVE-2009-1835)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Versions of Firefox prior to 3.0.11 are affected by the following security issues : 

 - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-24)
 - Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to spoof the location bar. (MFSA 2009-25)
 - It may be possible for local resources loaded via 'file: ' protocol to access any domain's cookies saved on a user's system. (MFSA 2009-26)
 - It may be possible to tamper with SSL date via non-200 responses to proxy CONNECT requests. (MFSA 2009-27)
 - A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. (MFSA 2009-28)
 - If the owner document of an element becomes a null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-29)
 - When the 'file: ' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files. (MFSA-2009-30)
 - While loading external scripts into XUL documents content-loading policies are not checked. (MFSA 2009-31)
 - It may also be possible for scripts from page content to run with elevated privileges. (MFSA 2009-32)

The remote host is running a version of SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

The installed version of Firefox is earlier than 3.0.11. Such versions are potentially affected by the following security issues : 

  - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-24)

  - Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to spoof the location bar. (MFSA 2009-25)

  - It may be possible for local resources loaded via 'file: ' protocol to access any domain's cookies saved on a user's system. (MFSA 2009-26)

  - It may be possible to tamper with SSL date via non-200 responses to proxy CONNECT requests. (MFSA 2009-27)

  - A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. (MFSA 2009-28)

  - If the owner document of an element becomes a null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-29)

  - When the 'file: ' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files. (MFSA-2009-30)

  - While loading external scripts into XUL documents content-loading policies are not checked. (MFSA 2009-31)

  - It may also be possible for scripts from page content to run with elevated privileges. (MFSA 2009-32)

The remote host is running a version of Mozilla SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
40176	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-1091)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
41356	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1001)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
39373	CentOS 3 : seamonkey (CESA-2009:1096)	Nessus	CentOS Local Security Checks	2009/6/15	2021/1/4	high
5072	Mozilla Firefox < 3.0.11 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
5084	SeaMonkey < 1.1.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
800755	Firefox < 3.0.11 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
801255	Mozilla SeaMonkey < 1.1.17 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

检测

插件搜索

high

high

high

medium

medium

high

high