The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-419:04 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    NSPR provides platform independence for non-GUI operating system facilities. These facilities include     threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic     memory management (malloc and free) and shared library linking.
    XULRunner provides the XUL Runtime environment for Gecko applications.
    nspr packages are included     Security bugs fixed with this release:
    CVE-2009-1563     Array index error in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows remote attackers to     execute arbitrary code via a long string that triggers incorrect memory allocation and a heap-based buffer     overflow during conversion to a floating-point number.
    CVE-2009-3274     Mozilla Firefox 3.6a1, 3.5.2, and earlier 2.x and 3.x versions on Linux uses a predictable /tmp pathname     for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded     file by placing a file in a /tmp location before the download occurs, possibly related to the Archive     Manager component.
    NOTE: some of these details are obtained from third party information.
    CVE-2009-3370     Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by     forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an     attacker-readable form, with history entries.
    CVE-2009-3372     Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to     execute arbitrary code via a crafted regular expression in a Proxy Auto-configuration (PAC) file.
    CVE-2009-3373     Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before     3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary code via unspecified     vectors.
    CVE-2009-3374     The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before     3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome     privileged code and objects obtained from remote web sites, which allows remote attackers to execute     arbitrary JavaScript with chrome privileges via unspecified method calls, related to doubly-wrapped     objects.
    CVE-2009-3375     content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4     allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content     selection via the document.getSelection function.
    CVE-2009-3376     Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a     right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote     attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable     extension for an executable file.
    CVE-2009-3380     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 and     3.5.x before 3.5.4 allow remote attackers to cause a denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown vectors.
    CVE-2009-3382     layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does     not properly handle first-letter frames, which allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Firefox 3.5 is earlier than 3.5.4.  Such versions are potentially affected by the following security issues :

  - It may be possible for a malicious web page to     steal form history. (MFSA 2009-52)

  - By predicting the filename of an already     downloaded file in the downloads directory, a     local attacker may be able to trick the browser     into opening an incorrect file. (MFSA 2009-53)

  - Recursive creation of JavaScript web-workers     could crash the browser or allow execution of     arbitrary code on the remote system.
    (MFSA 2009-54)

  - Provided the browser is configured to use Proxy     Auto-configuration it may be possible for an     attacker to crash the browser or execute     arbitrary code. (MFSA 2009-55)

  - Mozilla's GIF image parser is affected by a     heap-based buffer overflow. (MFSA 2009-56)

  - A vulnerability in XPCOM utility     'XPCVariant::VariantDataToJS' could allow     executing arbitrary JavaScript code with chrome     privileges. (MFSA 2009-57)

  - A vulnerability in Mozilla's string to floating     point number conversion routine could allow     arbitrary code execution on the remote system.     (MFSA 2009-59)

  - It may be possible to read text from a web page     using JavaScript function 'document.getSelection()     from a different domain. (MFSA 2009-61)

  - If a file contains right-to-left override     character (RTL) in the filename it may be possible     for an attacker to obfuscate the filename and     extension of the file being downloaded.     (MFSA 2009-62)

  - Multiple memory safety bugs in media libraries     could potentially allow arbitrary code execution.
    (MFSA 2009-63)

  - Multiple memory corruption vulnerabilities could     potentially allow arbitrary code execution.
    (MFSA 2009-64)

The Mozilla Firefox browser was updated to version 3.0.0.15 to fix various bugs and security issues.

Following security issues have been fixed: MFSA 2009-52 / CVE-2009-3370: Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to theft. A malicious web page could synthesize events such as mouse focus and key presses on behalf of the victim and trick the browser into auto-filling the form fields with history entries and then reading the entries.

MFSA 2009-53 / CVE-2009-3274: Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer and knew the name of a file the victim intended to open through the Download Manager, he could use this vulnerability to place a malicious file in the world-writable directory used to save temporary downloaded files and cause the browser to choose the incorrect file when opening it. Since this attack requires local access to the victim's machine, the severity of this vulnerability was determined to be low.

MFSA 2009-54 / CVE-2009-3371: Security researcher Orlando Berrera of Sec Theory reported that recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. These conditions often result in a crash which could potentially be used by an attacker to run arbitrary code on a victim's computer.

MFSA 2009-55 / CVE-2009-3372: Security researcher Marco C. reported a flaw in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. In certain cases this flaw could be used by an attacker to crash a victim's browser and run arbitrary code on their computer. Since this vulnerability requires the victim to have PAC configured in their environment with specific regular expresssions which can trigger the crash, the severity of the issue was determined to be moderate.

MFSA 2009-56 / CVE-2009-3373: Security research firm iDefense reported that researcher regenrecht discovered a heap-based buffer overflow in Mozilla's GIF image parser. This vulnerability could potentially be used by an attacker to crash a victim's browser and run arbitrary code on their computer.

MFSA 2009-57 / CVE-2009-3374: Mozilla security researcher moz_bug_r_a4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web content, potentially executing malicious JavaScript code with chrome privileges.

MFSA 2009-59 / CVE-2009-1563: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer.

MFSA 2009-61 / CVE-2009-3375: Security researcher Gregory Fleischer reported that text within a selection on a web page can be read by JavaScript in a different domain using the document.getSelection function, violating the same-origin policy. Since this vulnerability requires user interaction to exploit, its severity was determined to be moderate.

MFSA 2009-62 / CVE-2009-3376: Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file.

MFSA 2009-64 / CVE-2009-3380 / CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383: Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Security issues were identified and fixed in firefox 3.0.x :

Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location.
This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer (CVE-2009-1563).

Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer and knew the name of a file the victim intended to open through the Download Manager, he could use this vulnerability to place a malicious file in the world-writable directory used to save temporary downloaded files and cause the browser to choose the incorrect file when opening it. Since this attack requires local access to the victim's machine, the severity of this vulnerability was determined to be low (CVE-2009-3274).

Security researcher Paul Stone reported that a user's form history, both from web content as well as the smart location bar, was vulnerable to theft. A malicious web page could synthesize events such as mouse focus and key presses on behalf of the victim and trick the browser into auto-filling the form fields with history entries and then reading the entries (CVE-2009-3370).

Security researcher Marco C. reported a flaw in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. In certain cases this flaw could be used by an attacker to crash a victim's browser and run arbitrary code on their computer. Since this vulnerability requires the victim to have PAC configured in their environment with specific regular expresssions which can trigger the crash, the severity of the issue was determined to be moderate (CVE-2009-3372).

Security research firm iDefense reported that researcher regenrecht discovered a heap-based buffer overflow in Mozilla's GIF image parser.
This vulnerability could potentially be used by an attacker to crash a victim's browser and run arbitrary code on their computer (CVE-2009-3373).

Mozilla security researcher moz_bug_r_a4 reported that the XPCOM utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects before returning them to chrome callers. This could result in chrome privileged code calling methods on an object which had previously been created or modified by web content, potentially executing malicious JavaScript code with chrome privileges (CVE-2009-3374).

Security researcher Gregory Fleischer reported that text within a selection on a web page can be read by JavaScript in a different domain using the document.getSelection function, violating the same-origin policy. Since this vulnerability requires user interaction to exploit, its severity was determined to be moderate (CVE-2009-3375).

Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file (CVE-2009-3376).

Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel Banchero, David Keeler, and Boris Zbarsky reported crashes in the browser engine which affected both Firefox 3 and Firefox 3.5 (CVE-2009-3380). Carsten Book reported a crash in the browser engine which affected only Firefox 3 (CVE-2009-3382).

This update provides the latest Mozilla Firefox 3.0.x to correct these issues.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3380     Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers,     Daniel Banchero, David Keeler and Boris Zbarsky reported     crashes in layout engine, which might allow the     execution of arbitrary code.

  - CVE-2009-3382     Carsten Book reported a crash in the layout engine,     which might allow the execution of arbitrary code.

  - CVE-2009-3376     Jesse Ruderman and Sid Stamm discovered spoofing     vulnerability in the file download dialog.

  - CVE-2009-3375     Gregory Fleischer discovered a bypass of the same-origin     policy using the document.getSelection() function.

  - CVE-2009-3374     'moz_bug_r_a4' discovered a privilege escalation to     Chrome status in the XPCOM utility     XPCVariant::VariantDataToJS.

  - CVE-2009-3373     'regenrecht' discovered a buffer overflow in the GIF     parser, which might lead to the execution of arbitrary     code.

  - CVE-2009-3372     Marco C. discovered that a programming error in the     proxy auto configuration code might lead to denial of     service or the execution of arbitrary code.

  - CVE-2009-3274     Jeremy Brown discovered that the filename of a     downloaded file which is opened by the user is     predictable, which might lead to tricking the user into     a malicious file if the attacker has local access to the     system.

  - CVE-2009-3370     Paul Stone discovered that history information from web     forms could be stolen.

From Red Hat Security Advisory 2009:1531 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

A flaw was found in the way SeaMonkey creates temporary file names for downloaded files. If a local attacker knows the name of a file SeaMonkey is going to download, they can replace the contents of that file with arbitrary contents. (CVE-2009-3274)

A heap-based buffer overflow flaw was found in the SeaMonkey string to floating point conversion routines. A web page containing malicious JavaScript could crash SeaMonkey or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey.
(CVE-2009-1563)

A flaw was found in the way SeaMonkey handles text selection. A malicious website may be able to read highlighted text in a different domain (e.g. another website the user is viewing), bypassing the same-origin policy. (CVE-2009-3375)

A flaw was found in the way SeaMonkey displays a right-to-left override character when downloading a file. In these cases, the name displayed in the title bar differs from the name displayed in the dialog body. An attacker could use this flaw to trick a user into downloading a file that has a file name or extension that differs from what the user expected. (CVE-2009-3376)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3380)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284333	MiracleLinux 3 : firefox-3.0.15-3.1AXS3 (AXSA:2009-419:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
42306	Firefox 3.5.x < 3.5.4 Multiple Vulnerabilities	Nessus	Windows	2009/10/29	2018/7/16	high
42388	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1499)	Nessus	SuSE Local Security Checks	2009/11/5	2021/1/14	critical
42391	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1499)	Nessus	SuSE Local Security Checks	2009/11/5	2021/1/14	critical
42992	Mandriva Linux Security Advisory : firefox (MDVSA-2009:290-1)	Nessus	Mandriva Local Security Checks	2009/12/4	2021/1/6	critical
44787	Debian DSA-1922-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	critical
67949	Oracle Linux 3 / 4 : seamonkey (ELSA-2009-1531)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical

检测

插件搜索

critical

high

critical

critical

critical

critical

critical