Mozilla Project reports :

MFSA 2010-33 User tracking across sites using Math.random()

MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type:
multipart also present

MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes

MFSA 2010-30 Integer Overflow in XSLT Node Sorting

MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal

MFSA 2010-28 Freed object reuse across plugin instances

MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()

MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

MFSA 2010-25 Re-use of freed object due to scope confusion

USN-930-1 fixed vulnerabilities in Firefox. Due to a software packaging problem, the Firefox 3.6 update could not be installed when the firefox-2 package was also installed. This update fixes the problem and updates apturl for the change.

If was discovered that Firefox could be made to access freed memory.
If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2010-1121)

Several flaws were discovered in the browser engine of Firefox. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1200, CVE-2010-1201, CVE-2010-1202, CVE-2010-1203)

A flaw was discovered in the way plugin instances interacted. An attacker could potentially exploit this and use one plugin to access freed memory from a second plugin to execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1198)

An integer overflow was discovered in Firefox. If a user were tricked into viewing a malicious site, an attacker could overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1196)

Martin Barbella discovered an integer overflow in an XSLT node sorting routine. An attacker could exploit this to overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1199)

Michal Zalewski discovered that the focus behavior of Firefox could be subverted. If a user were tricked into viewing a malicious site, a remote attacker could use this to capture keystrokes. (CVE-2010-1125)

Ilja van Sprundel discovered that the 'Content-Disposition:
attachment' HTTP header was ignored when 'Content-Type:
multipart' was also present. Under certain circumstances, this could potentially lead to cross-site scripting attacks.
(CVE-2010-1197)

Amit Klein discovered that Firefox did not seed its random number generator often enough. An attacker could exploit this to identify and track users across different websites.
(CVE-2008-5913).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Martin Barbella discovered an integer overflow in an XSLT node sorting routine. An attacker could exploit this to overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1199)

An integer overflow was discovered in Thunderbird. If a user were tricked into viewing malicious content, an attacker could overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2010-1196)

Several flaws were discovered in the browser engine of Thunderbird. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1200, CVE-2010-1201, CVE-2010-1202, CVE-2010-1203)

If was discovered that Thunderbird could be made to access freed memory. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program.
(CVE-2010-1121).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox was updated to version 3.5.10, fixing various bugs and security issues.

MFSA 2010-33 / CVE-2008-5913: Security researcher Amit Klein reported that it was possible to reverse engineer the value used to seed Math.random(). Since the pseudo-random number generator was only seeded once per browsing session, this seed value could be used as a unique token to identify and track users across different websites.

MFSA 2010-32 / CVE-2010-1197: Security researcher Ilja van Sprundel of IOActive reported that the Content-Disposition: attachment HTTP header was ignored when Content-Type: multipart was also present. This issue could potentially lead to XSS problems in sites that allow users to upload arbitrary files and specify a Content-Type but rely on Content-Disposition: attachment to prevent the content from being displayed inline.

MFSA 2010-31 / CVE-2010-1125: Google security researcher Michal Zalewski reported that focus() could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location. This behaviour was also present across origins when content from one domain was embedded within another via an iframe. A malicious web page could use this behaviour to steal keystrokes from a victim while they were typing sensitive information such as a password.

MFSA 2010-30 / CVE-2010-1199: Security researcher Martin Barbella reported via TippingPoint's Zero Day Initiative that an XSLT node sorting routine contained an integer overflow vulnerability. In cases where one of the nodes to be sorted contained a very large text value, the integer used to allocate a memory buffer to store its value would overflow, resulting in too small a buffer being created. An attacker could use this vulnerability to write data past the end of the buffer, causing the browser to crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-29 / CVE-2010-1196: Security researcher Nils of MWR InfoSecurity reported that the routine for setting the text value for certain types of DOM nodes contained an integer overflow vulnerability. When a very long string was passed to this routine, the integer value used in creating a new memory buffer to hold the string would overflow, resulting in too small a buffer being allocated. An attacker could use this vulnerability to write data past the end of the buffer, causing a crash and potentially running arbitrary code on a victim's computer.

MFSA 2010-28 / CVE-2010-1198: Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first plugin would contain a pointer to freed memory which, if accessed, could be used by an attacker to execute arbitrary code on a victim's computer.

MFSA 2010-27 / CVE-2010-0183: Security researcher wushi of team509 reported that the frame construction process for certain types of menus could result in a menu containing a pointer to a previously freed menu item. During the cycle collection process, this freed item could be accessed, resulting in the execution of a section of code potentially controlled by an attacker.

MFSA 2010-26 / CVE-2010-1200 / CVE-2010-1201 / CVE-2010-1202 / CVE-2010-1203: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2010-25 / CVE-2010-1121: A memory corruption flaw leading to code execution was reported by security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own contest sponsored by TippingPoint's Zero Day Initiative. By moving DOM nodes between documents Nils found a case where the moved node incorrectly retained its old scope. If garbage collection could be triggered at the right time then Firefox would later use this freed object. The contest winning exploit only affects Firefox 3.6 and not earlier versions. Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and Thunderbird 3.0 based on earlier versions of the browser engine were patched just in case there is an alternate way of triggering the underlying flaw.

From Red Hat Security Advisory 2010:0499 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1200)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1198)

An integer overflow flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1199)

A flaw was found in the way SeaMonkey processed mail attachments. A specially crafted mail message could cause SeaMonkey to crash.
(CVE-2010-0163)

A flaw was found in the way SeaMonkey handled the 'Content-Disposition: attachment' HTTP header when the 'Content-Type:
multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users.
(CVE-2010-1197)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

Updated firefox packages that address several security issues, fix bugs, add numerous enhancements, and upgrade Firefox to version 3.6.4, are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 June 2010] The original packages distributed with this erratum had a bug which could cause unintended dependencies to be installed when upgrading. We have updated the packages to correct this bug.

Mozilla Firefox is an open source web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203)

A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198)

Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199)

A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125)

A flaw was found in the way Firefox handled the 'Content-Disposition:
attachment' HTTP header when the 'Content-Type: multipart' HTTP header was also present. A website that allows arbitrary uploads and relies on the 'Content-Disposition: attachment' HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197)

A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913)

A flaw was found in the Firefox XML document loading security checks.
Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.4. You can find a link to the Mozilla advisories in the References section of this erratum.

This erratum upgrades Firefox from version 3.0.19 to version 3.6.4.
Due to the requirements of Firefox 3.6.4, this erratum also provides a number of other updated packages, including esc, totem, and yelp.

This erratum also contains multiple bug fixes and numerous enhancements. Space precludes documenting these changes in this advisory. For details concerning these changes, refer to the Firefox Release Notes links in the References section of this erratum.

Important: Firefox 3.6.4 is not completely backwards-compatible with all Mozilla Add-ons and Firefox plug-ins that worked with Firefox 3.0.19. Firefox 3.6 checks compatibility on first-launch, and, depending on the individual configuration and the installed Add-ons and plug-ins, may disable said Add-ons and plug-ins, or attempt to check for updates and upgrade them. Add-ons and plug-ins may have to be manually updated.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.4. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Update to new upstream Firefox version 3.6.4, fixing a security issue detailed in the upstream advisory:
http://www.mozilla.org/security/known- vulnerabilities/firefox36.html#firefox3.6.4 Update also includes packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2010-1200 CVE-2010-1202 CVE-2010-1203 CVE-2010-1198 CVE-2010-1196 CVE-2010-1199 CVE-2010-1125 CVE-2010-1197 CVE-2008-5913

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mozilla Firefox has been updated to version 3.5.10, fixing various bugs and security issues.

  - Security researcher Amit Klein reported that it was     possible to reverse engineer the value used to seed     Math.random(). Since the pseudo-random number generator     was only seeded once per browsing session, this seed     value could be used as a unique token to identify and     track users across different websites. (MFSA 2010-33/     CVE-2008-5913)

  - Security researcher Ilja van Sprundel of IOActive     reported that the Content-Disposition: attachment HTTP     header was ignored when `Content-Type: multipart` was     also present. This issue could potentially lead to XSS     problems in sites that allow users to upload arbitrary     files and specify a content type but rely on     Content-Disposition: attachment to prevent the content     from being displayed inline. (MFSA 2010-32/     CVE-2010-1197)

  - Google security researcher Michal Zalewski reported that     focus() could be used to change a user's cursor focus     while they are typing, potentially directing their     keyboard input to an unintended location. This behaviour     was also present across origins when content from one     domain was embedded within another via an iframe. A     malicious web page could use this behaviour to steal     keystrokes from a victim while they were typing     sensitive information such as a password. (MFSA 2010-31/     CVE-2010-1125)

  - Security researcher Martin Barbella reported via     TippingPoint's Zero Day Initiative that an XSLT node     sorting routine contained an integer overflow     vulnerability. In cases where one of the nodes to be     sorted contained a very large text value, the integer     used to allocate a memory buffer to store its value     would overflow, resulting in too small a buffer being     created. An attacker could use this vulnerability to     write data past the end of the buffer, causing the     browser to crash and potentially running arbitrary code     on a victim's computer. (MFSA 2010-30/ CVE-2010-1199)

  - Security researcher Nils of MWR InfoSecurity reported     that the routine for setting the text value for certain     types of DOM nodes contained an integer overflow     vulnerability. When a very long string was passed to     this routine, the integer value used in creating a new     memory buffer to hold the string would overflow,     resulting in too small a buffer being allocated. An     attacker could use this vulnerability to write data past     the end of the buffer, causing a crash and potentially     running arbitrary code on a victim's computer. . (MFSA     2010-29/ CVE-2010-1196)

  - Microsoft Vulnerability Research reported that two     plugin instances could interact in a way in which one     plugin gets a reference to an object owned by a second     plugin and continues to hold that reference after the     second plugin is unloaded and its object is destroyed.
    In these cases, the first plugin would contain a pointer     to freed memory which, if accessed, could be used by an     attacker to execute arbitrary code on a victim's     computer. (MFSA 2010-28/ CVE-2010-1198)

  - Security researcher Wushi of Team509 reported that the     frame construction process for certain types of menus     could result in a menu containing a pointer to a     previously freed menu item. During the cycle collection     process, this freed item could be accessed, resulting in     the execution of a section of code potentially     controlled by an attacker. (MFSA 2010-27/ CVE-2010-0183)

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2010-26/ CVE-2010-1200 / CVE-2010-1201 /     CVE-2010-1202 / CVE-2010-1203)

  - A memory corruption flaw leading to code execution was     reported by security researcher Nils of MWR InfoSecurity     during the 2010 Pwn2Own contest sponsored by     TippingPoint's Zero Day Initiative. By moving DOM nodes     between documents, Nils found a case where the moved     node incorrectly retained its old scope. If garbage     collection could be triggered at the right time then     Firefox would later use this freed object. The exploit     only affects Firefox 3.6 and not earlier versions.
    Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and     Thunderbird 3.0 based on earlier versions of the browser     engine were patched just in case there is an alternate     way of triggering the underlying flaw. (MFSA 2010-25/     CVE-2010-1121)

Update to new upstream Thunderbird version 3.0.6, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security /known-vulnerabilities/thunderbird30.html#thunderbird3.0.5 http://www.mozilla.org/security/known- vulnerabilities/thunderbird30.html#thunderbird3.0.6 Update also includes sunbird package rebuilt against new version of Thunderbird.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 3.5.10.  Such versions are potentially affected by the following security issues :

  - A memory corruption vulnerability can lead to arbitrary     code execution if garbage collection is carefully timed     after DOM nodes are moved between documents.
    (MFSA 2010-25)

  - Multiple crashes can result in arbitrary code     execution. (MFSA 2010-26)  
  - An error in 'nsCycleCollector' may allow access to a     previously freed resource leading to arbitrary code     execution. (MFSA 2010-27)

  - A plugin is allowed to hold a reference to an object     owned by a second plugin even after the second plugin     is unloaded and the referenced object no longer exists.
    This could allow arbitrary code execution. (MFSA 2010-28)

  - An error in 'nsGenericDOMDataNode' allows a buffer     overflow in certain DOM nodes leading to arbitrary code     execution. (MFSA 2010-29)

  - An error in a XSLT node sorting function contains an     integer overflow leading to application crashes and     possible arbitrary code execution. (MFSA 2010-30)

  - A cross-site scripting vulnerability exists when     content from one domain is embedded in pages from other     domains and the 'focus()' function is used, leading to     information disclosure. (MFSA 2010-31)

  - The HTTP header, 'Content-Disposition: attachment', is     ignored when the HTTP header 'Content-Type: multipart'     is present. This could allow cross-site scripting to     occur. (MFSA 2010-32)

  - The pseudo-random number generator is only seeded once     per browsing session and 'Math.random()' may be used to     recover the seed value allowing the browser instance     to be tracked across different websites. (MFSA 2010-33)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
47130	FreeBSD : mozilla -- multiple vulnerabilities (99858b7c-7ece-11df-a007-000f20797ede)	Nessus	FreeBSD Local Security Checks	2010/6/25	2021/1/6	critical
47574	Ubuntu 8.04 LTS : firefox regression (USN-930-3)	Nessus	Ubuntu Local Security Checks	2010/7/1	2019/9/19	critical
47618	Ubuntu 10.04 LTS : thunderbird vulnerabilities (USN-943-1)	Nessus	Ubuntu Local Security Checks	2010/7/7	2019/9/19	critical
47693	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	2010/7/9	2021/1/14	critical
68053	Oracle Linux 3 / 4 : seamonkey (ELSA-2010-0499)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
47129	CentOS 5 : firefox (CESA-2010:0501)	Nessus	CentOS Local Security Checks	2010/6/25	2021/1/4	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
47225	Fedora 13 : firefox-3.6.4-1.fc13 / galeon-2.0.7-29.fc13 / gnome-python2-extras-2.25.3-19.fc13 / etc (2010-10361)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
49893	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7083)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	critical
47810	Fedora 12 : sunbird-1.0-0.23.20090916hg.fc12 / thunderbird-3.0.6-1.fc12 (2010-11361)	Nessus	Fedora Local Security Checks	2010/7/23	2021/1/11	critical
47119	RHEL 5 : firefox (RHSA-2010:0501)	Nessus	Red Hat Local Security Checks	2010/6/23	2021/1/14	critical
47123	Firefox < 3.5.10 Multiple Vulnerabilities	Nessus	Windows	2010/6/23	2026/6/23	high
47691	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0358-2)	Nessus	SuSE Local Security Checks	2010/7/9	2021/1/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical