此 24.0 版的 MozillaThunderbird 更新，可修正數個安全性和非安全性問題：

- Thunderbird 24.0 的更新 (bnc#840485)

- MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 其他記憶體安全危險

- MFSA 2013-77/CVE-2013-1720 (bmo#888820) 有範本的 HTML5 Tree Builder 中有不當狀態

- MFSA 2013-79/CVE-2013-1722 (bmo#893308) Animation Manager 在樣式表複製期間發生釋放後使用

- MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey 在 Widget 已損毀後繼續處理金鑰訊息

- MFSA 2013-81/CVE-2013-1724 (bmo#894137) 使用 select 元素時有釋放後使用錯誤

- MFSA 2013-82/CVE-2013-1725 (bmo#876762) 新 JavaScript 物件的呼叫範圍可導致記憶體損毀

- MFSA 2013-85/CVE-2013-1728 (bmo#883686) IonMonkey 中有未初始化的資料

- MFSA 2013-88/CVE-2013-1730 (bmo#851353) 區間不符重新附加 XBL 支援的節點

- MFSA 2013-89/CVE-2013-1732 (bmo#883514) 含多欄、清單與浮動的緩衝區溢位

- MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871、bmo#906301) 牽涉捲動的記憶體損毀

- MFSA 2013-91/CVE-2013-1737 (bmo#907727) DOM proxy 上使用者定義的內容取得錯誤的 'this' 物件

- MFSA 2013-92/CVE-2013-1738 (bmo#887334、bmo#882897) 預設區間和框架鏈還原有 GC 危險

- 將希臘文移至一般翻譯套件

- 需要 NSPR 4.10 和 NSS 3.15.1

- 新增 Gecko 的 GStreamer 版本需求

- 新增 enigmail-build.patch，可修正 TB 包裝 (bmo#886095)

- 已移除過時的修補程式：

- enigmail-old-gcc.patch

- mozilla-gcc43-enums.patch

- mozilla-gcc43-template_hacks.patch

- mozilla-gcc43-templates_instantiation.patch

- ppc-xpcshell.patch

此 2.21 版的 seamonkey 更新，可修正數個安全性和非安全性問題：

- SeaMonkey 2.21 版的更新 (bnc#840485)

- MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 其他記憶體安全危險

- MFSA 2013-77/CVE-2013-1720 (bmo#888820) 有範本的 HTML5 Tree Builder 中有不當狀態

- MFSA 2013-78/CVE-2013-1721 (bmo#890277) ANGLE 程式庫中有整數溢位

- MFSA 2013-79/CVE-2013-1722 (bmo#893308) Animation Manager 在樣式表複製期間發生釋放後使用

- MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey 在 Widget 已損毀後繼續處理金鑰訊息

- MFSA 2013-81/CVE-2013-1724 (bmo#894137) 使用 select 元素時有釋放後使用錯誤

- MFSA 2013-82/CVE-2013-1725 (bmo#876762) 新 JavaScript 物件的呼叫範圍可導致記憶體損毀

- MFSA 2013-85/CVE-2013-1728 (bmo#883686) IonMonkey 中有未初始化的資料

- MFSA 2013-88/CVE-2013-1730 (bmo#851353) 區間不符重新附加 XBL 支援的節點

- MFSA 2013-89/CVE-2013-1732 (bmo#883514) 含多欄、清單與浮動的緩衝區溢位

- MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871、bmo#906301) 牽涉捲動的記憶體損毀

- MFSA 2013-91/CVE-2013-1737 (bmo#907727) DOM proxy 上使用者定義的內容取得錯誤的 'this' 物件

- MFSA 2013-92/CVE-2013-1738 (bmo#887334、bmo#882897) 預設區間和框架鏈還原有 GC 危險

- 需要 NSS 3.15.1

Versions of Mozilla Firefox earlier than version 24.0 are prone to the following vulnerabilities :

 - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)
 - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)
 - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)
 - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)
 - flaw in the NVIDIA OS X graphic drivers would allow portions of a user's desktop or other visible applications to be incorporated into WebGL canvases, leading to potential information disclosure (CVE-2013-1729)
 - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)
 - Same-origin bypass through symbolic links can allow for cross-site scripting and access to locally stored Firefox containing sensitive user data (CVE-2013-1727)
 - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)
 - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)
 - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)
 - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)
 - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)
 - An integer overflow in the Almost Native Graphics Layer Engine (ANGLE) can lead to a potentially exploitable crash (CVE-2013-1721)
 - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)  - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

Versions of Mozilla Thunderbird prior to version 24.0 (or ESR 17.0.9) are prone to the following vulnerabilities :

 - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)
 - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)
 - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)
 - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)
 - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)
 - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)
 - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)
 - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)
 - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)
 - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)
 - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)
 - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

Versions of SeaMonkey earlier than version 2.21 are prone to the following vulnerabilities:

  - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)

  - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)

  - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)

  - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)

  - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)

  - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)

  - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)

  - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)

  - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)

  - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)

  - An integer overflow in the Almost Native Graphics Layer Engine (ANGLE) can lead to a potentially exploitable crash (CVE-2013-1721)

  - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)

  - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

Versions of Mozilla Firefox ESR prior to 17.0.9 are prone to the following vulnerabilities :

 - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)
 - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)
 - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)
 - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)
 - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)
 - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)
 - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)
 - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)
 - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)
 - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)
 - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)
 - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75150	openSUSE 安全性更新：MozillaThunderbird (openSUSE-SU-2013:1495-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
75151	openSUSE 安全性更新：seamonkey (openSUSE-SU-2013:1491-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
8010	Mozilla Firefox < 24.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/9/18	2019/3/6	high
8011	Mozilla Thunderbird < 24.0	Nessus Network Monitor	SMTP Clients	2013/9/18	2019/11/6	high
8012	SeaMonkey < 2.21 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/9/18	2019/3/6	high
701237	Mozilla Firefox ESR < 17.0.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2019/11/6	2019/11/6	high

检测

插件搜索

critical

critical

high

high

high

high