Upstream security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This MozillaFirefox update to version 24.0 fixes several security and non-security issues :

  - move greek to the translations-common package     (bnc#840551)

  - update to Firefox 24.0 (bnc#840485)

  - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous     memory safety hazards

  - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state     in HTML5 Tree Builder with templates

  - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow     in ANGLE library

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey     continues handling key messages after widget is     destroyed

  - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free     with select element

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized     data in IonMonkey

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

  - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC     hazard with default compartments and frame chain     restoration

  - enable gstreamer explicitely via pref (gecko.js)

  - require NSS 3.15.1

The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments can result in denial of service or possibly     arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker can     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch can result in a denial     of service or arbitrary code execution.  Versions of     Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This can     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An issue in the NVIDIA OS X graphic drivers allows the     user's desktop to be viewed by web content, potentially     exposing sensitive information. (CVE-2013-1729)

The installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735,     CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service     attack. (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution. Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

This MozillaThunderbird update to version 24.0 fixes several security and non-security issues :

  - update to Thunderbird 24.0 (bnc#840485)

  - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous     memory safety hazards

  - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state     in HTML5 Tree Builder with templates

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey     continues handling key messages after widget is     destroyed

  - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free     with select element

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized     data in IonMonkey

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

  - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC     hazard with default compartments and frame chain     restoration

  - moved greek to common translation package

  - require NSPR 4.10 and NSS 3.15.1

  - add GStreamer build requirements for Gecko

  - added enigmail-build.patch to fix TB packaging     (bmo#886095)

  - removed obsolete patches :

  - enigmail-old-gcc.patch

  - mozilla-gcc43-enums.patch

  - mozilla-gcc43-template_hacks.patch

  - mozilla-gcc43-templates_instantiation.patch

  - ppc-xpcshell.patch

This seamonkey update to version 2.21 fixes several security and non-security issues :

  - update to SeaMonkey 2.21 (bnc#840485)

  - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous     memory safety hazards

  - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state     in HTML5 Tree Builder with templates

  - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow     in ANGLE library

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey     continues handling key messages after widget is     destroyed

  - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free     with select element

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized     data in IonMonkey

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

  - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC     hazard with default compartments and frame chain     restoration

  - requires NSS 3.15.1

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
70036	Fedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)	Nessus	Fedora Local Security Checks	2013/9/21	2021/1/11	critical
75149	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1493-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
69989	Firefox < 24.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/9/19	2026/3/3	critical
69996	SeaMonkey < 2.21 Multiple Vulnerabilities	Nessus	Windows	2013/9/19	2026/5/27	critical
75150	openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2013:1495-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
75151	openSUSE Security Update : seamonkey (openSUSE-SU-2013:1491-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical