This update fixes the following security issues with SeaMonkey :

  - update to SeaMonkey 2.23 (bnc#854370))

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - rebased patches :

  - mozilla-nongnome-proxies.patch

  - mozilla-shared-nss-db.patch

Update to Firefox 26.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph Diehl discovered multiple memory safety issues in Firefox.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5609, CVE-2013-5610)

Myk Melez discovered that the doorhanger notification for web app installation could persist between page navigations. An attacker could potentially exploit this to conduct clickjacking attacks.
(CVE-2013-5611)

Masato Kinugawa discovered that pages with missing character set encoding information can inherit character encodings across navigations from another domain. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2013-5612)

Daniel Veditz discovered that a sandboxed iframe could use an object element to bypass its own restrictions. (CVE-2013-5614)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in event listeners. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5618)

Dan Gohman discovered that binary search algorithms in Spidermonkey used arithmetic prone to overflow in several places. However, this is issue not believed to be exploitable. (CVE-2013-5619)

Tyson Smith and Jesse Schwartzentruber discovered a crash when inserting an ordered list in to a document using script. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-6671)

Vincent Lefevre discovered that web content could access clipboard data under certain circumstances, resulting in information disclosure.
(CVE-2013-6672)

Sijie Xia discovered that trust settings for built-in EV root certificates were ignored under certain circumstances, removing the ability for a user to manually untrust certificates from specific authorities. (CVE-2013-6673)

Tyson Smith, Jesse Schwartzentruber and Atte Kettunen discovered a use-after-free in functions for synthetic mouse movement handling. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5613)

Eric Faust discovered that GetElementIC typed array stubs can be generated outside observed typesets. An attacker could possibly exploit this to cause undefined behaviour with a potential security impact. (CVE-2013-5615)

Michal Zalewski discovered several issues with JPEG image handling. An attacker could potentially exploit these to obtain sensitive information. (CVE-2013-6629, CVE-2013-6630).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - An issue exists where the notification for a Web App     installation could persist from one website to another     website. This could be used by a malicious website to     trick a user into installing an application from one     website while making it appear to come from another     website. (CVE-2013-5611)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

- update to Firefox 26.0 (bnc#854367, bnc#854370)

  - rebased patches

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - removed gecko.js preference file as GStreamer is enabled     by default now

Mozilla Firefox has been updated to the 24.2.0 ESR security release.

This is a major upgrade from the 17 ESR release branch.

Security issues fixed :

  - Application Installation doorhanger persists on     navigation. (MFSA 2013-105). (CVE-2013-5611)

  - Miscellaneous memory safety hazards (rv:24.2). (MFSA     2013-104). (CVE-2013-5609)

  - Miscellaneous memory safety hazards (rv:26.0). (MFSA     2013-104). (CVE-2013-5610)

  - Character encoding cross-origin XSS attack. (MFSA     2013-106). (CVE-2013-5612)

  - Sandbox restrictions not applied to nested object     elements. (MFSA 2013-107). (CVE-2013-5614)

  - Use-after-free in event listeners. (MFSA 2013-108).
    (CVE-2013-5616)

  - Potential overflow in JavaScript binary search     algorithms. (MFSA 2013-110). (CVE-2013-5619)

  - Segmentation violation when replacing ordered list     elements. (MFSA 2013-111). (CVE-2013-6671)

  - Trust settings for built-in roots ignored during EV     certificate validation. (MFSA 2013-113). (CVE-2013-6673)

  - Use-after-free in synthetic mouse movement. (MFSA     2013-114). (CVE-2013-5613)

  - GetElementIC typed array stubs can be generated outside     observed typesets. (MFSA 2013-115). (CVE-2013-5615)

  - Linux clipboard information disclosure though selection     paste. (MFSA 2013-112). (CVE-2013-6672)

  - Use-after-free during Table Editing (MFSA 2013-109).
    (CVE-2013-5618)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75327	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0008-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
71365	Fedora 19 : firefox-26.0-2.fc19 / xulrunner-26.0-1.fc19 (2013-23127)	Nessus	Fedora Local Security Checks	2013/12/12	2021/1/11	critical
71374	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2052-1)	Nessus	Ubuntu Local Security Checks	2013/12/12	2019/9/19	critical
71505	Fedora 20 : firefox-26.0-3.fc20 / thunderbird-24.2.0-3.fc20 / xulrunner-26.0-2.fc20 (2013-23519)	Nessus	Fedora Local Security Checks	2013/12/18	2021/1/11	critical
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
71347	Firefox < 26.0 Multiple Vulnerabilities	Nessus	Windows	2013/12/11	2019/11/27	critical
75240	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1917-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
75241	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1918-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
71559	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	2013/12/20	2021/1/19	critical
75239	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1916-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical