這是 SeaMonkey 2.26 版的更新：

- MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 其他記憶體安全危險

- MFSA 2014-36/CVE-2014-1522 (bmo#995289) Web Audio 記憶體損毀問題

- MFSA 2014-37/CVE-2014-1523 (bmo#969226) 解碼 JPG 影像時發生超出邊界讀取問題

- MFSA 2014-38/CVE-2014-1524 (bmo#989183) 將非 XBL 物件作為 XBL 使用時發生緩衝區溢位

- MFSA 2014-39/CVE-2014-1525 (bmo#989210) 針對 HTML 視訊，Text Track Manager 發生釋放後使用問題

- MFSA 2014-41/CVE-2014-1528 (bmo#963962) Cairo 有超出邊界寫入問題

- MFSA 2014-42/CVE-2014-1529 (bmo#987003) 透過 Web 通知 API 提升權限

- MFSA 2014-43/CVE-2014-1530 (bmo#895557) 使用歷程記錄導覽時發生跨網站指令碼 (XSS) 問題

- MFSA 2014-44/CVE-2014-1531 (bmo#987140) 調整影像大小時 imgLoader 中發生釋放後使用問題

- MFSA 2014-45/CVE-2014-1492 (bmo#903885) 萬用字元憑證的 IDNA 網域名稱比對不正確 (已由 NSS 3.16 修正)

- MFSA 2014-46/CVE-2014-1532 (bmo#966006) nsHostResolver 中發生釋放後使用問題

- MFSA 2014-47/CVE-2014-1526 (bmo#988106) 除錯程式可使用 JavaScript 繞過 XrayWrapper

- 重定基底修補程式

- 新增 aarch64 移植修補程式

- mozilla-aarch64-bmo-810631.patch

- mozilla-aarch64-bmo-962488.patch

- mozilla-aarch64-bmo-963023.patch

- mozilla-aarch64-bmo-963024.patch

- mozilla-aarch64-bmo-963027.patch

- 需要 NSPR 4.10.3 和 NSS 3.16

- 已新增 mozilla-icu-strncat.patch 來修正構建後檢查

遠端主機受到 GLSA-201504-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

    在 Firefox、Thunderbird 和 SeaMonkey 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    遠端攻擊者可能引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者還可能發動攔截式攻擊、取得敏感資訊、偽造位址列、發動點擊劫持攻擊、繞過安全性限制和保護機制，或造成其他不明影響。
  因應措施：

    目前尚無任何已知的因應措施。

安装的 Firefox 版本低于 29.0 版。
因此，它可能受到多种漏洞的影响：

- 网络安全 (NSS) 库中存在问题，原因是没有正确地为通配符证书处理 IDNA 域前缀。此问题可导致中间人攻击。(CVE-2014-1492)

- 存在内存问题，可导致执行任意代码。（CVE-2014-1518、CVE-2014-1519）

- Web 音频功能中存在越界读取问题，可导致信息泄露。
 (CVE-2014-1522)

- 当解码某些 JPG 图像时，存在越界读取问题，可能导致拒绝服务。(CVE-2014-1523)

- 存在因 XBL 对象验证不当导致的内存损坏问题，可造成任意代码执行。(CVE-2014-1524)

- 在 HTML 视频处理期间，在文本跟踪管理器中存在一个释放后使用内存问题，可导致任意代码执行。(CVE-2014-1525)

- 存在关于调试程序绕过 XrayWrapper 的问题，可导致权限升级。
 (CVE-2014-1526)

- 在 Web 通知 API 中存在安全绕过问题，可导致任意代码执行。
 (CVE-2014-1529)

- 存在跨站脚本问题，可允许攻击者加载地址栏所显示的网站 URL 以外的其他网站。
 (CVE-2014-1530)

- 在调整大小时释放的“imgLoader”对象导致释放后使用问题。此问题可造成执行任意代码。(CVE-2014-1531)

- 在主机解析期间存在一个释放后使用问题，可导致任意代码执行。
 (CVE-2014-1532)

Mozilla 项目报告：

MFSA 2014-34 多项内存安全危害 (rv:29.0 / rv:24.5)

MFSA 2014-35 通过 Mozilla Maintenance Service 安装程序的权限升级

MFSA 2014-36 Web 音频内存损坏问题

MFSA 2014-37 解码 JPG 图像时的越界读取

MFSA 2014-38 使用非 XBL 对象作为 XBL 时的缓冲区溢出

MFSA 2014-39 HTML 视频的文本跟踪管理器中的释放后使用

MFSA 2014-41 Cairo 中的越界写入

MFSA 2014-42 通过 Web 通知 API 的权限升级

MFSA 2014-43 利用历史记录导航的跨站脚本 (XSS)

MFSA 2014-44 调整图像大小时 imgLoader 中的释放后使用

MFSA 2014-45 通配符证书的 IDNA 域名匹配不正确

MFSA 2014-46 nsHostResolve 中的释放后使用

MFSA 2014-47 调试程序可通过 JavaScript 绕过 XrayWrapper

这是到 2.26 版的 SeaMonkey 更新：

- MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 多项内存安全危害

- MFSA 2014-36/CVE-2014-1522 (bmo#995289) Web 音频内存损坏问题

- MFSA 2014-37/CVE-2014-1523 (bmo#969226) 解码 JPG 图像时的越界读取

- MFSA 2014-38/CVE-2014-1524 (bmo#989183) 使用非 XBL 对象作为 XBL 时的缓冲区溢出

- MFSA 2014-39/CVE-2014-1525 (bmo#989210) HTML 视频的文本跟踪管理器中的释放后使用

- MFSA 2014-41/CVE-2014-1528 (bmo#963962) Cairo 中存在越界写入

- MFSA 2014-42/CVE-2014-1529 (bmo#987003) 存在通过 Web 通知 API 的权限升级

- MFSA 2014-43/CVE-2014-1530 (bmo#895557) 利用历史记录导航的跨站脚本 (XSS)

- MFSA 2014-44/CVE-2014-1531 (bmo#987140) 调整图像大小时 imgLoader 中的释放后使用

- MFSA 2014-45/CVE-2014-1492 (bmo#903885) 通配符证书的 IDNA 域名匹配不正确（已通过 NSS 3.16 修复）

- MFSA 2014-46/CVE-2014-1532 (bmo#966006) nsHostResolver 中的释放后使用

- MFSA 2014-47/CVE-2014-1526 (bmo#988106) 调试程序可通过 JavaScript 绕过 XrayWrapper

- 衍合了修补程序

- 添加了 aarch64 移植修补程序

- mozilla-aarch64-bmo-810631.patch

- mozilla-aarch64-bmo-962488.patch

- mozilla-aarch64-bmo-963023.patch

- mozilla-aarch64-bmo-963024.patch

- mozilla-aarch64-bmo-963027.patch

- 需要 NSPR 4.10.3 和 NSS 3.16

- 增加了 mozilla-icu-strncat.patch 以修复构建后检查

远程主机受到 GLSA-201504-01 中所述漏洞的影响（Mozilla 产品：多个漏洞）

    在 Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。
  变通方案：

    目前尚无已知的变通方案。

Versions of Mozilla Firefox ESR prior to 24.5 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Versions of Mozilla Firefox earlier than 29.0 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)
 - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)
 - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)
 - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - Privilege escalation via the Mozilla Maintenance Service Installer, which writes to a globally writeable temporary directory during the update process (Windows only) (CVE-2014-1520)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Versions of SeaMonkey earlier than 2.26 are unpatched against the following vulnerabilities:

  - Use-after-free vulnerabilities in nsHostResolver, imgLoader, and Text Track Manager (for HTML video), which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531, CVE-2014-1525)

  - A potentially exploitable out-of-bounds write in Cairo, a potentially exploitable out-of-bounds read issue with Web Audio, and a non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1528, CVE-2014-1522, CVE-2014-1523)

  - Improper wildcard matching of domains in the Network Security Services (NSS library), which has since been fixed by updating to version 3.16 (CVE-2014-1492)

  - Potential privilege escalation via Xray Wrappers bypass, which can occur if a user used the debugger to interact with a malicious page (CVE-2014-1526)

  - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)

  - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)

  - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)

  - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

Versions of Mozilla Thunderbird prior to 24.5 are unpatched against the following vulnerabilities :

 - Use-after-free vulnerabilities in nsHostResolver and imgLoader, which can crash with a potentially exploitable condition (CVE-2014-1532, CVE-2014-1531)
 - A non-exploitable out-of-bounds read when decoding JPG images (CVE-2014-1523)
 - Privilege escalation for scripts when sites that have been granted notification permissions by a user can bypass security checks on source components for the Web Notification API (CVE-2014-1529)
 - A potentially exploitable buffer overflow when a script uses a non-XBL object as an XBL object (CVE-2014-1524)
 - A cross-site scripting vulnerability using browser navigations through history to load a website with the page's base URI pointing to a different site (CVE-2014-1530)
 - Various memory safety hazards (CVE-2014-1518, CVE-2014-1519)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75352	openSUSE 安全性更新：seamonkey (openSUSE-SU-2014:0629-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
82632	GLSA-201504-01：Mozilla 產品：多個弱點	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
73766	Firefox < 29.0 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/4/29	2019/11/26	critical
73779	FreeBSD：mozilla -- 多种漏洞 (985d4d6c-cfbd-11e3-a003-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	2014/4/30	2021/1/6	critical
75352	openSUSE 安全更新：seamonkey (openSUSE-SU-2014:0629-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
82632	GLSA-201504-01 ：Mozilla 产品：多个漏洞	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
701244	Mozilla Firefox ESR < 24.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2019/11/6	2019/11/6	high
8213	Mozilla Firefox < 29.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/5/5	2019/11/6	high
8214	SeaMonkey < 2.26 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/5/5	2019/3/6	high
8215	Mozilla Thunderbird < 24.5 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2014/5/5	2019/3/6	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

high

high

high