Lucene search

K
centosCentOS ProjectCESA-2007:1084
HistoryNov 28, 2007 - 7:08 p.m.

seamonkey security update

2007-11-2819:08:58
CentOS Project
lists.centos.org
41

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.945 High

EPSS

Percentile

99.2%

CentOS Errata and Security Advisory CESA-2007:1084

SeaMonkey is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.

A cross-site scripting flaw was found in the way SeaMonkey handled the
jar: URI scheme. It was possible for a malicious website to leverage this
flaw and conduct a cross-site scripting attack against a user running
SeaMonkey. (CVE-2007-5947)

Several flaws were found in the way SeaMonkey processed certain malformed
web content. A webpage containing malicious content could cause SeaMonkey
to crash, or potentially execute arbitrary code as the user running
SeaMonkey. (CVE-2007-5959)

A race condition existed when Seamonkey set the “window.location” property
for a webpage. This flaw could allow a webpage to set an arbitrary Referer
header, which may lead to a Cross-site Request Forgery (CSRF) attack
against websites that rely only on the Referer header for protection.
(CVE-2007-5960)

Users of SeaMonkey are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-December/076636.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076620.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076621.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076622.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076625.html
https://lists.centos.org/pipermail/centos-announce/2007-November/076634.html

Affected packages:
seamonkey
seamonkey-chat
seamonkey-devel
seamonkey-dom-inspector
seamonkey-js-debugger
seamonkey-mail
seamonkey-nspr
seamonkey-nspr-devel
seamonkey-nss
seamonkey-nss-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:1084

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.945 High

EPSS

Percentile

99.2%