CVE-2010-3774

The NSSecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle 1 about:neterror and 2 about:certerror pages, which allows remote attackers to spoof the location bar via a crafted...

CVE-2010-3771

CVE-2010-3771 – Impact and fix (from provided sources) Affected products (per description): Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. Root cause: improper handling of injection of an ISINDEX element into an about:blank page, which can be exploited via vec...

CVE-2010-3768

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation, which allows remote attackers to execute arbitrary code via...

CVE-2010-3770

Multiple cross-site scripting XSS vulnerabilities in the rendering engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allow remote attackers to inject arbitrary web script or HTML via 1 x-mac-arabic, 2 x-mac-farsi, or 3 x-mac-hebrew characters that may b...

CVE-2010-3775

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle certain redirections involving data: URLs and Java LiveConnect scripts, which allows remote attackers to start processes, read arbitrary local files, and establish network connections via...

CVE-2010-3766

Use-after-free vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allows remote attackers to execute arbitrary code via vectors involving a change to an nsDOMAttribute node...

CVE-2010-3772

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly calculate index values for certain child content in a XUL tree, which allows remote attackers to execute arbitrary code via vectors involving a DIV element within a treechildren element...

CVE-2010-3773

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

CVE-2010-3769

CVE-2010-3769 affects Mozilla Firefox (pre-3.5.16 and pre-3.6.13 on Windows), Thunderbird (pre-3.0.11 and pre-3.1.7), and SeaMonkey (pre-2.0.11) due to a flaw in line-breaking when handling very long strings. The root cause is a buffer over-read triggered by a crafted document.write call, enablin...

CVE-2010-3766

CVE-2010-3766 is a use-after-free vulnerability in Mozilla Firefox prior to 3.5.16 and in 3.6.x prior to 3.6.13, and SeaMonkey prior to 2.0.11. The flaw involves modification of an nsDOMAttribute node, which can cause an inconsistent DOM state and enable remote code execution. The affected produc...

CVE-2010-3770

CVE-2010-3770 refers to multiple XSS vulnerabilities in the Mozilla Firefox/SeaMonkey rendering engine. The issue allows remote attackers to inject arbitrary scripts via certain character encodings: x-mac-arabic, x-mac-farsi, or x-mac-hebrew, which may be converted to angle brackets during render...

CVE-2010-3776

CVE-2010-3776 affects Mozilla Firefox before 3.5.16 and Firefox 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11. The issue is described as memory safety/memory corruption in the browser engine, allowing a remote attacker to cause a denial of serv...

CVE-2010-3776

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 allow remote attackers to cause a denial of service memory corruption and application crash or possibl...

CVE-2010-3767

Integer overflow in the NewIdArray function in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allows remote attackers to execute arbitrary code via a JavaScript array with many elements...

seamonkey security update

1.0.9-66.0.1.el48 - Add mozilla-oracle-default-prefs.js and mozilla-oracle-default-bookmarks.html and remove corresponding RedHat ones 1.0.9-66.el4 - Added fixes from 1.9.1.16...

Mozilla Foundation Security Advisory 2010-77

Mozilla Foundation Security Advisory 2010-77 Title: Crash and remote code execution using HTML tags inside a XUL tree Impact: Critical Announced: December 9, 2010 Reporter: wushi Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description Security researcher...

Mozilla Foundation Security Advisory 2010-74

Mozilla Foundation Security Advisory 2010-74 Title: Miscellaneous memory safety hazards rv:1.9.2.13/ 1.9.1.16 Impact: Critical Announced: December 9, 2010 Reporter: Mozilla developers and community Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 Thunderbird 3.1.7...

Mozilla Foundation Security Advisory 2010-79

Mozilla Foundation Security Advisory 2010-79 Title: Java security bypass from LiveConnect loaded via data: URL meta refresh Impact: Critical Announced: December 9, 2010 Reporter: Gregory Fleischer Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description...

Mozilla SeaMonkey 2.0.x < 2.0.11 Multiple Vulnerabilities

Binary data 801283.prm...

Mozilla Foundation Security Advisory 2010-83

Mozilla Foundation Security Advisory 2010-83 Title: Location bar SSL spoofing using network error page Impact: High Announced: December 9, 2010 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description Google security researcher...