USN-920-1: Firefox 3.0 and Xulrunner vulnerabilities

Martijn Wargers, Josh Soref, Jesse Ruderman, and Ehsan Akhgari discovered flaws in the browser engine of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking...

CentOS 4 : firefox (CESA-2010:0332)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

Code injection

Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

CVE-2010-0179

Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

Mozilla Firefox < 3.0.19 Multiple Vulnerabilities

Binary data 801260.prm...

Firefox < 3.0.19 Multiple Vulnerabilities

The installed version of Firefox is earlier than 3.0.19. Such versions are potentially affected by the following security issues : - Multiple crashes can result in arbitrary code execution. MFSA 2010-16 - A select event handler for XUL tree items can be called after the item is deleted. MFSA...

SeaMonkey < 2.0.3 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.0.3. Such versions are potentially affected by the following security issues : - Multiple crashes can result in arbitrary code execution. MFSA 2010-01 - The implementation of 'Web Workers' contained an error in its handling of array data types...

Mozilla Apologizes for Blaming Malware on Developers

Mozilla acknowledged that it had falsely accused a developer of infecting a Firefox add-on with attack code. The admission came a week after Mozilla announced that a pair of add-ons, Sothink Web Video Downloader 4.0 and Master Filer, had slipped through its security check-in. Read the full articl...

WD-CMS 3.0 XSS / File Disclosure

Exploit Title: WD-CMS 3.0 Multiple Vulnerabilities Date: December 31st, 2009 Author: Sora Software Link: http://www.webdiamond.net/cms.html Version: 3.0 Tested on: Windows Vista and Linux Backtrack 3 --------------------------------------------------------------- WD-CMS 3.0 Multiple Vulnerabiliti...

WD-CMS 3.0 - Multiple Vulnerabilities

WD-CMS 3.0 - Multiple Vulnerabilities Exploit Title: WD-CMS 3.0 Multiple Vulnerabilities Date: December 31st, 2009 Author: Sora Software Link: http://www.webdiamond.net/cms.html Version: 3.0 Tested on: Windows Vista and Linux Backtrack 3...

WD-CMS 3.0 Multiple Vulnerabilities

Exploit for unknown platform in category web applications =================================== WD-CMS 3.0 Multiple Vulnerabilities =================================== Exploit Title: WD-CMS 3.0 Multiple Vulnerabilities Date: December 31st, 2009 Author: Sora Software Link:...

Mozilla Temporarily Blocklists MS Firefox Add-On

Mozilla temporarily added the dangerous Microsoft .NET Framework Assistant add-on to its blacklist over the weekend, a move that effectively disabled the dangerous extension and plug-in for all Firefox users. However, after some clarifications from Redmond, the add-on was unblocked. The move came...

Microsoft .NET Plug-In Exposes Firefox Users to Malware Attacks

Remember that Microsoft .NET Framework Assistant add-on that Microsoft sneaked into Firefox without explicit permission from end users? Well, the code in that add-on has a serious code execution vulnerability that exposes Firefox users to the “browse and you’re owned” attacks that are typically...

Firefox Add-on Spies on Google Search Results

Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results. The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monit...

Firefox 3.5.x < 3.5.2 Multiple Vulnerabilities

The installed version of Firefox 3.5 is earlier than 3.5.2. Such versions are potentially affected by the following security issues : - A SOCKS5 proxy that replies with a hostname containing more than 15 characters can corrupt the subsequent data stream. This can lead to a denial of service, thou...

Foxit Reader JPEG2000头解码内存破坏漏洞

Bugraq ID: 35443 CVE-2009-0691 CNCVE-20090691 Foxit Reader是一款设计用于PDF文件的应用程序。 Foxit Reader处理JPX JPEG2000流存在问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 Foxit Reader默认不能解码JPEG2000数据，安装了JPEG2000 / JBIG Decoder add-on的Foxit Reader受此漏洞影响。通过诱使用户打开恶意DPF文件，攻击者可执行任意代码或使PDF查看器崩溃。 Foxit Foxit Reader 3.0.2009 1301 Foxit Fox...

Foxit Reader JPEG2000 / JBIG Decoder Add-On < 2.0.2009.616 Multiple Vulnerabilities

The Foxit Reader application installed on the remote Windows host includes an optional JPEG2000 / JBIG Decoder add-on that is prior to version 2.0.2009.616. It is, therefore affected by multiple vulnerabilities : - A out-of-bounds read error exists in the add-on due to improper handling of a...

Microsoft sneaks Firefox add-on without user knowledge

A routine security update for a Microsoft Windows component installed on tens of millions of computers has quietly installed an extra add-on for an untold number of users surfing the Web with Mozilla’s Firefox Web browser, according to a report washingtonpost.com by Brian Krebs The Firefox add-on...

Should Microsoft be in the security business?

Gartner security analyst Neil MacDonald thinks there are five levels to the discussion gartner.com about whether Microsoft should be in the security business. They include secure coding obviously, secure functionality in the platform at no cost of course, add-on security products at a fee maybe a...

Microsoft Word 2007 Sensitive Information Disclosure Vulnerability

Microsoft Word is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...