Mozilla: evalInSanbox location context incorrectly applied (MFSA 2012-93)

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

Mozilla: evalInSanbox location context incorrectly applied (MFSA 2012-93)

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which...

Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in the way Firefox handled certain add-ons. A web page containing malicious content could cause an add-on to grant itself full browser privileges, which could lead t...

CentOS Update for firefox CESA-2011:1437 centos4 x86_64

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2011:1437 centos4 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Improper filtering of javascript in HTML feed-view — Mozilla

Security researcher Mario Heiderich reported that javascript could be executed in the HTML feed-view using tag within the RSS . This problem is due to tags not being filtered out during parsing and can lead to a potential cross-site scripting XSS attack. The flaw existed in a parser utility class...

USN-1254-1: Thunderbird vulnerabilities

It was discovered that CVE-2011-3004, which addressed possible privilege escalation in addons, also affected Thunderbird 3.1. An attacker could potentially exploit a user who had installed an add-on that used loadSubscript in vulnerable ways. CVE-2011-3647 Yosuke Hasegawa discovered that the...

SuSE 11.1 Security Update : pure-ftpd (SAT Patch Number 5091)

The OES Netware add-ons in pure-ftpd had a security problem and some bugs, which are fixed by this update. A local attacker could overwrite local files when the OES remote server feature of pure-ftpd is enabled due to a directory traversal. CVE-2011-3171 Additionally the following bugs have been...

CentOS Update for firefox CESA-2011:1437 centos4 i386

Check for the Version of firefox OpenVAS Vulnerability Test CentOS Update for firefox CESA-2011:1437 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mozilla: Security problem with loadSubScript on 1.9.2 branch (MFSA 2011-46)

The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain...

Mozilla Foundation Security Advisory 2011-43

Mozilla Foundation Security Advisory 2011-43 Title: loadSubScript unwraps XPCNativeWrapper scope parameter Impact: Critical Announced: September 27, 2011 Reporter: David Rees Products: Firefox, SeaMonkey Fixed in: Firefox 7.0 SeaMonkey 2.4 Description David Rees reported that the JSSubScriptLoade...

loadSubScript unwraps XPCNativeWrapper scope parameter — Mozilla

David Rees reported that the JSSubScriptLoader a feature used by some add-ons was "unwrapping" XPCNativeWrappers when they were used as the scope parameter to loadSubScript. Without the protection of the wrappers the add-on could be vulnerable to privilege escalation attacks from malicious web...

Mozilla Firefox Security Bypass Vulnerability (Jul 2011) - Windows

Mozilla Firefox is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Non-whitelisted site can trigger xpinstall — Mozilla

Mozilla security researcher mozbugra4 reported that it was possible for a non-whitelisted site to trigger an install dialog for add-ons and themes...

Mozilla Firefox > 4.0 and < 5.0 Multiple Vulnerabilities

Binary data 5965.prm...

Firefox 4 Multiple Vulnerabilities

The installed version of Firefox 4 is potentially affected by the following security issues : - Multiple memory safety issues can lead to application crashes and possibly remote code execution. CVE-2011-2374, CVE-2011-2375 - A use-after-free issue when viewing XUL documents with scripts disabled...

Facebook Vulnerability - Beware of A New XSS on Facebook !

Facebook Vulnerability - Beware of A New XSS on Facebook ! Url : https://m.facebook.com/connect/promptfeed.php?display=wap&usermessageprompt=%3Cscript%3Ealert%281 %29%3C/script%3E New Cross-site scripting vulnerability has been detected on Facebook and widely exploited in the mobile API version,...

A Closer Look at the Eleonore Exploit Kit

Today’s attackers care less about the browser you use and more about whether your third-party browser add-ons and plugins are out-of-date and exploitable. Read the full article. KrebsonSecurity...

Mozilla Foundation Security Advisory 2010-24

Mozilla Foundation Security Advisory 2010-24 Title: XMLDocument::load doesn't check nsIContentPolicy Impact: Low Announced: March 30, 2010 Reporter: Wladimir Palant Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.2 Firefox 3.5.9 Thunderbird 3.0.4 SeaMonkey 2.0.4 Description Mozill...

XMLDocument::load() doesn't check nsIContentPolicy — Mozilla

Mozilla community member Wladimir Palant reported that XML documents were failing to call certain security checks when loading new content. This could result in certain resources being loaded that would otherwise violate security policies set by the browser or installed add-ons...

CVE-2010-0168

Technical details for CVE-2010-0168 are not provided in the supplied documents. The materials reference Firefox historical fixes and related advisories but do not describe affected components, root cause, impact, or remediation for this CVE. Monitor for updates.