jar: scheme ignores the content-disposition: header on the inner URI

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly other attacks via an uploaded .jar file with a...

Mozilla Firefox Multiple Vulnerability Jun-09 (Windows)

The host is installed with Firefox Browser, which is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbfirefoxmultvulnjun09win.nasl 4865 2016-12-28 16:16:43Z teissa $ Mozilla Firefox Multiple Vulnerabilities Jun-09 Windows Authors: Antu Sanadi Copyright: Copyright c 2009...

firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...

Firefox 2 and 3 - Layout engine crashes

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via vectors related to nsCSSStyleSheet::GetOwnerNode, events, and garbage collection, which...

Debian: Security Advisory (DSA-1707-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-1707-1 : iceweasel - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-5500 Jesse Ruderman discovered that the layout engine is vulnerable to DoS...

Firefox Browser designMode Null Pointer Dereference DoS Vulnerability - Win

The host is installed with Mozilla Firefox browser and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbfirefoxnullptrdosvulnwin.nasl 4865 2016-12-28 16:16:43Z teissa $ Firefox Browser designMode Null Pointer Dereference DoS Vulnerability - Win Authors: Chandan S...

Debian: Security Advisory (DSA-1614-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-1614-1 : iceweasel - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-2785 It was discovered that missing boundary checks on a reference counter...

Debian Security Advisory DSA 1535-1 (iceweasel)

The remote host is missing an update to iceweasel announced via advisory DSA 1535-1. OpenVAS Vulnerability Test $Id: deb15351.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1535-1 iceweasel Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian: Security Advisory (DSA-1396-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2007-5459

CVE-2007-5459 concerns MouseoverDictionary (Firefox extension) prior to version 0.6.2. The cited sources indicate a cross-site scripting (XSS) vulnerability in the sidebar HTML page, allowing remote scripts to be executed in the user's browser via unspecified vectors. The vulnerability affects th...

Firefox < 1.5.0.4 Multiple Vulnerabilities

The installed version of Firefox is affected by various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges. C Tenable Network Security, Inc. if NASLLEVEL 3004 exit0; include"compat.inc"; if description scriptid21627;...

SUSE-SA:2006:021: MozillaFirefox,mozilla

The remote host is missing the patch for the advisory SUSE-SA:2006:021 MozillaFirefox,mozilla. A number of security issues have been fixed in the Mozilla browser suite and the Mozilla Firefox browser. These problems could be used by remote attackers to gain privileges, gain access to confidential...

firefox-1.5.txt

-- heh function ex var buffer = ""; for var i = 0; i ZIPLOCK says CLICK ME...

Firescrolling 2 [Firefox 1.0.1&#41;

Summary Even though Firefox 1.0.1 patched one of the key bugs behind my firescrolling exploit the ability of plugins to load chrome files in a hidden frame the ability to hijack a drag and drop operation and open a privileged xul file is still available. The demo opens...

security flaw

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolli...

security flaw

Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such a...

Mozilla and Firefox browsers buffer overflow

Heap based buffer overflow in text processing functions...

US-CERT Technical Cyber Security Alert TA04-261A -- Multiple vulnerabilities in Mozilla products

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA04-261A Multiple vulnerabilities in Mozilla products Original release date: September 17, 2004 Last revised: -- Source: US-CERT Systems Affected Mozilla software, including the following: Mozilla web browser, email and...