Mozilla Foundation Security Advisory 2007-06

Mozilla Foundation Security Advisory 2007-06 Title: Mozilla Network Security Services NSS SSLv2 buffer overflows Impact: Critical Firefox 2.0 not affected in default configuration Announced: February 23, 2007 Reporter: iDefense Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.2...

Mozilla Foundation Security Advisory 2007-05

Mozilla Foundation Security Advisory 2007-05 Title: XSS and local file access by opening blocked popups Impact: Moderate Announced: February 23, 2007 Reporter: shutdown, Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10 SeaMonkey 1.0.8 Description shutdown...

Mozilla Foundation Security Advisory 2007-07

Mozilla Foundation Security Advisory 2007-07 Title: Embedded nulls in location.hostname confuse same-domain checks Impact: High Announced: February 23, 2007 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10 SeaMonkey 1.0.8 Description Michal Zalewsk...

Unfixed XSS vulnerability at www.ellisonfoundation.org

Security researcher RubberDuck, has submitted on 23/02/2007 a cross-site-scripting XSS vulnerability affecting www.ellisonfoundation.org, which at the time of submission ranked 4073525 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 27/02/2007...

mozilla -- multiple vulnerabilities

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. MFSA 2007-08 onUnload + document.write memory corruption MFSA 2007-07 Embedded...

MOAB-22-01-2007: Apple UserNotificationCenter Privilege Escalation Vulnerability

Summary The following description about CFUserNotification is available from Apple's Mac OS X Core Foundation reference: A CFUserNotification object presents a simple dialog on the screen and optionally receives feedback from the user. The contents of the dialog can include a header, a message, a...

Texinfo File Handling Buffer Overflow Vulnerability

Texinfo is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Exploiting this issue allows attackers to cause the affected applications using Texinfo to crash, denying...

[SECURITY] Fedora Extras Update: mediawiki-1.8.3-7 [FE 5 6 devel]

MediaWiki is the software used for Wikipedia http://www.wikipedia.org and the other Wikimedia Foundation websites. Compared to other wikis, it has a wide range of features and support for high-traffic websites using multiple servers...

CVE-2006-6719

The ftpsyst function in ftp-basic.c in Free Software Foundation FSF GNU wget 1.10.2 allows remote attackers to cause a denial of service application crash via a malicious FTP server with a large number of blank 220 responses to the SYST command...

CVE-2006-6719

The ftpsyst function in ftp-basic.c in Free Software Foundation FSF GNU wget 1.10.2 allows remote attackers to cause a denial of service application crash via a malicious FTP server with a large number of blank 220 responses to the SYST command...

Mozilla Foundation Security Advisory 2006-74

Mozilla Foundation Security Advisory 2006-74 Title: Mail header processing heap overflows Impact: Critical Announced: December 19, 2006 Reporter: Georgi Guninski, David Bienvenu Products: Thunderbird, SeaMonkey Fixed in: Thunderbird 1.5.0.9 SeaMonkey 1.0.7 Description Georgi Guninski reported tha...

Mozilla Foundation Security Advisory 2006-69

Mozilla Foundation Security Advisory 2006-69 Title: CSS cursor image buffer overflow Windows only Impact: Critical Announced: December 19, 2006 Reporter: Frederik Reiss Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.1 Firefox 1.5.0.9 Thunderbird 1.5.0.9 SeaMonkey 1.0.7...

Mozilla Foundation Security Advisory 2006-68

Mozilla Foundation Security Advisory 2006-68 Title: Crashes with evidence of memory corruption rv:1.8.0.9/1.8.1.1 Impact: Critical Announced: December 19, 2006 Reporter: Mozilla Developers Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.1 Firefox 1.5.0.9 Thunderbird 1.5.0.9...

Mozilla Foundation Security Advisory 2006-75

Mozilla Foundation Security Advisory 2006-75 Title: RSS Feed-preview referrer leak Impact: Low Announced: December 19, 2006 Reporter: Jared Breland Products: Firefox 2.0 Fixed in: Firefox 2.0.0.1 Description Jared Breland reported on LEGROOM.net that when the new "Feed Preview" feature in Firefox...

Mozilla Foundation Security Advisory 2006-70

Mozilla Foundation Security Advisory 2006-70 Title: Privilege escallation using watch point Impact: Critical Announced: December 19, 2006 Reporter: shutdown Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.1 Firefox 1.5.0.9 Thunderbird 1.5.0.9 SeaMonkey 1.0.7 Description Shutdown...

CVE-2006-6105

Format string vulnerability in the host chooser window gdmchooser in GNOME Foundation Display Manager gdm allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog...

CVE-2006-6105

The CVE-2006-6105 issue affects the GNOME Display Manager (gdm), specifically the host chooser window (gdmchooser). The vulnerability arises from format string handling in a hostname used in an error dialog, allowing a local attacker to execute arbitrary code via crafted input. Reports across mul...

Apache Struts Error Response Cross-Site Scripting Vulnerability

Struts is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the...

Mozilla products vulnerable to memory corruption

Overview A vulnerability exists in the way Mozilla products process JavaScript. This vulnerability may allow an attacker to execute arbitrary code. Description The Mozilla Foundation supports several Open Source projects, including the Mozilla, Seamonkey, and Firefox web browsers. The Thunderbird...

Python repr()函数远程指令执行漏洞

Python是一种开放源代码的强大功能的脚本编程语言。 Python的repr函数实现上存在漏洞，远程或本地攻击者可能利用此漏洞提升自己的权限。 Python的repr函数没有正确地处理UTF-32/UCS-4字符串。如果应用程序对任意不可信任的数据使用了repr的话，就可能导致以python应用程序的权限执行任意指令。 Python Software Foundation Python 2.4 Python Software Foundation Python 2.3 Ubuntu Linux 6.06 LTS Ubuntu Linux 5.10 Ubuntu Linux 5.04...