CVE-2012-0445

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute...

SeaMonkey < 2.7.0 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.7.0. Such versions are potentially affected by the following security issues : - A use-after-free error exists related to removed nsDOMAttribute child nodes.CVE-2011-3659 - Various memory safety issues exist. CVE-2012-0442, CVE-2012-0443 - Memo...

Firefox < 10.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox 9.x is potentially affected by the following security issues : - A use-after-free error exists related to removed nsDOMAttribute child nodes.CVE-2011-3659 - Various memory safety issues exist. CVE-2012-0442, CVE-2012-0443 - Memory corruption errors exist related t...

&lt;iframe&gt; element exposed across domains via name attribute — Mozilla

Vitaly Nevgen reported that an attacker could replace a sub-frame in another domain's document by using the name attribute of the sub-frame as a form submission target. This can potentially allow for phishing attacks against users and violates the HTML5 frame navigation policy...

Fedora 15 : firefox-9.0.1-1.fc15 / gnome-python2-extras-2.25.3-35.fc15.4 / nspr-4.8.9-2.fc15 / etc (2011-17399)

The latest version of Firefox and Thunderbird have the following changes : - Added Type Inference, significantly improving JavaScript performance - Added support for querying Do Not Track status via JavaScript - Added support for font-stretch - Improved support for text-overflow - Improved...

Mozilla Fixes Firefox 9 Crash Issue With Update

Mozilla followed up its Firefox 9 release earlier this week with an update aimed at swatting a bug causing browsers to crash. The fix was issued Wednesday with Firefox 9.0.1, and addresses the issue for users across Mac, Windows and Linux, though Mac users were reportedly affected the most. The...

Fedora 16 : firefox-9.0-3.fc16 / nss-3.13.1-9.fc16 / nss-softokn-3.13.1-14.fc16 / etc (2011-17400)

The latest version of Firefox and Thunderbird have the following changes : - Added Type Inference, significantly improving JavaScript performance - Added support for querying Do Not Track status via JavaScript - Added support for font-stretch - Improved support for text-overflow - Improved...

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

[pdf] Attacking with HTML5

Attacking with HTML5 December 16, 2010 Presentation White paper...

Apple Safari Directory Traversal

CVE: CVE-2011-3229 Found by: Aaron Sigel of vtty.com Summary: Safari is vulnerable to a directory traversal issue with the handling of "safari-extension://" URLs. Attackers can create malicious websites that trigger Safari to send files from the victim's system to the attacker. Arbitrary Javascri...

GateOne Beta - Terminal emulator for HTML5 web browsers

GateOne Beta - Terminal emulator for HTML5 web browsers The software makes use of WebSockets to connect a server backend written in Python and a frontend written for modern browsers in JavaScript, HTML5 and CSS. The frontend doesn't require any browser plug-ins to be installed.Gate One also...

Evercookie Creator: FTC Cookie Inquiry Would Be Too Narrow

Samy Kamkar has always been prescient. He first gained notoriety by showing how nascent social networks like MySpace could be used to spread malware rapidly among a population of millions now billions of users. His worm for MySpace, dubbed the ‘Samy Worm’ earned him a visit from law enforcement...

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Apple Safari Update Fixes 58 Bugs, Adds Sandboxing

Along with the release of their new Lion OS X, Apple has issued a new version of its Safari browser for Mac and Windows users, pushing version 5.1 and 5.0.6 to patch a boatload of security holes, some of which are critical. Fifty-eight security vulnerabilities in total are addressed in the update...

PT-2011-16: Denial Of Service in Mozilla Firefox

Positive Research Center has discovered a Denial of Service vulnerability in Mozilla Firefox. Due to insufficient checks of input parameters of HTML5 Canvas' Arc method, Mozilla Firefox allows a remote attacker to cause a denial of service infinite loop. Example of HTML code triggering the...

Fedora 13 : python-feedparser-5.0.1-1.fc13 (2011-4911)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...

Fedora 14 : python-feedparser-5.0.1-1.fc14 (2011-4894)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...

HTML5 Implementation in Chrome, Opera, and Safari Could Allow Information Disclosure

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Google Chrome browser versions 8.0.552.210 and earlier; Opera browser versions 10.62 and earlier; and Safari browser versions 4.1.2 and earlier, Safari browser versions 5.0.2 and...

Fedora 15 : python-feedparser-5.0.1-1.fc15 (2011-4988)

Current release: 5.0.1 - February 20, 2011 - Fix issue 91 invalid text in XML declaration causes sanitizer to crash - Fix issue 254 sanitization can be bypassed by malformed XML comments - Fix issue 255 sanitizer doesn't strip unsafe URI schemes Previous release: 5.0 - January 25, 2011 - Improved...