CVE-2008-2801

CVE-2008-2801 affects Mozilla Firefox (pre-2.0.0.15) and SeaMonkey (pre-1.1.10) due to a flaw in JAR signing implementation that allows remote attackers to run arbitrary code via JavaScript in a JAR or via a JAR archive using relative URLs to JavaScript files. The underlying issue is improper han...

CVE-2008-2801: Improper Authentication

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via 1 injection of JavaScript into documents within a JAR archive or 2 a JAR archive that uses relative URLs to JavaScript files...

CVE-2008-2801

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via 1 injection of JavaScript into documents within a JAR archive or 2 a JAR archive that uses relative URLs to JavaScript files...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple memory corruptions, code execution, certificate spoofing, .jar files signature spoofing, etc...

Mozilla Foundation Security Advisory 2008-23

Mozilla Foundation Security Advisory 2008-23 Title: Signed JAR tampering Impact: High Announced: July 1, 2008 Reporter: Collin Jackson, Adam Barth Products: Firefox, SeaMonkey Fixed in: Firefox 3.0 Firefox 2.0.0.15 SeaMonkey 1.1.10 Description Security researchers Collin Jackson and Adam Barth...

Firefox arbitrary signed JAR code execution

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via 1 injection of JavaScript into documents within a JAR archive or 2 a JAR archive that uses relative URLs to JavaScript files...

Firefox arbitrary signed JAR code execution

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via 1 injection of JavaScript into documents within a JAR archive or 2 a JAR archive that uses relative URLs to JavaScript files...

Java Web Start vulnerable to execution of unauthorized system classes

Overview Java Web Start, included in the JRE Java Runtime Environment from Sun Microsystems and other products, contains a vulnerability allowing unauthorized execution of system classes. Java Web Start, included in the JRE Java Runtime Environment and other products, is a tool for distributing...

Buffer overflow

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

IBM DB2数据库JAR文件处理多个拒绝服务漏洞

BUGTRAQ ID: 28835 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 DB2的RECOVERJAR和REMOVEJAR过程处理畸形参数数据时存在漏洞，如果用特殊参数调用了RECOVERJAR和REMOVEJAR过程的话，就可能导致DB2例程崩溃。 任何DB2数据库用户都可以利用这个漏洞，因为默认为这两个过程分配了PUBLIC权限。 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database...

IBM DB2 database server multiple security vulnerabilities

Privilege escalation with administration utility, db2dasStartStopFMDaemon buffer overflow. JAR files DoS. Code execution with ADMINSPC/ADMINSPC2. Arbitrary files overwrite with SYSPROC.NNSTAT...

Team SHATTER Security Advisory: Multiple DoS in JAR files manipulation procedures

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Multiple DoS in JAR files manipulation procedures April 17th 2008 Risk Level: High Affected versions: All versions of IBM DB2 Database Server on Windows platform. Remote exploitable: Yes Authentication to Database Server...

[SECURITY] [DSA 1535-1] New iceweasel packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1535-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 30, 2008 http://www.debian.org/security/faq -...

CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

Design/Logic Flaw

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

CVE-2008-1240: Undefined Security Weakness

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

[SECURITY] [DSA 1532-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1532-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 27, 2008 http://www.debian.org/security/faq -...

Mozilla Firefox < 2.0.0.13 Multiple Vulnerabilities

Binary data 4447.prm...

SeaMonkey < 1.1.9 Multiple Vulnerabilities

The installed version of SeaMonkey is affected by various security issues : - A series of vulnerabilities that allow for JavaScript privilege escalation and arbitrary code execution. - Several stability bugs leading to crashes which, in some cases, show traces of memory corruption. - An HTTP...