openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5002)

This update brings Mozilla Firefox to security update version 2.0.0.12 Following security problems were fixed : - MFSA 2008-11/CVE-2008-0594 Web forgery overwrite with div overlay - MFSA 2008-10/CVE-2008-0593 URL token stealing via stylesheet redirect - MFSA 2008-09/CVE-2008-0592 Mishandling of...

openSUSE 10 Security Update : epiphany (epiphany-4870)

This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inne...

openSUSE 10 Security Update : seamonkey (seamonkey-4795)

This update fixed various security problems in Mozilla SeaMonkey. Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the sa...

Upgraded Thunderbird 1.5.0.13 missing fix for MFSA 2007-23 — Mozilla

Mozilla tester Stephen Donner reported that only users who installed Thunderbird 1.5.0.13 using the install package received the fix for MFSA 2007-23. Users who upgraded to Thunderbird 1.5.0.13 from an earlier version using the automatic update mechanism were not protected. If those users browsed...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-4811)

This update brings Mozilla Thunderbird to security update version 2.0.0.9 Following security problems were fixed : - MFSA 2007-29: Crashes with evidence of memory corruption As part of the Firefox 2.0.0.8 update releases Mozilla developers fixed many bugs to improve the stability of the product...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix security issues. Slackware is not vulnerable to either of these in its default configuration, but watch out if you've enabled JavaScript. More information about the security issues may be found here...

Ubuntu 5.04 / 5.10 : mozilla-thunderbird vulnerabilities (USN-297-3)

USN-297-1 fixed several vulnerabilities in Thunderbird for the Ubuntu 6.06 LTS release. This update provides the corresponding fixes for Ubuntu 5.04 and Ubuntu 5.10. For reference, these are the details of the original USN : Jonas Sicking discovered that under some circumstances persisted XUL...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-4574)

This update brings Mozilla Firefox to security update version 2.0.0.8 Following security problems were fixed : - MFSA 2007-26 / CVE-2007-3844: Privilege escalation through chrome-loaded about:blank windows Mozilla researcher mozbugra4 reported that a flaw was introduced by the fix for MFSA 2007-2...

Mozilla products vulnerable to memory corruption in the JavaScript engine

Overview A number of vulnerabilities in the Mozilla JavaScript engine may allow the execution of arbitrary code or denial of service. Description The Mozilla JavaScript engine contains several vulnerabilities that may result in memory corruption. The impact of this memory corruption in specific...

XPCNativeWraper pollution using Script object — Mozilla

Mozilla security researcher mozbugra4 reported that it was possible to use the Script object to modify XPCNativeWrappers in such a way that subsequent access by the browser chrome--such as by right-clicking to open a context menu--can cause attacker-supplied javascript to run with the same...

URIs with invalid %-encoding mishandled by Windows — Mozilla

On Windows XP with Internet Explorer 7 installed several "web related" URI schemes do not launch the registered protocol-handler if the URI contains an invalid %-encoded sequence. This was initially reported by Billy Rios and Nate McFeters with additional investigation by Secunia. A patch that...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-2734)

This update brings Mozilla Thunderbird to version 1.5.0.10. It contains stability fixes and some security fixes : - MFSA 2007-01: As part of the Thunderbird 1.5.0.10 update releases several bugs were fixed to improve the stability of the browser. Some of these were crashes that showed evidence of...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-3545)

This update brings Mozilla Thunderbird to security update version 1.5.0.12. - MFSA 2007-17 / CVE-2007-2871 : Chris Thomas demonstrated that XUL popups opened by web content could be placed outside the boundaries of the content area. This could be used to spoof or hide parts of the browser chrome...

Mozilla FirefoxThunderbirdSeaMonkey - Chrome-Loaded About:Blank Script Execution

Mozilla FirefoxThunderbirdSeaMonkey - Chrome-Loaded About:Blank Script Execution source: https://www.securityfocus.com/bid/25142/info Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a vulnerability that allows JavaScript to execute with unintended privileges. A malicious site may be able...

Frame spoofing using document.open() — Mozilla

shutdown demonstrated a way to inject content into a sub-frame of another site using targetWindow.framesn.document.open, making the attackers content look like it was part of the victim site. Similar in effect to MFSA 2005-51...

[SECURITY] [DSA 1118-1] New Mozilla packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1118-1 [email protected] http://www.debian.org/security/ Martin Schulze July 22nd, 2006 http://www.debian.org/security/faq -...

Privilege escalation using addSelectionListener — Mozilla

Web content could access the nsISelectionPrivate interface of the Selection object and use it to add a SelectionListener. The listener would be called when the user did a "Find" on the page or a "select all", and as intended this shouldn't cause any problems. But as with escaping the PAC sandbox ...

PLUGINSPAGE privileged JavaScript execution II — Mozilla

Paul Nickerson reports that the fix for MFSA 2005-34 can be bypassed using nested javascript: URLs, again allowing the attacker to execute privileged code. The attacker must first convince the user to first click on the missing-plugin icon in the page or the "Install Missing Plugins..." button in...

[SECURITY] [DSA 1051-1] New Mozilla Thunderbird packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1051-1 [email protected] http://www.debian.org/security/ Martin Schulze May 4th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1044-1] New Mozilla Firefox packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1044-1 [email protected] http://www.debian.org/security/ Martin Schulze April 26th, 2006 http://www.debian.org/security/faq -...