USN-431-1: Thunderbird vulnerabilities

The SSLv2 protocol support in the NSS library did not sufficiently check the validity of public keys presented with a SSL certificate. A malicious SSL web site using SSLv2 could potentially exploit this to execute arbitrary code with the user's privileges. CVE-2007-0008 The SSLv2 protocol support...

Mozilla Network Security Services (NSS) fails to properly process malformed SSLv2 server messages

Overview A vulnerability in the way Mozilla Network Security Services NSS handles malformed SSLv2 server messages may lead to execution of arbitrary code. Description The SSLv2 protocol uses a client master key to generate all subsequent session keys. The client master key is created using a publ...

Mozilla Network Security Services (NSS) fails to properly handle the client master key

Overview A vulnerability in the way Mozilla Network Security Services NSS handles the client master key may lead to execution of arbitrary code. Description The SSLv2 protocol uses a client master key to generate all subsequent session keys. The validity of the client master key is determined...

CentOS 4 : thunderbird (CESA-2007:0078)

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 06 March 2007 Updated text description to add CVE-2007-1282 and remove...

Critical: Red Hat Security Advisory: thunderbird security update

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 06 March 2007 Updated text description to add CVE-2007-1282 and remove...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:050-1)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.10. This update provides the latest Firefox to correct these issues. Update : A regression was found in the latest Firefox packages provided where changes to library paths...

USN-428-1: Firefox vulnerabilities

Several flaws have been found that could be used to perform Cross-site scripting attacks. A malicious web site could exploit these to modify the contents or steal confidential data such as passwords from other opened web pages. CVE-2006-6077, CVE-2007-0780, CVE-2007-0800, CVE-2007-0981,...

Mozilla Foundation Security Advisory 2007-06

Mozilla Foundation Security Advisory 2007-06 Title: Mozilla Network Security Services NSS SSLv2 buffer overflows Impact: Critical Firefox 2.0 not affected in default configuration Announced: February 23, 2007 Reporter: iDefense Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.2...

Fedora Core 5 : nspr-4.6.5-0.5.0.fc5 / nss-3.11.5-0.5.0.fc5 (2007-278)

This update fixes two security vulnerabilities with SSL 2 CVE-2007-0008, CVE-2007-0009. All users of NSS, which includes users of Firefox, Thunderbird, SeaMonkey, and other mozilla.org products, are recommended to update to this package. Note that Tenable Network Security has extracted the...

Fedora Core 6 : nspr-4.6.5-0.6.0.fc6 / nss-3.11.5-0.6.0.fc6 (2007-279)

This update fixes two security vulnerabilities with SSL 2 CVE-2007-0008, CVE-2007-0009. All users of NSS, which includes users of Firefox, Thunderbird, SeaMonkey, and other mozilla.org products, are recommended to update to this package. Note that Tenable Network Security has extracted the...

[SECURITY] Fedora Core 6 Update: nss-3.11.5-0.6.0.fc6

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

[SECURITY] Fedora Core 5 Update: nss-3.11.5-0.5.0.fc5

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Heap overflow

Integer underflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to...

Stack overflow

Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote...

CVE-2007-0009

Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote...

CVE-2007-0008

Integer underflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to...

CVE-2007-0009

Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote...

CVE-2007-0009

CVE-2007-0009 describes a stack-based buffer overflow in the SSLv2 handling of the Mozilla Network Security Services (NSS) library, caused by improper handling of the Client Master Key length values. This can enable remote attackers to execute arbitrary code in the context of the affected process...

CVE-2007-0008

CVE-2007-0008 is an NSS heap-based overflow caused by an integer underflow when processing an SSLv2 server message with a key too short to encrypt the Master Secret. It affects SeaMonkey, Firefox, and Thunderbird around NSS usage and was addressed by updating to fixed NSS-containing packages (e.g...

CentOS 3 / 4 : seamonkey (CESA-2007:0077)

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 26 February 2007 Packages for Red Hat Enterprise Linux 4 have been...