Mozilla SeaMonkey 2.0.x < 2.0.11 Multiple Vulnerabilities

Binary data 801283.prm...

Firefox < 3.5.16 Multiple Vulnerabilities

The installed version of Firefox is earlier than 3.5.16. Such versions are potentially affected by multiple vulnerabilities : - Multiple memory corruption issues could lead to arbitrary code execution. MFSA 2010-74 - On the Windows platform, when 'document.write' is called with a very long string...

Mozilla Firefox < 3.5.16 Multiple Vulnerabilities

Binary data 5728.prm...

Mozilla Foundation Security Advisory 2010-83

Mozilla Foundation Security Advisory 2010-83 Title: Location bar SSL spoofing using network error page Impact: High Announced: December 9, 2010 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description Google security researcher...

SeaMonkey 2.0.x < 2.0.11 Multiple Vulnerabilities

Binary data 5731.prm...

Firefox 3.6 < 3.6.13 Multiple Vulnerabilities

The installed version of Firefox 3.6 is earlier than 3.6.13. Such versions are potentially affected by multiple vulnerabilities : - Multiple memory corruption issues could lead to arbitrary code execution. MFSA 2010-74 - On the Windows platform, when 'document.write' is called with a very long...

SeaMonkey < 2.0.11 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.0.11. Such versions are potentially affected by multiple vulnerabilities : - Multiple memory corruption issues could lead to arbitrary code execution. MFSA 2010-74 - On the Windows platform, when 'document.write' is called with a very long...

Location bar SSL spoofing using network error page — Mozilla

Google security researcher Michal Zalewski reported that when a window was opened to a site resulting in a network or certificate error page, the opening site could access the document inside the opened window and inject arbitrary content. An attacker could use this bug to spoof the location bar...

Mozilla Firefox 3.6.x < 3.6.13 Multiple Vulnerabilities

Binary data 5727.prm...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2010-74 Miscellaneous memory safety hazards rv:1.9.2.13/ 1.9.1.16 MFSA 2010-75 Buffer overflow while line breaking after document.write with long string MFSA 2010-76 Chrome privilege escalation with window.open and isindex element MFSA 2010-77 Crash and remote co...

Mozilla Firefox 3.6.x < 3.6.13 Multiple Vulnerabilities

Binary data 801273.prm...

CVE-2010-3170

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL serve...

SuSE 10 Security Update : neon (ZYPP Patch Number 6549)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

Mozilla SSL spoofing with history.back() and history.forward()

The nsDocShell::OnRedirectStateChange function in docshell/base/nsDocShell.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to spoof the SSL security status of a document via vectors involving multiple requests, a redirect, and...

CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

CVE-2010-1192

libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

Design/Logic Flaw

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content aka 204 status code and an empty...

CVE-2009-3984

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content aka 204 status code and an empty...

CVE-2009-3984

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content aka 204 status code and an empty...

Shibboleth Service Provider NULL Character Spoofing Vulnerability - Windows

Shibboleth Service Provider is prone to a NULL character spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...