Java RE allows Same Origin Policy to be Bypassed (6687932)

Multiple unspecified vulnerabilities in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.218, and SDK and JRE 1.3.x before 1.3.123 allow remote attackers to violate the security model for an applet's outbound...

openSUSE 10 Security Update : seamonkey (seamonkey-5815)

This update brings the Mozilla SeaMonkey browser to version 1.1.13. It fixes following security issues : CVE-2008-0017 / MFSA 2008-54 : The http-index-format MIME type parser nsDirIndexParser in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check...

Debian DSA-1671-1 : iceweasel - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0017 Justin Schuh discovered that a buffer overflow in the http-index-forma...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5812)

This update brings the Mozilla Firefox browser to version 2.0.0.18. It fixes following security issues : CVE-2008-0017 / MFSA 2008-54 : The http-index-format MIME type parser nsDirIndexParser in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check...

[SECURITY] [DSA 1671-1] New iceweasel packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1671-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2008 http://www.debian.org/security/faq -...

Debian DSA-1669-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser...

DSA-1671-1 iceweasel - several vulnerabilities

Bulletin has no description...

DSA-1669-1 xulrunner - several vulnerabilities

Bulletin has no description...

nsXMLHttpRequest:: NotifyEventListeners() same-origin violation

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass t...

Mozilla Image stealing via canvas and HTTP redirect

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are no...

Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities

Binary data 4762.prm...

Mozilla Thunderbird < 2.0.0.18 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 2.0.0.18. Such versions are potentially affected by the following security issues : - The canvas element can be used in conjunction with an HTTP redirect to bypass same-origin restrictions and gain access to the content in arbitrary images from...

USN-667-1: Firefox and xulrunner vulnerabilities

Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved .url shortcut files. If a user were tricked into downloading a crafted .url file and a crafted HTML file, an attacker could steal information from the user's cache. CVE-2008-4582 Georgi Guninski, Michal...

Mozilla Firefox Internet快捷方式破坏同源策略漏洞

BUGTRAQ ID: 31611,31747 CVECAN ID: CVE-2008-4582 Firefox是非常流行的开源WEB浏览器。 Firefox在通过HTML单元启动URL快捷方式的时候没有正确地实施同源策略，如果在本地路径或Windows共享（UNC/SMB）路径中打开了网页的话，就可能读取任何位置的内容，包括缓存信息、Cookie、本地文件系统等。 Mozilla Firefox 3.0.3 Mozilla Firefox 3.0.2 Mozilla ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Mozilla Foundation Security Advisory 2008-48

Mozilla Foundation Security Advisory 2008-48 Title: Image stealing via canvas and HTTP redirect Impact: High Announced: November 12, 2008 Reporter: Georgi Guninski, Michal Zalewski, Chris Evans Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.18 Thunderbird 2.0.0.18 SeaMonkey...

Mozilla Foundation Security Advisory 2008-53

Mozilla Foundation Security Advisory 2008-53 Title: XSS and JavaScript privilege escalation via session restore Impact: Critical Announced: November 12, 2008 Reporter: David Bloom, mozbugra4 Products: Firefox Fixed in: Firefox 3.0.4 Firefox 2.0.0.18 Description Security researcher David Bloom...

CVE-2008-5019

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting XSS attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors...

CVE-2008-5022

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass t...

CVE-2008-5012

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are no...

Cross site scripting

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting XSS attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors...