Mozilla Firefox, Thunderbird, Seamonkey multiple securityvulnerabilities

Code execution, memory corruption, content spoofing, crossite scripting, DoS...

Mozilla Foundation Security Advisory 2007-18

Mozilla Foundation Security Advisory 2007-18 Title: Crashes with evidence of memory corruption Impact: Critical Announced: July 17, 2007 Reporter: Mozilla developers and community Products: Firefox, Thunderbird and Seamonkey Fixed in: Firefox 2.0.0.5, Thunderbird 2.0.0.5 Description As part of th...

mozilla -- multiple vulnerabilities

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. MFSA 2007-25 XPCNativeWrapper pollution MFSA 2007-24 Unauthorized access to...

Design/Logic Flaw

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

CVE-2007-3511

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

CVE-2007-3511

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated ...

CVE-2007-3511

CVE-2007-3511 is a file input focus stealing vulnerability present in SeaMonkey (and related Mozilla suites) up to versions affected by the 2007 advisories (e.g., SeaMonkey before 1.1.5). The root cause involves focus handling for onkeydown triggered by the label’s for attribute, enabling an atta...

Mozilla products: Multiple vulnerabilities

Background Mozilla Firefox is an open-source web browser from the Mozilla Project, and Mozilla Thunderbird an email client. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the 'Mozilla Application Suite'...

Debian DSA-1300-1 : iceape - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1362 Nicolas Derouet discovered that Iceape performs insufficient...

fetchmail/mutt/evolution/...: APOP password disclosure vulnerability

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

DSA-1300-1 iceape

Bulletin has no description...

Mozilla Firefox / Thunderbird / SeaMonkey multiple security vulnerabilities

Multiple DoS conditions, addEventListener method crossite scripting. Multiple heap oberflows, integer overflows, etc...

SUSE-SA:2007:022: mozilla,MozillaThunderbird,seamonkey

The remote host is missing the patch for the advisory SUSE-SA:2007:022 mozilla,MozillaThunderbird,seamonkey. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2007:022 if ! definedfunc"bnrandom" exit0;...

Slackware 10.2 / 11.0 / current : firefox-seamonkey-thunderbird (SSA:2007-152-02)

New mozilla-firefox and seamonkey packages are available for Slackware 10.2, 11.0, and -current to fix security issues. New thunderbird packages are are available for Slackware 10.2 and 11.0 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

SUSE-SA:2007:019: MozillaFirefox,seamonkey

The remote host is missing the patch for the advisory SUSE-SA:2007:019 MozillaFirefox,seamonkey. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2007:019 if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Fedora Core 5 : devhelp-0.11-7.fc5 / epiphany-2.14.3-6.fc5 / seamonkey-1.0.9-1.fc5 / etc (2007-552)

Updated seamonkey packages that fix several security bugs are now available for Fedora Core 5. This update has been rated as having critical security impact by the Fedora Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTM...

[SECURITY] Fedora 7 Update: seamonkey-1.1.2-1.fc7

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

Cross site scripting

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to bypass the same-origin policy and conduct cross-site scripting XSS and other attacks by using the addEventListener method to add an event listener for a site, which is executed ...

Path traversal

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via 1 a large cookie path parameter, which triggers memory consumption, or 2 an internal delimiter within cookie path or name values, which could trigg...

Memory corruption

Multiple vulnerabilities in the JavaScript engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code...