Mozilla Foundation Security Advisory 2007-02

Mozilla Foundation Security Advisory 2007-02 Title: Improvements to help protect against Cross-Site Scripting attacks Impact: Low Announced: February 23, 2007 Reporter: various Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10 SeaMonkey 1.0.8 Firefox 2.0.0.2 and 1.5.0.10...

Fedora Core 5 : devhelp-0.11-6.fc5 / epiphany-2.14.3-4.fc5 / seamonkey-1.0.8-0.5.1.fc5 / etc (2007-289)

The remote Fedora Core host is missing one or more security updates : yelp-2.14.3-4.fc5 : - Fri Feb 16 2007 Martin Stransky - 2.14.3-4 - Rebuild against SeaMonkey - Fri Dec 22 2006 Martin Stransky - 2.14.3-3 - Rebuild against SeaMonkey - Tue Nov 14 2006 Martin Stransky - 2.14.3-2 - Rebuild agains...

Mozilla Foundation Security Advisory 2007-01

Mozilla Foundation Security Advisory 2007-01 Title: Crashes with evidence of memory corruption rv:1.8.0.10/1.8.1.2 Impact: Critical Announced: February 23, 2007 Reporter: Mozilla developers and community Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.2 Firefox 1.5.0.10...

CVE-2007-0996: Undefined Security Weakness

The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated using the UTF-7 character set...

[SECURITY] Fedora Core 5 Update: seamonkey-1.0.8-0.5.1.fc5

SeaMonkey former Mozilla is an open-source web browser, designed for stan dards compliance, performance and portability...

Heap overflow

Integer underflow in the SSLv2 support in Mozilla Network Security Services NSS before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to...

Code injection

GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom...

Design/Logic Flaw

The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors whe...

CVE-2007-0779

GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom...

CVE-2007-0778

The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors whe...

CVE-2007-0779

GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom...

Cross site scripting

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting XSS attacks by opening a blocked popup originating from a javascript: URI in...

CVE-2007-0778

The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors whe...

CVE-2007-0780

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting XSS attacks by opening a blocked popup originating from a javascript: URI in...

CVE-2007-0780

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting XSS attacks by opening a blocked popup originating from a javascript: URI in...

CVE-2007-0779

GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom...

CVE-2007-0778

CVE-2007-0778 affects Mozilla Firefox (and related Gecko-based browsers like SeaMonkey) prior to 1.5.0.10 / 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The vulnerability stems from the page cache implementation, where hash collisions can cause page data to be appended to the wrong cache entry...

CVE-2007-0779

CVE-2007-0779 concerns a GUI overlay spoofing flaw in SeaMonkey prior to 1.0.8 (and Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2) where a large, transparent cursor via CSS3 hotspot could spoof UI elements such as the hostname or security indicators. The vulnerability allows remote observe...

CVE-2007-0780

CVE-2007-0780 is a cross-site scripting vulnerability in Firefox 1.5.x up to 1.5.0.9 and Firefox 2.x up to 2.0.0.x, and SeaMonkey up to 1.0.7, where the requesting URI is used to identify child windows. This enables remote XSS when a blocked popup originating from a javascript: URI is opened acro...

CVE-2007-0008

CVE-2007-0008 is an NSS heap-based overflow caused by an integer underflow when processing an SSLv2 server message with a key too short to encrypt the Master Secret. It affects SeaMonkey, Firefox, and Thunderbird around NSS usage and was addressed by updating to fixed NSS-containing packages (e.g...