Mozilla Products Updater Service Privilege Escalation Vulnerabilities - Windows

Mozilla Firefox/Thunderbird/Seamonkey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Releases Automatic Updater for Certificate Revocation Lists, Plans to Invalidate Short RSA Keys

As part of its response to the Flame malware and its usage of a forged Microsoft certificate to sign malicious files, Microsoft has changed the way that Windows handles certificates, releasing an automatic updater function that will recognize and flag untrusted certificates. The new functionality...

Adobe Releases Sandboxed Flash Player for Firefox

Adobe has released a new version of the Flash player that now gives Firefox users the additional security of a sandbox and also includes a background update mechanism for Mac users. Flash has run in a sandbox on Google Chrome and Internet Explorer for some time already. The big security news in...

CVE-2012-1943

Untrusted search path vulnerability in Updater.exe in the Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allows local users to gain privileges via a Trojan horse wsock32.dll file in an application directory...

CVE-2012-1942

The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context...

Design/Logic Flaw

Untrusted search path vulnerability in Updater.exe in the Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allows local users to gain privileges via a Trojan horse wsock32.dll file in an application directory...

Code injection

The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context...

CVE-2012-1942

CVE-2012-1942 affects Mozilla Firefox 12.0, Thunderbird 12.0 and SeaMonkey 2.9 on Windows. The root cause is the Mozilla/Windows Updater Service loading a DLL in a privileged context, enabling a local user to gain privileges by placing a malicious DLL in a privileged path before updater execution...

PT-2012-3674

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 12.0 Thunderbird version 12.0 SeaMonkey version 2.9 Description The issue is related to an untrusted search path vulnerability in the Updater.exe component of the Windows Updater Service. This vulnerability allows local...

Privilege escalation through Mozilla Updater and Windows Updater Service — Mozilla

Security researcher James Forshaw of Context Information Security found two issues with the Mozilla updater and the Mozilla updater service introduced in Firefox 12 for Windows. The first issue allows Mozilla's updater to load a local DLL file in a privileged context. The updater can be called by...

Flash 11.3 Beta Includes Protected Mode Sandbox for Firefox

Adobe is working on a new version of the Flash player software that will include some upgraded security features, most notably a sandbox for Flash running on Firefox. The beta version of Flash that includes the sandbox for Firefox is available for users now. Flash on Google Chrome has been...

Oracle Java Software Update Remote Code Execution

A remote code execution vulnerability has been reported in Oracle Java software updater...

Google Releases Chrome 18, Fixes Nine Security Flaws

Google has released version 18 of its Chrome browser and has fixed a number of serious security vulnerabilities in the process. The latest version of Chrome also includes an updated release of the Flash player that now includes the background updated that enables users to set the software to upda...

Adobe Patches Flash Player, Unveils New Silent Updater

Adobe pushed out a security update for its Flash Player Wednesday, patching two critical holes and introducing a new silent update option. The update, Adobe Flash Player 11.2, addresses two memory corruption vulnerabilities in Windows, Mac, Linux and early Android builds that could lead to remote...

CVE-2012-0054

libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat...

Mozilla Readies Silent Updater with New Versions of Firefox

Mozilla announced this week that it plans to integrate a silent updater in the next build of its flagship browser, Firefox, allowing future patches for Firefox 12 to be downloaded and installed in the background while the browser is running, according to a blog post by Robert Nyman, Mozilla’s...

SA-CONTRIB-2012-036 - Multiple Modules Unsupported

CVE: CVE-2012-2056 Content Lock Is a module that prevents users from concurrent editing of nodes. This module does not use a token for unlocking a content lock. This leads to a CSRF attack vector. CVE: CVE-2012-2057 Ubercart Bulk Stock Updater is an extension module for Ubercart 2.x running on...

CVE-2011-0085

Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Gentoo Security Advisory GLSA 201009-08 (python-updater)

The remote host is missing updates announced in advisory GLSA 201009-08. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...