SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1001)

The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues : - Crashes with evidence of memory corruption rv:1.9.0.11. MFSA 2009-24 / CVE-2009-1392 / CVE-2009-1832 / CVE-2009-1833 - bmo479413 URL spoofing with invalid unicode characters. MFSA 2009-25 /...

OpenJDK Proxy mechanism information leaks (6801071)

The proxy mechanism implementation in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted 1 applets and 2 Java Web Start applications, which allows remote attackers to hijack web sessions...

SeaMonkey < 1.1.17 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 1.1.17. Such versions are potentially affected by the following security issues : - When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage...

SUSE: Security Advisory for MozillaFirefox (SUSE-SA:2009:034)

The remote host is missing updates announced in advisory SUSE-SA:2009:034. Copyright C 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

FreeBSD : mozilla -- multiple vulnerabilities (da185955-5738-11de-b857-000f20797ede)

Mozilla Foundation reports : MFSA 2009-32 JavaScript chrome privilege escalation MFSA 2009-31 XUL scripts bypass content-policy checks MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar MFSA 2009-29 Arbitrary code execution using event listeners attached to an elemen...

RHEL 4 : seamonkey (RHSA-2009:1096)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1096 advisory. - Firefox browser engine crashes CVE-2009-1392 - Firefox JavaScript engine crashes CVE-2009-1833 - Firefox Arbitrary domain cookie access by...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: MFSA 2009-32 JavaScript chrome privilege escalation MFSA 2009-31 XUL scripts bypass content-policy checks MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar MFSA 2009-29 Arbitrary code execution using event listeners attached to an element...

Arbitrary domain cookie access by local file: resources — Mozilla

Security researcher Gregory Fleischer reported that local resources loaded via the file: protocol can access any domain's cookies which have been saved on a user's machine. Fleischer demonstrated that a local document's domain was being calculated incorrectly from its URL. If a victim could be...

Movable Type cross-site scripting vulnerability

Overview Movable Type, a web log system from Six Apart, contains a cross-site scripting vulnerability. This vulnerability is different from JVN68295640. Impact An arbitrary script could be executed on the user's web browser or the display of a web page could be falsified. In addition, an attacker...

phpEventCalendar HTML injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: phpEventCalendar HTML injection Vulnerability discovery: Madelman madelman AT iname.com Date: 25/01/2005 Severity: Medium. Registered users can obtain other users cookies Summary: - -------- phpEventCalendar is a MySQL backed application that...

CVE-2002-1348

CVE-2002-1348 affects w3m prior to 0.3.2.2, where HTML escaping in IMG ALT attributes is insufficient, potentially allowing remote attackers to access local files or cookies. Connected advisories (Debian DSA for w3m/w3mmee) confirm multiple Debian advisories addressing this vulnerability and indi...

CVE-2002-1348

w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies...

CVE-2003-0513

Microsoft Internet Explorer allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Internet Explorer to send the cookie outside the specified URL subsets, e.g. to a vulnerable...

CVE-2003-0593

Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Opera to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same...

CVE-2003-0514

Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Safari to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the...

CVE-2003-0594

Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same...

CVE-2003-0592

Konqueror in KDE 3.1.3 and earlier kdelibs allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a...

CVE-2003-0594

Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same...

CVE-2003-0513

Microsoft Internet Explorer is affected by CVE-2003-0513 through a cookie path-traversal issue. The root cause is that encoded directory traversal sequences ("%2e%2e") in a URL can bypass cookie scope restrictions, causing the browser to send cookies outside the intended URL subset to another app...

CVE-2003-0592

Konqueror in KDE 3.1.3 and earlier kdelibs allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a...