Java security bypass from LiveConnect loaded via data: URL meta refresh — Mozilla

Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read loca...

SuSE 11 / 11.1 Security Update : Mozilla XULrunner (SAT Patch Numbers 3557 / 3558)

This update brings the Mozilla XULRunner engine to version 1.9.1.15, fixing various bugs and security issues. The following security issues were fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Som...

RHEL 6 : thunderbird (RHSA-2010:0896)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0896 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. A race condition flaw was found in the way Thunderbird handled Document Objec...

FileFuzz - Denial of Service

Exploit Title :Filefuzzer Denial of service vulnerability Software : Filefuzzer Software link :http://labs.idefense.com/software/fuzzing.php Autor : Sweet Email : [email protected] Date : 5/11/2010 Tested on : WinXp sp3 eng | Vmware Software detail: FileFuzz is a graphical Windows based devlopp...

Report: Technical Glitch Takes ICMBs Offline

A report in The Atlantic claims that a technical glitch at Warren Air Force Base in Wyoming took 50 nuclear intercontinental ballistic missiles ICBMs offline for around 45 minutes on Saturday – a serious breach of national security. The causes of the disruption are still in dispute, but the loss ...

Mandriva Update for mozilla-thunderbird MDVSA-2010:211 (mozilla-thunderbird)

Check for the Version of mozilla-thunderbird OpenVAS Vulnerability Test Mandriva Update for mozilla-thunderbird MDVSA-2010:211 mozilla-thunderbird Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Update for mozilla-thunderbird MDVSA-2010:211 (mozilla-thunderbird)

Check for the Version of mozilla-thunderbird OpenVAS Vulnerability Test Mandriva Update for mozilla-thunderbird MDVSA-2010:211 mozilla-thunderbird Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

CVE-2010-3182

A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan hor...

HP Insight Diagnostics Online Edition 8.4 - 'custom.php?testmode' Cross-Site Scripting

source: https://www.securityfocus.com/bid/42888/info HP Insight Diagnostics Online Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of ...

SUMATRA PDF READER version 1.1 (CRASHER) DoS File Creator

Exploit for windows platform in category dos / poc ========================================================= SUMATRA PDF READER version 1.1 CRASHER DoS File Creator ========================================================= SUMATRA PDF READER version 1.1 CRASHER DoS File Creator Vulnerability...

Fedora 12 : quake3-1.36-7.svn1783.fc12 (2010-8558)

Wed May 12 2010 Xavier Lamien - 1.36-7.svn1783 - Update release to svn revision r1783. - Remove botlib-strcpy-abuse patch added upstream. - Thu Jan 21 2010 Hans de Goede 1.36-6 - Update fix autodlrc mirror URL's 557252 - Fri Dec 18 2009 Hans de Goede 1.36-5 - Modify Urban Terror launch script to...

acroread: multiple code execution flaws (APSB10-15)

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PD...

Multiple PDF products Launch Action Command Code Execution (APSB10-15; CVE-2009-0836; CVE-2010-1240)

Portable Document Format PDF is an open file format created by Adobe Systems. A vulnerability has been discovered in Adobe Reader. The vulnerability is due to an error in the Adobe Reader that fails to restrict the contents of one text field in the Launch File warning dialog, which makes it easie...

Critical PDF Reader Patch Fixes '/Launch' Command Attack Vector

Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac and UNIX users to malicious hacker attacks. The update, which affects Adobe Reader/Acrobat 9.3.2 and earlier versions, includes a fix for the outstanding PDF “/Launch”...

The Uploader 2.0.4 File Disclosure

================================================= The Uploader 2.0.4 Remote File disclosure Vulnerability ================================================= ============================================== Script Name : The Uploader Version : 2.0.4 Language : php Author : Xa7m3d [email protected]...

The Uploader 2.0.4 - Remote File Disclosure

================================================= The Uploader 2.0.4 Remote File disclosure Vulnerability ================================================= ============================================== Script Name : The Uploader Version : 2.0.4 Language : php Author : Xa7m3d [email protected]...

CVE-2010-1991

Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service excessive application launches via an HTML document with many IFRAM...

Mac OS X 10.5.4 Update / Mac OS X Security Update 2008-004

The remote host is missing Mac OS X 10.5.4 Update / Mac OS X Security Update 2008-004. One or more of the following components are affected: Alias Manager CoreTypes c++filt Dock Launch Services Net-SNMP Ruby SMB File Server System Configuration Tomcat VPN WebKit OpenVAS Vulnerability Test Mac OS ...

Mac OS X Security Update 2007-009

The remote host is missing Security Update 2007-009. SPDX-FileCopyrightText: 2010 LSS Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Mac OS X Security Update 2009-005

The remote host is missing Security Update 2009-005. One or more of the following components are affected: Alias Manager CarbonCore ClamAV ColorSync CoreGraphics CUPS Flash Player plug-in ImageIO Launch Services MySQL PHP SMB Wiki Server OpenVAS Vulnerability Test Mac OS X Security Update 2009-00...