[SECURITY] [DSA 1339-1] New iceape packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1339-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 23rd, 2007 http://www.debian.org/security/faq -...

DSA-1339-1 iceape - several

Bulletin has no description...

USN-490-1: Firefox vulnerabilities

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-3734, CVE-2007-3735 Flaws were discovered in the JavaScript methods addEventListener and setTimeo...

Unauthorized access to wyciwyg:// documents — Mozilla

Michal Zalewski reported that it was possible to bypass the same-origin checks and read from cached wyciwyg documents. It is possible to access wyciwyg:// documents without proper same domain policy checks through the use of HTTP 302 redirects. This enables the attacker to steal sensitive data...

XSS using addEventListener and setTimeout — Mozilla

Mozilla contributor mozbugra4 demonstrated that the methods addEventListener and setTimeout could be used to inject script into another site in violation of the browser's same-origin policy. This could be used to access or modify private or valuable information from that other site...

Cross site scripting

Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, ...

CVE-2007-3514

Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, ...

CVE-2007-3514

Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, ...

CVE-2007-3514

CVE-2007-3514 describes a cross-domain vulnerability in Apple Safari for Windows 3.0.2 where JavaScript that overwrites the document variable and statically assigns the document.domain to a file:// location bypasses the Same Origin Policy and allows access to restricted information from other dom...

CVE-2007-3514: Undefined Security Weakness

Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, ...

Cross site scripting

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute...

CVE-2007-3481

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue...

CVE-2007-3482

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute...

CVE-2007-3481

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue...

CVE-2007-3482

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute...

CVE-2007-3481

CVE-2007-3481 concerns a cross-domain issue in Microsoft Internet Explorer 6 and 7 where a remote attacker could bypass the Same Origin Policy by a JavaScript action that overwrites the document variable and statically sets the document.domain attribute. The connected PT-security entry confirms a...

CVE-2007-3482

CVE-2007-3482 concerns Cross-domain vulnerability in Apple Safari for Windows 3.0.1 where JavaScript can overwrite the document variable and statically set document.domain, allowing a remote attacker to bypass the same-origin policy and access restricted information from other domains. The connec...

PT-2007-4742 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 7 Description: A cross-domain issue allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript. This is achieved by overwriting t...

CVE-2007-3482: Improper Neutralization of Input During Web Page Generation

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute...

CVE-2007-3481: Improper Restriction of Operations within the Bounds of a Memory Buffer

Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute. NOTE: this issue...