Mozilla Firefox/Thunderbird/SeaMonkey信息泄露漏洞

Bugtraq ID:66418 CVE ID:CVE-2014-1505 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox 28.0之前版本, Thunderbird 24.4之前版本，SeaMonkey 2.25之前版本的SVG过滤器实现中存在安全漏洞，远程攻击者可利用此漏洞获取敏感的位移相关信息、绕过同源策略，读取不同域的文本。 0 Mozilla Firefox 28.0 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Mozilla Firefox/Thunderbird/SeaMonkey安全限制绕过漏洞

Bugtraq ID:66418 CVE ID:CVE-2014-1505 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox 28.0之前版本, Thunderbird 24.4之前版本，SeaMonkey 2.25之前版本的SVG过滤器实现中存在安全漏洞，远程攻击者可利用此漏洞获取敏感的位移相关信息、绕过同源策略，读取不同域的文本。 0 Mozilla Firefox 28.0 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Updated iceape packages fix multiple vulnerabilities

Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service memory corruption and...

Fedora 20 : seamonkey-2.25-1.fc20 (2014-4338)

Update to 2.25 Fixes various security issues, see http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html for more info. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Slackware 14.0 / 14.1 / current : seamonkey (SSA:2014-086-07)

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-086-07. The text itself is copyright...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/seamonkey-2.25-i486-1slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information, se...

SeaMonkey Multiple Vulnerabilities-01 (Mar 2014) - Mac OS X

SeaMonkey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey"; ifdescription...

VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free (Pwn2Own)

VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Mozilla Firefox is a free and open-source web browser developed for Windows, OS X, and Linux, with ...

SeaMonkey Multiple Vulnerabilities-01 (Mar 2014) - Windows

SeaMonkey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey"; ifdescription...

Mozilla Firefox / Thunderbird / Seamonkey / nss multiple security vulnerabilities

Buffer overflows, memory corruptions, information leakage, privilege escalation, protection bypass, unauthorized access, interface spoofing...

SeaMonkey < 2.25 Multiple Vulnerabilities

Binary data 8172.prm...

Mozilla多个产品onbeforeunload事件页面导航拒绝服务漏洞

CVE ID:CVE-2014-1500 Mozilla Firefox/SeaMonkey是Mozilla所发布的WEB浏览器/新闻组客户端。 当onbeforeunload事件与页面导航一起使用时会使浏览器变得不稳定，允许攻击者利用漏洞构建恶意WEB页，诱使用户解析，可使应用程序崩溃。 0 Mozilla Firefox 27 Mozilla Seamonkey 2.24 Mozilla Firefox 28，Seamonkey 2.25已经修复该漏洞，建议用户下载更新： http://www.mozilla.org...

Mozilla多个产品crypto.generateCRMFRequest拒绝服务漏洞

CVE ID:CVE-2014-1498 Mozilla Firefox/SeaMonkey是Mozilla所发布的WEB浏览器/新闻组客户端。 Mozilla多个产品在生成ec-dual-use请求时crypto.generateCRFMRequest方法没有正确校验KeyParams参数的键值类型，允许攻击者利用漏洞进行拒绝服务攻击，使应用程序崩溃。 0 Mozilla Firefox 27 Mozilla Seamonkey 2.24 Mozilla Firefox 28，Seamonkey 2.25已经修复该漏洞，建议用户下载更新： http://www.mozilla.org...

Mozilla多个产品WebRTC会话权限提示伪造攻击漏洞

CVE ID:CVE-2014-1499 Mozilla Firefox/SeaMonkey是Mozilla所发布的WEB浏览器/新闻组客户端。 Mozilla多个产品处理WebRTC会话权限提示时存在错误会显示错误的域名，允许攻击者利用漏洞构建恶意WEB页，诱使用户解析，进行伪造攻击，可用于访问webcam或麦克风。 0 Mozilla Firefox 27 Mozilla Seamonkey 2.24 Mozilla Firefox 28，Seamonkey 2.25已经修复该漏洞，建议用户下载更新： http://www.mozilla.org...

Mozilla: Miscellaneous memory safety hazards (rv:24.4) (MFSA 2014-15)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary cod...

CVE-2014-1505

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a differen...

CVE-2014-1499

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC 1 camera or 2 microphone permission prompt by triggering navigation at a certain time during generation of this prompt...

CVE-2014-1498

The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service application crash via vectors that trigger generation of a key that supports the Elliptic Curve...

CVE-2014-1493

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary cod...

CVE-2014-1504

The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted document that is accessed after a browser restart...