Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple memory corruptions, privilege escalations, weak permissions, DoS, protection bypass, crossite scripting...

CVE-2013-0789

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to the nsContentUtils::HoldJSObjec...

PT-2013-2618 · Mozilla +3 · Thunderbird Esr +8

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 20.0 Firefox ESR 17.x versions prior to 17.0.5 Thunderbird versions prior to 17.0.5 Thunderbird ESR 17.x versions prior to 17.0.5 SeaMonkey versions prior to 2.17 Description: The issue allows remote attacker...

CVE-2013-0794

Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site...

PT-2013-2624 · Mozilla +1 · Firefox Esr +5

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 20.0 Firefox ESR versions prior to 17.0.5 Thunderbird versions prior to 17.0.5 Thunderbird ESR versions prior to 17.0.5 SeaMonkey versions prior to 2.17 Description: The issue allows local users to gain...

Mozilla Releases Multiple Updates

The Mozilla Foundation has released updates to address multiple vulnerabilities. These vulnerabilities could allow an attacker to initiate a cross-site scripting attack or obtain sensitive information, enable privilege escalation or execute arbitrary code, or cause a denial-of-service condition...

CVE-2013-0795

The System Only Wrapper SOW implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote...

CVE-2013-0792

Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.colormanagement.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service memory corruption via a...

CVE-2013-0800

Integer signedness error in the pixmanfillsse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows...

Mozilla: Cross-site scripting (XSS) using timed history navigations (MFSA 2013-38)

Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting XSS attac...

Mozilla: Out-of-bounds write in Cairo library (MFSA 2013-31)

Integer signedness error in the pixmanfillsse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows...

Mozilla: Miscellaneous memory safety hazards (rv:17.0.5) (MFSA 2013-30)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service memory corruption and application...

Mozilla: WebGL crash with Mesa graphics driver on Linux (MFSA 2013-35)

The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a...

Mozilla: Miscellaneous memory safety hazards (rv:17.0.5) (MFSA 2013-30)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service memory corruption and application...

SeaMonkey 2.16.x < 2.16.1 nsHTMLEditor User-After-Free

Binary data 6723.prm...

Mozilla SeaMonkey 2.16.x < 2.16.1 nsHTMLEditor User-After-Free

Binary data 801259.prm...

Mozilla Firefox / Thunderbird / Seamonkey use-after-free vulnerability

HTML editor use-after-free...

Mozilla Firefox Thunderbird SeaMonkey nsSVGValue Memory Corruption (CVE-2011-3658)

A memory corruption vulnerability exists in Firefox 7.0 and 8.0, Thunderbird 8.0 and SeaMonkey 2.5. The vulnerability is due to unchecked iteration that could cause an out of bounds access to attacker controlled memory. A sucesseful exploitation could lead to malicious code running in the context...

seamonkey: update to 2.16.1 (important)

seamonkey was updated to version 2.16.1 fixing a severe security issue. MFSA 2013-29/CVE-2013-0787 bmo848644 Use-after-free in HTML Editor...

Slackware 13.37 / 14.0 / current : seamonkey (SSA:2013-072-02)

New seamonkey packages are available for Slackware 13.37, 14.0, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-072-02. The text itself is copyrig...