JVN#21563357 Mozilla Firefox cross-site scripting vulnerability

Mozilla Firefox does not properly handle certain HTML documents in ShiftJIS encoding. According to MFSA 2008-13, this flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard. Impact An arbitrary script may be executed on the user's web browser. Solution...

Fedora 8 : seamonkey-1.1.9-1.fc8 (2008-2830)

Fri Mar 28 2008 Kai Engert - 1.1.9-1 - SeaMonkey 1.1.9 - Fri Feb 8 2008 Kai Engert - 1.1.8-1 - SeaMonkey 1.1.8 - Sun Dec 2 2007 Kai Engert - 1.1.7-1 - SeaMonkey 1.1.7 - Mon Nov 5 2007 Kai Engert - 1.1.6-1 - SeaMonkey 1.1.6 - Fri Oct 19 2007 Kai Engert - 1.1.5-2 - SeaMonkey 1.1.5 Note that Tenable...

Fedora 7 : seamonkey-1.1.9-1.fc7 (2008-2812)

Fri Mar 28 2008 Kai Engert - 1.1.9-1 - SeaMonkey 1.1.9 - Fri Feb 8 2008 Kai Engert - 1.1.8-1 - SeaMonkey 1.1.8 - Sun Dec 2 2007 Kai Engert - 1.1.7-1 - SeaMonkey 1.1.7 - Mon Nov 5 2007 Kai Engert - 1.1.6-1 - SeaMonkey 1.1.6 - Fri Oct 19 2007 Kai Engert - 1.1.5-1 - SeaMonkey 1.1.5 - Fri Jul 27 2007...

universal XSS using event handlers

Cross-site scripting XSS vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."...

chrome privilege via wrong principal

Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via incorrect principals...

browser engine crashes

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via unknown vectors related to the layout engine...

javascript crashes

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via unknown vectors related to the JavaScript engine...

XUL popup spoofing

GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab...

Referrer spoofing bug

Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely ...

Mozilla products XPCNativeWrapper pollution

Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."...

[SECURITY] Fedora 8 Update: seamonkey-1.1.9-1.fc8

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

[SECURITY] Fedora 7 Update: seamonkey-1.1.9-1.fc7

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.13版本修复多个安全漏洞

BUGTRAQ ID: 28448 CVECAN ID: CVE-2008-1241,CVE-2008-1240,CVE-2007-4879,CVE-2008-1238,CVE-2008-1236,CVE-2008-1237,CVE-2008-1233,CVE-2008-1234,CVE-2008-1235 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...

Debian DSA-1534-1 : iceape - several vulnerabilities

This shares a lot of text with dsa-1532.wml, dsa-1535.wml, dsa-1574.wml Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the following problems : -...

Slackware 11.0 / 12.0 / current : seamonkey (SSA:2008-089-02)

New seamonkey packages are available for Slackware 11.0, 12.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2008-089-02. The text itself is copyright...

FreeBSD : mozilla -- multiple vulnerabilities (12b336c6-fe36-11dc-b09c-001c2514716c)

The Mozilla Foundation reports of multiple security issues in Firefox, SeaMonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. - MFSA 2008-19 XUL popup spoofing variant cross-tab popups - MFSA 2008-18 Java...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 11.0, 12.0, and -current to fix security issues. For more information, see: http://www.mozilla.org/projects/security/known-vulnerabilities.htmlseamonkey Here are the details from the Slackware 12.0 ChangeLog:...

seamonkey security update

CentOS Errata and Security Advisory CESA-2008:0208 Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open...

seamonkey security update

CentOS Errata and Security Advisory CESA-2008:0208-01 Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open...

CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...