Mozilla Foundation Security Advisory 2010-06

You are here: Security Center Mozilla Foundation Security Advisories MFSA 2010-06 Mozilla Foundation Security Advisory 2010-06 Title: Scriptable plugin execution in SeaMonkey mail Impact: Critical Announced: March 16, 2010 Reporter: Georgi Guninski Products: SeaMonkey Fixed in: SeaMonkey 1.1.19...

Mozilla Foundation Security Advisory 2010-17

Mozilla Foundation Security Advisory 2010-17 Title: Remote code execution with use-after-free in nsTreeSelection Impact: Critical Announced: March 30, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.5.9 Firefox 3.0.19...

Mozilla Foundation Security Advisory 2010-21

Mozilla Foundation Security Advisory 2010-21 Title: Arbitrary code execution with Firebug XMLHttpRequestSpy Impact: High Announced: March 30, 2010 Reporter: mozbugra4 Products: Firefox, SeaMonkey Fixed in: Firefox 3.5.8 Firefox 3.0.19 SeaMonkey 2.0.3 Description Mozilla security researcher...

Mozilla Foundation Security Advisory 2010-23

Mozilla Foundation Security Advisory 2010-23 Title: Image src redirect to mailto: URL opens email editor Impact: Low Announced: March 30, 2010 Reporter: Henry Sudhof Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.2 Firefox 3.5.9 SeaMonkey 2.0.4 Description phpBB developer Henry Sudhof reporte...

Mozilla Foundation Security Advisory 2010-07

Mozilla Foundation Security Advisory 2010-07 Title: Fixes for potentially exploitable crashes ported to the legacy branch Impact: Critical Announced: March 16, 2010 Reporter: Mozilla developers and community Products: Thunderbird, SeaMonkey Fixed in: Thunderbird 2.0.0.24 SeaMonkey 1.1.19...

Mozilla Foundation Security Advisory 2010-18

Mozilla Foundation Security Advisory 2010-18 Title: Dangling pointer vulnerability in nsTreeContentView Impact: Critical Announced: March 30, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.2 Firefox 3.5.9 Firefox...

Fedora Update for seamonkey FEDORA-2010-5840

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2010-0173

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...

CVE-2010-0174

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly...

Code injection

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, does not prevent applets from interpreting mouse clicks as drag-and-drop actions, which allows remote attackers to execute arbitrary JavaScript with Chrome privileges by loading a chrome: URL an...

Design/Logic Flaw

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, frees the contents of the window.navigator.plugins array while a reference to an array element is still active, which allows remote attackers to execute arbitrary code or cause a denial of servi...

Code injection

Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

CVE-2010-0179

Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute...

CVE-2010-0178

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, does not prevent applets from interpreting mouse clicks as drag-and-drop actions, which allows remote attackers to execute arbitrary JavaScript with Chrome privileges by loading a chrome: URL an...

Design/Logic Flaw

Use-after-free vulnerability in the nsTreeSelection implementation in Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

Memory corruption

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly...

Memory corruption

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...

CVE-2010-0181

Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service excessive application launches via an...

Hardcoded credentials

Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4, executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service excessive application launches via an...

Design/Logic Flaw

Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2; Thunderbird before 3.0.4; and SeaMonkey before 2.0.4 do not properly manage reference counts for option elements in a XUL tree optgroup, which might allow remote attackers to execute arbitrary code via unspecified vectors...