Debian DSA-2342-1 : iceape - several vulnerabilities

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey : - CVE-2011-3647 'mozbugra4' discovered a privilege escalation vulnerability in addon handling. - CVE-2011-3648 Yosuke Hasegawa discovered that incorrect handling of Shift-JIS encodings could...

CVE-2011-3648

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

Cross site scripting

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

CVE-2011-3648

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

CVE-2011-3648

CVE-2011-3648 is an XSS vulnerability in Mozilla Firefox prior to 3.6.24 and 4.x through 7.0 and in Thunderbird prior to 3.1.6 and 5.0 through 7.0. It allows remote attackers to inject arbitrary web script or HTML via crafted text encoded in Shift_JIS. Affected products include Firefox and Thunde...

Thunderbird 3.1 < 3.1.16 Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird 3.1 is earlier than 3.1.16. Such versions are potentially affected by the following security issues : - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an...

Firefox 3.6.x < 3.6.24 Multiple Vulnerabilities

The installed version of Firefox 3.6.x is earlier than 3.6.24 and is potentially affected by the following vulnerabilities: - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could...

Mozilla Thunderbird 3.1.x < 3.1.16 Multiple Vulnerabilities

The installed version of Thunderbird 3.1.x is earlier than 3.1.16 and is potentially affected by the following vulnerabilities: - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could...

Thunderbird 7.x Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird 7.x is potentially affected by the following security issues : - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding, which can allow cross-site scripting attacks. CVE-2011-3648 - Profiling JavaScript files with many functions can cause...

CVE-2011-3648

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

CVE-2011-3648: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

DSA-2341-1 iceweasel - several

Bulletin has no description...

Mozilla Thunderbird < 8.0 Multiple Vulnerabilities

The installed version of Thunderbird is earlier than 8.0 and thus, is potentially affected by the following security issues : - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. CVE-2011-3648 - The addition of the 'Azure' graphi...

Firefox < 8.0 Multiple Vulnerabilities

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues : - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. CVE-2011-3648 - The addition of the 'Azure' graphics...

Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47)

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47)

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47)

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

PT-2011-4559

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.24 and 4.x through 7.0 Thunderbird versions prior to 3.1.6 and 5.0 through 7.0 Description The issue allows remote attackers to inject arbitrary web script or HTML code through crafted text with Shift JIS...

Potential XSS against sites using Shift-JIS — Mozilla

Yosuke Hasegawa reported that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. When encountering an invalid pair Mozilla would turn the entire two-byte sequence into a single unknown character rather than an unknown character followed by a valid single-byte...

CVE-2011-1962

Microsoft Internet Explorer 6 through 9 does not properly handle unspecified character sequences, which allows remote attackers to read content from a different 1 domain or 2 zone via a crafted web site that triggers "inactive filtering," aka "Shift JIS Character Encoding Vulnerability."...