nessus
via4
|
NASL family | Solaris Local Security Checks | NASL id | SOLARIS8_120671.NASL | description | Mozilla 1.7 for Solaris 8 and 9.
Date this patch was last updated by Sun : Aug/29/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 24395 | published | 2007-02-18 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=24395 | title | Solaris 8 (sparc) : 120671-08 |
NASL family | Ubuntu Local Security Checks | NASL id | UBUNTU_USN-271-1.NASL | description | Web pages with extremely long titles caused subsequent launches of
Firefox browser to hang for up to a few minutes, or caused Firefox to
crash on computers with insufficient memory. (CVE-2005-4134)
Igor Bukanov discovered that the JavaScript engine did not properly
declare some temporary variables. Under some rare circumstances, a
malicious website could exploit this to execute arbitrary code with
the privileges of the user. (CVE-2006-0292, CVE-2006-1742)
The function XULDocument.persist() did not sufficiently validate the
names of attributes. An attacker could exploit this to inject
arbitrary XML code into the file 'localstore.rdf', which is read and
evaluated at startup. This could include JavaScript commands that
would be run with the user's privileges. (CVE-2006-0296)
Due to a flaw in the HTML tag parser a specific sequence of HTML tags
caused memory corruption. A malicious website could exploit this to
crash the browser or even execute arbitrary code with the user's
privileges. (CVE-2006-0749)
Georgi Guninski discovered that embedded XBL scripts of websites could
escalate their (normally reduced) privileges to get full privileges of
the user if that page is viewed with 'Print Preview'. (CVE-2006-1727)
The crypto.generateCRMFRequest() function had a flaw which could be
exploited to run arbitrary code with the user's privileges.
(CVE-2006-1728)
Claus Jorgensen and Jesse Ruderman discovered that a text input box
could be pre-filled with a filename and then turned into a file-upload
control with the contents intact. A malicious website could exploit
this to read any local file the user has read privileges for.
(CVE-2006-1729)
An integer overflow was detected in the handling of the CSS property
'letter-spacing'. A malicious website could exploit this to run
arbitrary code with the user's privileges. (CVE-2006-1730)
The methods valueOf.call() and .valueOf.apply() returned an object
whose privileges were not properly confined to those of the caller,
which made them vulnerable to cross-site scripting attacks. A
malicious website could exploit this to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-1731) The window.controllers array variable (CVE-2006-1732)
and event handlers (CVE-2006-1741) were vulnerable to a similar
attack.
The privileged built-in XBL bindings were not fully protected from web
content and could be accessed by calling valueOf.call() and
valueOf.apply() on a method of that binding. A malicious website could
exploit this to run arbitrary JavaScript code with the user's
privileges. (CVE-2006-1733)
It was possible to use the Object.watch() method to access an internal
function object (the 'clone parent'). A malicious website could
exploit this to execute arbitrary JavaScript code with the user's
privileges. (CVE-2006-1734)
By calling the XBL.method.eval() method in a special way it was
possible to create JavaScript functions that would get compiled with
the wrong privileges. A malicious website could exploit this to
execute arbitrary JavaScript code with the user's privileges.
(CVE-2006-1735)
Michael Krax discovered that by layering a transparent image link to
an executable on top of a visible (and presumably desirable) image a
malicious site could fool the user to right-click and choose 'Save
image as...' from the context menu, which would download the
executable instead of the image. (CVE-2006-1736)
Several crashes have been fixed which could be triggered by websites
and involve memory corruption. These could potentially be exploited to
execute arbitrary code with the user's privileges. (CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
If the user has turned on the 'Entering secure site' modal warning
dialog, it was possible to spoof the browser's secure-site indicators
(the lock icon and the gold URL field background) by first loading the
target secure site in a pop-up window, then changing its location to a
different site, which retained the displayed secure-browsing
indicators from the original site. (CVE-2006-1740).
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues. | last seen | 2019-01-16 | modified | 2018-08-15 | plugin id | 21270 | published | 2006-04-21 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21270 | title | Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1) |
NASL family | Debian Local Security Checks | NASL id | DEBIAN_DSA-1051.NASL | description | Several security related problems have been discovered in Mozilla
Thunderbird. The Common Vulnerabilities and Exposures project
identifies the following vulnerabilities :
- CVE-2005-2353
The 'run-mozilla.sh' script allows local users to create
or overwrite arbitrary files when debugging is enabled
via a symlink attack on temporary files.
- CVE-2005-4134
Web pages with extremely long titles cause subsequent
launches of the browser to appear to 'hang' for up to a
few minutes, or even crash if the computer has
insufficient memory. [MFSA-2006-03]
- CVE-2006-0292
The JavaScript interpreter does not properly dereference
objects, which allows remote attackers to cause a denial
of service or execute arbitrary code. [MFSA-2006-01]
- CVE-2006-0293
The function allocation code allows attackers to cause a
denial of service and possibly execute arbitrary code.
[MFSA-2006-01]
- CVE-2006-0296
XULDocument.persist() did not validate the attribute
name, allowing an attacker to inject arbitrary XML and
JavaScript code into localstore.rdf that would be read
and acted upon during startup. [MFSA-2006-05]
- CVE-2006-0748
An anonymous researcher for TippingPoint and the Zero
Day Initiative reported that an invalid and nonsensical
ordering of table-related tags can be exploited to
execute arbitrary code. [MFSA-2006-27]
- CVE-2006-0749
A particular sequence of HTML tags can cause memory
corruption that can be exploited to execute arbitrary
code. [MFSA-2006-18]
- CVE-2006-0884
Georgi Guninski reports that forwarding mail in-line
while using the default HTML 'rich mail' editor will
execute JavaScript embedded in the e-mail message with
full privileges of the client. [MFSA-2006-21]
- CVE-2006-1045
The HTML rendering engine does not properly block
external images from inline HTML attachments when 'Block
loading of remote images in mail messages' is enabled,
which could allow remote attackers to obtain sensitive
information. [MFSA-2006-26]
- CVE-2006-1529
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1530
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1531
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1723
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1724
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1727
Georgi Guninski reported two variants of using scripts
in an XBL control to gain chrome privileges when the
page is viewed under 'Print Preview'. [MFSA-2006-25]
- CVE-2006-1728
'shutdown' discovered that the
crypto.generateCRMFRequest method can be used to run
arbitrary code with the privilege of the user running
the browser, which could enable an attacker to install
malware. [MFSA-2006-24]
- CVE-2006-1729
Claus Jorgensen reported that a text input box can be
pre-filled with a filename and then turned into a
file-upload control, allowing a malicious website to
steal any local file whose name they can guess.
[MFSA-2006-23]
- CVE-2006-1730
An anonymous researcher for TippingPoint and the Zero
Day Initiative discovered an integer overflow triggered
by the CSS letter-spacing property, which could be
exploited to execute arbitrary code. [MFSA-2006-22]
- CVE-2006-1731
'moz_bug_r_a4' discovered that some internal functions
return prototypes instead of objects, which allows
remote attackers to conduct cross-site scripting
attacks. [MFSA-2006-19]
- CVE-2006-1732
'shutdown' discovered that it is possible to bypass
same-origin protections, allowing a malicious site to
inject script into content from another site, which
could allow the malicious page to steal information such
as cookies or passwords from the other site, or perform
transactions on the user's behalf if the user were
already logged in. [MFSA-2006-17]
- CVE-2006-1733
'moz_bug_r_a4' discovered that the compilation scope of
privileged built-in XBL bindings is not fully protected
from web content and can still be executed which could
be used to execute arbitrary JavaScript, which could
allow an attacker to install malware such as viruses and
password sniffers. [MFSA-2006-16]
- CVE-2006-1734
'shutdown' discovered that it is possible to access an
internal function object which could then be used to run
arbitrary JavaScript code with full permissions of the
user running the browser, which could be used to install
spyware or viruses. [MFSA-2006-15]
- CVE-2006-1735
It is possible to create JavaScript functions that would
get compiled with the wrong privileges, allowing an
attacker to run code of their choice with full
permissions of the user running the browser, which could
be used to install spyware or viruses. [MFSA-2006-14]
- CVE-2006-1736
It is possible to trick users into downloading and
saving an executable file via an image that is overlaid
by a transparent image link that points to the
executable. [MFSA-2006-13]
- CVE-2006-1737
An integer overflow allows remote attackers to cause a
denial of service and possibly execute arbitrary
bytecode via JavaScript with a large regular expression.
[MFSA-2006-11]
- CVE-2006-1738
An unspecified vulnerability allows remote attackers to
cause a denial of service. [MFSA-2006-11]
- CVE-2006-1739
Certain Cascading Style Sheets (CSS) can cause an
out-of-bounds array write and buffer overflow that could
lead to a denial of service and the possible execution
of arbitrary code. [MFSA-2006-11]
- CVE-2006-1740
It is possible for remote attackers to spoof secure site
indicators such as the locked icon by opening the
trusted site in a popup window, then changing the
location to a malicious site. [MFSA-2006-12]
- CVE-2006-1741
'shutdown' discovered that it is possible to inject
arbitrary JavaScript code into a page on another site
using a modal alert to suspend an event handler while a
new page is being loaded. This could be used to steal
confidential information. [MFSA-2006-09]
- CVE-2006-1742
Igor Bukanov discovered that the JavaScript engine does
not properly handle temporary variables, which might
allow remote attackers to trigger operations on freed
memory and cause memory corruption. [MFSA-2006-10]
- CVE-2006-1790
A regression fix that could lead to memory corruption
allows remote attackers to cause a denial of service and
possibly execute arbitrary code. [MFSA-2006-11] | last seen | 2019-01-16 | modified | 2018-07-20 | plugin id | 22593 | published | 2006-10-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22593 | title | Debian DSA-1051-1 : mozilla-thunderbird - several vulnerabilities |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS10_X86_119116.NASL | description | Mozilla 1.7_x86 patch.
Date this patch was last updated by Sun : Aug/05/09
This plugin has been deprecated and either replaced with individual
119116 patch-revision plugins, or deemed non-security related. | last seen | 2019-01-16 | modified | 2018-07-30 | plugin id | 22987 | published | 2006-11-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22987 | title | Solaris 10 (x86) : 119116-35 (deprecated) |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS10_119115.NASL | description | Mozilla 1.7 patch.
Date this patch was last updated by Sun : Sep/13/14
This plugin has been deprecated and either replaced with individual
119115 patch-revision plugins, or deemed non-security related. | last seen | 2019-01-16 | modified | 2018-07-30 | plugin id | 22954 | published | 2006-11-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22954 | title | Solaris 10 (sparc) : 119115-36 (deprecated) |
NASL family | Debian Local Security Checks | NASL id | DEBIAN_DSA-1046.NASL | description | Several security related problems have been discovered in Mozilla. The
Common Vulnerabilities and Exposures project identifies the following
vulnerabilities :
- CVE-2005-2353
The 'run-mozilla.sh' script allows local users to create
or overwrite arbitrary files when debugging is enabled
via a symlink attack on temporary files.
- CVE-2005-4134
Web pages with extremely long titles cause subsequent
launches of the browser to appear to 'hang' for up to a
few minutes, or even crash if the computer has
insufficient memory. [MFSA-2006-03]
- CVE-2006-0292
The JavaScript interpreter does not properly dereference
objects, which allows remote attackers to cause a denial
of service or execute arbitrary code. [MFSA-2006-01]
- CVE-2006-0293
The function allocation code allows attackers to cause a
denial of service and possibly execute arbitrary code.
[MFSA-2006-01]
- CVE-2006-0296
XULDocument.persist() did not validate the attribute
name, allowing an attacker to inject arbitrary XML and
JavaScript code into localstore.rdf that would be read
and acted upon during startup. [MFSA-2006-05]
- CVE-2006-0748
An anonymous researcher for TippingPoint and the Zero
Day Initiative reported that an invalid and nonsensical
ordering of table-related tags can be exploited to
execute arbitrary code. [MFSA-2006-27]
- CVE-2006-0749
A particular sequence of HTML tags can cause memory
corruption that can be exploited to execute arbitrary
code. [MFSA-2006-18]
- CVE-2006-0884
Georgi Guninski reports that forwarding mail in-line
while using the default HTML 'rich mail' editor will
execute JavaScript embedded in the e-mail message with
full privileges of the client. [MFSA-2006-21]
- CVE-2006-1045
The HTML rendering engine does not properly block
external images from inline HTML attachments when 'Block
loading of remote images in mail messages' is enabled,
which could allow remote attackers to obtain sensitive
information. [MFSA-2006-26]
- CVE-2006-1529
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1530
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1531
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1723
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1724
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1725
Due to an interaction between XUL content windows and
the history mechanism, some windows may to become
translucent, which might allow remote attackers to
execute arbitrary code. [MFSA-2006-29]
- CVE-2006-1726
'shutdown' discovered that the security check of the
function js_ValueToFunctionObject() can be circumvented
and exploited to allow the installation of malware.
[MFSA-2006-28]
- CVE-2006-1727
Georgi Guninski reported two variants of using scripts
in an XBL control to gain chrome privileges when the
page is viewed under 'Print Preview'. [MFSA-2006-25]
- CVE-2006-1728
'shutdown' discovered that the
crypto.generateCRMFRequest method can be used to run
arbitrary code with the privilege of the user running
the browser, which could enable an attacker to install
malware. [MFSA-2006-24]
- CVE-2006-1729
Claus Jorgensen reported that a text input box can be
pre-filled with a filename and then turned into a
file-upload control, allowing a malicious website to
steal any local file whose name they can guess.
[MFSA-2006-23]
- CVE-2006-1730
An anonymous researcher for TippingPoint and the Zero
Day Initiative discovered an integer overflow triggered
by the CSS letter-spacing property, which could be
exploited to execute arbitrary code. [MFSA-2006-22]
- CVE-2006-1731
'moz_bug_r_a4' discovered that some internal functions
return prototypes instead of objects, which allows
remote attackers to conduct cross-site scripting
attacks. [MFSA-2006-19]
- CVE-2006-1732
'shutdown' discovered that it is possible to bypass
same-origin protections, allowing a malicious site to
inject script into content from another site, which
could allow the malicious page to steal information such
as cookies or passwords from the other site, or perform
transactions on the user's behalf if the user were
already logged in. [MFSA-2006-17]
- CVE-2006-1733
'moz_bug_r_a4' discovered that the compilation scope of
privileged built-in XBL bindings is not fully protected
from web content and can still be executed which could
be used to execute arbitrary JavaScript, which could
allow an attacker to install malware such as viruses and
password sniffers. [MFSA-2006-16]
- CVE-2006-1734
'shutdown' discovered that it is possible to access an
internal function object which could then be used to run
arbitrary JavaScript code with full permissions of the
user running the browser, which could be used to install
spyware or viruses. [MFSA-2006-15]
- CVE-2006-1735
It is possible to create JavaScript functions that would
get compiled with the wrong privileges, allowing an
attacker to run code of their choice with full
permissions of the user running the browser, which could
be used to install spyware or viruses. [MFSA-2006-14]
- CVE-2006-1736
It is possible to trick users into downloading and
saving an executable file via an image that is overlaid
by a transparent image link that points to the
executable. [MFSA-2006-13]
- CVE-2006-1737
An integer overflow allows remote attackers to cause a
denial of service and possibly execute arbitrary
bytecode via JavaScript with a large regular expression.
[MFSA-2006-11]
- CVE-2006-1738
An unspecified vulnerability allows remote attackers to
cause a denial of service. [MFSA-2006-11]
- CVE-2006-1739
Certain Cascading Style Sheets (CSS) can cause an
out-of-bounds array write and buffer overflow that could
lead to a denial of service and the possible execution
of arbitrary code. [MFSA-2006-11]
- CVE-2006-1740
It is possible for remote attackers to spoof secure site
indicators such as the locked icon by opening the
trusted site in a popup window, then changing the
location to a malicious site. [MFSA-2006-12]
- CVE-2006-1741
'shutdown' discovered that it is possible to inject
arbitrary JavaScript code into a page on another site
using a modal alert to suspend an event handler while a
new page is being loaded. This could be used to steal
confidential information. [MFSA-2006-09]
- CVE-2006-1742
Igor Bukanov discovered that the JavaScript engine does
not properly handle temporary variables, which might
allow remote attackers to trigger operations on freed
memory and cause memory corruption. [MFSA-2006-10]
- CVE-2006-1790
A regression fix that could lead to memory corruption
allows remote attackers to cause a denial of service and
possibly execute arbitrary code. [MFSA-2006-11] | last seen | 2019-01-16 | modified | 2018-07-20 | plugin id | 22588 | published | 2006-10-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22588 | title | Debian DSA-1046-1 : mozilla - several vulnerabilities |
NASL family | Windows | NASL id | SEAMONKEY_101.NASL | description | The remote Windows host is using SeaMonkey, an alternative web browser
and application suite.
The installed version of SeaMonkey contains various security issues,
some of which may lead to execution of arbitrary code on the affected
host subject to the user's privileges. | last seen | 2019-01-16 | modified | 2018-07-27 | plugin id | 21226 | published | 2006-04-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21226 | title | SeaMonkey < 1.0.1 Multiple Vulnerabilities |
NASL family | Red Hat Local Security Checks | NASL id | REDHAT-RHSA-2006-0328.NASL | description | Updated firefox packages that fix several security bugs are now
available.
This update has been rated as having critical security impact by the
Red Hat Security Response Team.
[Updated 24 Apr 2006] The erratum text has been updated to include
CVE-2006-0748, an issue fixed by these erratum packages but which was
not public at the time of release. No changes have been made to the
packages.
Mozilla Firefox is an open source Web browser.
Several bugs were found in the way Firefox processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Firefox processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Firefox processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Firefox.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730,
CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Firefox displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Firefox allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
Users of Firefox are advised to upgrade to these updated packages
containing Firefox version 1.0.8 which corrects these issues. | last seen | 2019-01-16 | modified | 2018-12-20 | plugin id | 21232 | published | 2006-04-17 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21232 | title | RHEL 4 : firefox (RHSA-2006:0328) |
NASL family | Mandriva Local Security Checks | NASL id | MANDRAKE_MDKSA-2006-075.NASL | description | A number of vulnerabilities have been discovered in the Mozilla
Firefox browser that could allow a remote attacker to craft malicious
web pages that could take advantage of these issues to execute
arbitrary code with elevated privileges, spoof content, and steal
local files, cookies, or other information from web pages. As well,
some of these vulnerabilities can be exploited to execute arbitrary
code with the privileges of the user running the browser.
As well, two crasher bugs have been fixed as well.
The updated packages have been patched to fix these problems. | last seen | 2019-01-16 | modified | 2018-07-19 | plugin id | 21282 | published | 2006-04-26 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21282 | title | Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:075) |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS9_120671.NASL | description | Mozilla 1.7 for Solaris 8 and 9.
Date this patch was last updated by Sun : Aug/29/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 24403 | published | 2007-02-18 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=24403 | title | Solaris 9 (sparc) : 120671-08 |
NASL family | FreeBSD Local Security Checks | NASL id | FREEBSD_PKG_84630F4ACD8C11DAB7B9000C6EC775D9.NASL | description | A Mozilla Foundation Security Advisory reports of multiple issues.
Several of which can be used to run arbitrary code with the privilege
of the user running the program.
- MFSA 2006-29 Spoofing with translucent windows
- MFSA 2006-28 Security check of js_ValueToFunctionObject() can be
circumvented
- MFSA 2006-26 Mail Multiple Information Disclosure
- MFSA 2006-25 Privilege escalation through Print Preview
- MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
- MFSA 2006-23 File stealing by changing input type
- MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
- MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)
- MFSA 2006-19 Cross-site scripting using .valueOf.call()
- MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
- MFSA 2006-17 cross-site scripting through window.controllers
- MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
- MFSA 2006-15 Privilege escalation using a JavaScript function's
cloned parent
- MFSA 2006-14 Privilege escalation via XBL.method.eval
- MFSA 2006-13 Downloading executables with 'Save Image As...'
- MFSA 2006-12 Secure-site spoof (requires security warning dialog)
- MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
- MFSA 2006-10 JavaScript garbage-collection hazard audit
- MFSA 2006-09 Cross-site JavaScript injection using event handlers | last seen | 2019-01-16 | modified | 2018-12-19 | plugin id | 21461 | published | 2006-05-13 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21461 | title | FreeBSD : mozilla -- multiple vulnerabilities (84630f4a-cd8c-11da-b7b9-000c6ec775d9) |
NASL family | Windows | NASL id | SEAMONKEY_10.NASL | description | The remote Windows host is using SeaMonkey, an alternative web browser
and application suite.
The installed version of SeaMonkey contains various security issues,
some of which can be exploited to execute arbitrary code on the
affected host subject to the user's privileges. | last seen | 2019-01-16 | modified | 2018-07-27 | plugin id | 20863 | published | 2006-02-05 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=20863 | title | SeaMonkey < 1.0 Multiple Vulnerabilities |
NASL family | Red Hat Local Security Checks | NASL id | REDHAT-RHSA-2006-0329.NASL | description | Updated mozilla packages that fix several security bugs are now
available.
This update has been rated as having critical security impact by the
Red Hat Security Response Team.
[Updated 24 Apr 2006] The erratum text has been updated to include the
details of additional issues that were fixed by these erratum packages
but which were not public at the time of release. No changes have been
made to the packages.
Mozilla is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.
Several bugs were found in the way Mozilla processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Mozilla processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Mozilla processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Mozilla.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1730, CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Mozilla displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Mozilla allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
A bug was found in the way Mozilla executes in-line mail forwarding.
If a user can be tricked into forwarding a maliciously crafted mail
message as in-line content, it is possible for the message to execute
JavaScript with the permissions of 'chrome'. (CVE-2006-0884)
Users of Mozilla are advised to upgrade to these updated packages
containing Mozilla version 1.7.13 which corrects these issues. | last seen | 2019-01-16 | modified | 2018-12-20 | plugin id | 21257 | published | 2006-04-21 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21257 | title | RHEL 2.1 / 3 / 4 : mozilla (RHSA-2006:0329) |
NASL family | Ubuntu Local Security Checks | NASL id | UBUNTU_USN-275-1.NASL | description | Web pages with extremely long titles caused subsequent launches of
Mozilla browser to hang for up to a few minutes, or caused Mozilla to
crash on computers with insufficient memory. (CVE-2005-4134)
Igor Bukanov discovered that the JavaScript engine did not properly
declare some temporary variables. Under some rare circumstances, a
malicious website could exploit this to execute arbitrary code with
the privileges of the user. (CVE-2006-0292, CVE-2006-1742)
The function XULDocument.persist() did not sufficiently validate the
names of attributes. An attacker could exploit this to inject
arbitrary XML code into the file 'localstore.rdf', which is read and
evaluated at startup. This could include JavaScript commands that
would be run with the user's privileges. (CVE-2006-0296)
Due to a flaw in the HTML tag parser a specific sequence of HTML tags
caused memory corruption. A malicious website could exploit this to
crash the browser or even execute arbitrary code with the user's
privileges. (CVE-2006-0748)
An invalid ordering of table-related tags caused Mozilla to use a
negative array index. A malicious website could exploit this to
execute arbitrary code with the privileges of the user.
(CVE-2006-0749)
Georgi Guninski discovered that embedded XBL scripts of websites could
escalate their (normally reduced) privileges to get full privileges of
the user if that page is viewed with 'Print Preview'. (CVE-2006-1727)
The crypto.generateCRMFRequest() function had a flaw which could be
exploited to run arbitrary code with the user's privileges.
(CVE-2006-1728)
Claus Jorgensen and Jesse Ruderman discovered that a text input box
could be pre-filled with a filename and then turned into a file-upload
control with the contents intact. A malicious website could exploit
this to read any local file the user has read privileges for.
(CVE-2006-1729)
An integer overflow was detected in the handling of the CSS property
'letter-spacing'. A malicious website could exploit this to run
arbitrary code with the user's privileges. (CVE-2006-1730)
The methods valueOf.call() and .valueOf.apply() returned an object
whose privileges were not properly confined to those of the caller,
which made them vulnerable to cross-site scripting attacks. A
malicious website could exploit this to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-1731) The window.controllers array variable (CVE-2006-1732)
and event handlers (CVE-2006-1741) were vulnerable to a similar
attack.
The privileged built-in XBL bindings were not fully protected from web
content and could be accessed by calling valueOf.call() and
valueOf.apply() on a method of that binding. A malicious website could
exploit this to run arbitrary JavaScript code with the user's
privileges. (CVE-2006-1733)
It was possible to use the Object.watch() method to access an internal
function object (the 'clone parent'). A malicious website could
exploit this to execute arbitrary JavaScript code with the user's
privileges. (CVE-2006-1734)
By calling the XBL.method.eval() method in a special way it was
possible to create JavaScript functions that would get compiled with
the wrong privileges. A malicious website could exploit this to
execute arbitrary JavaScript code with the user's privileges.
(CVE-2006-1735)
Michael Krax discovered that by layering a transparent image link to
an executable on top of a visible (and presumably desirable) image a
malicious site could fool the user to right-click and choose 'Save
image as...' from the context menu, which would download the
executable instead of the image. (CVE-2006-1736)
Several crashes have been fixed which could be triggered by websites
and involve memory corruption. These could potentially be exploited to
execute arbitrary code with the user's privileges. (CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
If the user has turned on the 'Entering secure site' modal warning
dialog, it was possible to spoof the browser's secure-site indicators
(the lock icon and the gold URL field background) by first loading the
target secure site in a pop-up window, then changing its location to a
different site, which retained the displayed secure-browsing
indicators from the original site. (CVE-2006-1740).
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues. | last seen | 2019-01-16 | modified | 2018-08-15 | plugin id | 21301 | published | 2006-04-28 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21301 | title | Ubuntu 4.10 / 5.04 / 5.10 : mozilla vulnerabilities (USN-275-1) |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS8_X86_120672.NASL | description | Mozilla 1.7_x86 for Solaris 8 and 9.
Date this patch was last updated by Sun : Sep/02/08 | last seen | 2018-09-02 | modified | 2016-12-09 | plugin id | 23772 | published | 2006-12-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=23772 | title | Solaris 8 (x86) : 120672-08 |
NASL family | Fedora Local Security Checks | NASL id | FEDORA_2006-410.NASL | description | Several bugs were found in the way Firefox processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Firefox processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Firefox processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Firefox.
(CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Firefox displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Firefox allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues. | last seen | 2019-01-16 | modified | 2018-07-19 | plugin id | 21250 | published | 2006-04-21 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21250 | title | Fedora Core 4 : firefox-1.0.8-1.1.fc4 (2006-410) |
NASL family | CentOS Local Security Checks | NASL id | CENTOS_RHSA-2006-0329.NASL | description | Updated mozilla packages that fix several security bugs are now
available.
This update has been rated as having critical security impact by the
Red Hat Security Response Team.
[Updated 24 Apr 2006] The erratum text has been updated to include the
details of additional issues that were fixed by these erratum packages
but which were not public at the time of release. No changes have been
made to the packages.
Mozilla is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.
Several bugs were found in the way Mozilla processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Mozilla processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Mozilla processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Mozilla.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1730, CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Mozilla displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Mozilla allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
A bug was found in the way Mozilla executes in-line mail forwarding.
If a user can be tricked into forwarding a maliciously crafted mail
message as in-line content, it is possible for the message to execute
JavaScript with the permissions of 'chrome'. (CVE-2006-0884)
Users of Mozilla are advised to upgrade to these updated packages
containing Mozilla version 1.7.13 which corrects these issues. | last seen | 2019-01-16 | modified | 2018-11-10 | plugin id | 21898 | published | 2006-07-03 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21898 | title | CentOS 3 / 4 : mozilla (CESA-2006:0329) |
NASL family | Debian Local Security Checks | NASL id | DEBIAN_DSA-1044.NASL | description | Several security related problems have been discovered in Mozilla
Firefox. The Common Vulnerabilities and Exposures project identifies
the following vulnerabilities :
- CVE-2005-4134
Web pages with extremely long titles cause subsequent
launches of the browser to appear to 'hang' for up to a
few minutes, or even crash if the computer has
insufficient memory. [MFSA-2006-03]
- CVE-2006-0292
The JavaScript interpreter does not properly dereference
objects, which allows remote attackers to cause a denial
of service or execute arbitrary code. [MFSA-2006-01]
- CVE-2006-0293
The function allocation code allows attackers to cause a
denial of service and possibly execute arbitrary code.
[MFSA-2006-01]
- CVE-2006-0296
XULDocument.persist() did not validate the attribute
name, allowing an attacker to inject arbitrary XML and
JavaScript code into localstore.rdf that would be read
and acted upon during startup. [MFSA-2006-05]
- CVE-2006-0748
An anonymous researcher for TippingPoint and the Zero
Day Initiative reported that an invalid and nonsensical
ordering of table-related tags can be exploited to
execute arbitrary code. [MFSA-2006-27]
- CVE-2006-0749
A particular sequence of HTML tags can cause memory
corruption that can be exploited to execute arbitrary
code. [MFSA-2006-18]
- CVE-2006-1727
Georgi Guninski reported two variants of using scripts
in an XBL control to gain chrome privileges when the
page is viewed under 'Print Preview'. [MFSA-2006-25]
- CVE-2006-1728
'shutdown' discovered that the
crypto.generateCRMFRequest method can be used to run
arbitrary code with the privilege of the user running
the browser, which could enable an attacker to install
malware. [MFSA-2006-24]
- CVE-2006-1729
Claus Jorgensen reported that a text input box can be
pre-filled with a filename and then turned into a
file-upload control, allowing a malicious website to
steal any local file whose name they can guess.
[MFSA-2006-23]
- CVE-2006-1730
An anonymous researcher for TippingPoint and the Zero
Day Initiative discovered an integer overflow triggered
by the CSS letter-spacing property, which could be
exploited to execute arbitrary code. [MFSA-2006-22]
- CVE-2006-1731
'moz_bug_r_a4' discovered that some internal functions
return prototypes instead of objects, which allows
remote attackers to conduct cross-site scripting
attacks. [MFSA-2006-19]
- CVE-2006-1732
'shutdown' discovered that it is possible to bypass
same-origin protections, allowing a malicious site to
inject script into content from another site, which
could allow the malicious page to steal information such
as cookies or passwords from the other site, or perform
transactions on the user's behalf if the user were
already logged in. [MFSA-2006-17]
- CVE-2006-1733
'moz_bug_r_a4' discovered that the compilation scope of
privileged built-in XBL bindings is not fully protected
from web content and can still be executed which could
be used to execute arbitrary JavaScript, which could
allow an attacker to install malware such as viruses and
password sniffers. [MFSA-2006-16]
- CVE-2006-1734
'shutdown' discovered that it is possible to access an
internal function object which could then be used to run
arbitrary JavaScript code with full permissions of the
user running the browser, which could be used to install
spyware or viruses. [MFSA-2006-15]
- CVE-2006-1735
It is possible to create JavaScript functions that would
get compiled with the wrong privileges, allowing an
attacker to run code of their choice with full
permissions of the user running the browser, which could
be used to install spyware or viruses. [MFSA-2006-14]
- CVE-2006-1736
It is possible to trick users into downloading and
saving an executable file via an image that is overlaid
by a transparent image link that points to the
executable. [MFSA-2006-13]
- CVE-2006-1737
An integer overflow allows remote attackers to cause a
denial of service and possibly execute arbitrary
bytecode via JavaScript with a large regular expression.
[MFSA-2006-11]
- CVE-2006-1738
An unspecified vulnerability allows remote attackers to
cause a denial of service. [MFSA-2006-11]
- CVE-2006-1739
Certain Cascading Style Sheets (CSS) can cause an
out-of-bounds array write and buffer overflow that could
lead to a denial of service and the possible execution
of arbitrary code. [MFSA-2006-11]
- CVE-2006-1740
It is possible for remote attackers to spoof secure site
indicators such as the locked icon by opening the
trusted site in a popup window, then changing the
location to a malicious site. [MFSA-2006-12]
- CVE-2006-1741
'shutdown' discovered that it is possible to inject
arbitrary JavaScript code into a page on another site
using a modal alert to suspend an event handler while a
new page is being loaded. This could be used to steal
confidential information. [MFSA-2006-09]
- CVE-2006-1742
Igor Bukanov discovered that the JavaScript engine does
not properly handle temporary variables, which might
allow remote attackers to trigger operations on freed
memory and cause memory corruption. [MFSA-2006-10]
- CVE-2006-1790
A regression fix that could lead to memory corruption
allows remote attackers to cause a denial of service and
possibly execute arbitrary code. [MFSA-2006-11] | last seen | 2019-01-16 | modified | 2018-07-20 | plugin id | 22586 | published | 2006-10-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22586 | title | Debian DSA-1044-1 : mozilla-firefox - several vulnerabilities |
NASL family | Windows | NASL id | MOZILLA_FIREFOX_108.NASL | description | The installed version of Firefox contains various security issues,
some of which may lead to execution of arbitrary code on the affected
host subject to the user's privileges. | last seen | 2019-01-16 | modified | 2018-07-16 | plugin id | 29744 | published | 2007-12-21 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=29744 | title | Firefox < 1.0.8 Multiple Vulnerabilities |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS9_X86_120672.NASL | description | Mozilla 1.7_x86 for Solaris 8 and 9.
Date this patch was last updated by Sun : Sep/02/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 23773 | published | 2006-12-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=23773 | title | Solaris 9 (x86) : 120672-08 |
NASL family | Fedora Local Security Checks | NASL id | FEDORA_2006-411.NASL | description | Several bugs were found in the way Firefox processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Firefox processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Firefox processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Firefox.
(CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737,
CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Firefox displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Firefox allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues. | last seen | 2019-01-16 | modified | 2018-07-19 | plugin id | 21251 | published | 2006-04-21 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21251 | title | Fedora Core 5 : firefox-1.5.0.2-1.1.fc5 (2006-411) |
NASL family | Gentoo Local Security Checks | NASL id | GENTOO_GLSA-200604-18.NASL | description | The remote host is affected by the vulnerability described in GLSA-200604-18
(Mozilla Suite: Multiple vulnerabilities)
Several vulnerabilities were found in Mozilla Suite. Version
1.7.13 was released to fix them.
Impact :
A remote attacker could craft malicious web pages or emails that
would leverage these issues to inject and execute arbitrary script code
with elevated privileges, steal local files, cookies or other
information from web pages or emails, and spoof content. Some of these
vulnerabilities might even be exploited to execute arbitrary code with
the rights of the user running the client.
Workaround :
There are no known workarounds for all the issues at this time. | last seen | 2019-01-16 | modified | 2018-08-10 | plugin id | 21315 | published | 2006-05-03 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21315 | title | GLSA-200604-18 : Mozilla Suite: Multiple vulnerabilities |
NASL family | Gentoo Local Security Checks | NASL id | GENTOO_GLSA-200604-12.NASL | description | The remote host is affected by the vulnerability described in GLSA-200604-12
(Mozilla Firefox: Multiple vulnerabilities)
Several vulnerabilities were found in Mozilla Firefox. Versions
1.0.8 and 1.5.0.2 were released to fix them.
Impact :
A remote attacker could craft malicious web pages that would
leverage these issues to inject and execute arbitrary script code with
elevated privileges, steal local files, cookies or other information
from web pages, and spoof content. Some of these vulnerabilities might
even be exploited to execute arbitrary code with the rights of the
browser user.
Workaround :
There are no known workarounds for all the issues at this time. | last seen | 2019-01-16 | modified | 2018-08-10 | plugin id | 21277 | published | 2006-04-26 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21277 | title | GLSA-200604-12 : Mozilla Firefox: Multiple vulnerabilities |
NASL family | CentOS Local Security Checks | NASL id | CENTOS_RHSA-2006-0328.NASL | description | Updated firefox packages that fix several security bugs are now
available.
This update has been rated as having critical security impact by the
Red Hat Security Response Team.
[Updated 24 Apr 2006] The erratum text has been updated to include
CVE-2006-0748, an issue fixed by these erratum packages but which was
not public at the time of release. No changes have been made to the
packages.
Mozilla Firefox is an open source Web browser.
Several bugs were found in the way Firefox processes malformed
JavaScript. A malicious web page could modify the content of a
different open web page, possibly stealing sensitive information or
conducting a cross-site scripting attack. (CVE-2006-1731,
CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Firefox processes certain
JavaScript actions. A malicious web page could execute arbitrary
JavaScript instructions with the permissions of 'chrome', allowing the
page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734,
CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Firefox processes malformed web
pages. A carefully crafted malicious web page could cause the
execution of arbitrary code as the user running Firefox.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730,
CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Firefox displays the secure site icon. If a
browser is configured to display the non-default secure site modal
warning dialog, it may be possible to trick a user into believing they
are viewing a secure site. (CVE-2006-1740)
A bug was found in the way Firefox allows JavaScript mutation events
on 'input' form elements. A malicious web page could be created in
such a way that when a user submits a form, an arbitrary file could be
uploaded to the attacker. (CVE-2006-1729)
Users of Firefox are advised to upgrade to these updated packages
containing Firefox version 1.0.8 which corrects these issues. | last seen | 2019-01-16 | modified | 2018-11-10 | plugin id | 21993 | published | 2006-07-05 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21993 | title | CentOS 4 : firefox (CESA-2006:0328) |
|