ID CVE-2006-1790
Summary A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
References
Vulnerable Configurations
  • Mozilla Firefox 1.0.7
    cpe:2.3:a:mozilla:firefox:1.0.7
CVSS
Base: 10.0 (as of 17-04-2006 - 09:07)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_119115.NASL
    description Mozilla 1.7 patch. Date this patch was last updated by Sun : Sep/13/14 This plugin has been deprecated and either replaced with individual 119115 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22954
    published 2006-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22954
    title Solaris 10 (sparc) : 119115-36 (deprecated)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-078.NASL
    description A number of vulnerabilities have been discovered in the Mozilla Thunderbird email client that could allow a remote attacker to craft malicious web emails that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, or other information. As well, some of these vulnerabilities can be exploited to execute arbitrary code with the privileges of the user running the program. As well, two crasher bugs have been fixed as well. The updated packages have been patched to fix these problems.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 21284
    published 2006-04-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21284
    title Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:078)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1051.NASL
    description Several security related problems have been discovered in Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-2353 The 'run-mozilla.sh' script allows local users to create or overwrite arbitrary files when debugging is enabled via a symlink attack on temporary files. - CVE-2005-4134 Web pages with extremely long titles cause subsequent launches of the browser to appear to 'hang' for up to a few minutes, or even crash if the computer has insufficient memory. [MFSA-2006-03] - CVE-2006-0292 The JavaScript interpreter does not properly dereference objects, which allows remote attackers to cause a denial of service or execute arbitrary code. [MFSA-2006-01] - CVE-2006-0293 The function allocation code allows attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-01] - CVE-2006-0296 XULDocument.persist() did not validate the attribute name, allowing an attacker to inject arbitrary XML and JavaScript code into localstore.rdf that would be read and acted upon during startup. [MFSA-2006-05] - CVE-2006-0748 An anonymous researcher for TippingPoint and the Zero Day Initiative reported that an invalid and nonsensical ordering of table-related tags can be exploited to execute arbitrary code. [MFSA-2006-27] - CVE-2006-0749 A particular sequence of HTML tags can cause memory corruption that can be exploited to execute arbitrary code. [MFSA-2006-18] - CVE-2006-0884 Georgi Guninski reports that forwarding mail in-line while using the default HTML 'rich mail' editor will execute JavaScript embedded in the e-mail message with full privileges of the client. [MFSA-2006-21] - CVE-2006-1045 The HTML rendering engine does not properly block external images from inline HTML attachments when 'Block loading of remote images in mail messages' is enabled, which could allow remote attackers to obtain sensitive information. [MFSA-2006-26] - CVE-2006-1529 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1530 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1531 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1723 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1724 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1727 Georgi Guninski reported two variants of using scripts in an XBL control to gain chrome privileges when the page is viewed under 'Print Preview'. [MFSA-2006-25] - CVE-2006-1728 'shutdown' discovered that the crypto.generateCRMFRequest method can be used to run arbitrary code with the privilege of the user running the browser, which could enable an attacker to install malware. [MFSA-2006-24] - CVE-2006-1729 Claus Jorgensen reported that a text input box can be pre-filled with a filename and then turned into a file-upload control, allowing a malicious website to steal any local file whose name they can guess. [MFSA-2006-23] - CVE-2006-1730 An anonymous researcher for TippingPoint and the Zero Day Initiative discovered an integer overflow triggered by the CSS letter-spacing property, which could be exploited to execute arbitrary code. [MFSA-2006-22] - CVE-2006-1731 'moz_bug_r_a4' discovered that some internal functions return prototypes instead of objects, which allows remote attackers to conduct cross-site scripting attacks. [MFSA-2006-19] - CVE-2006-1732 'shutdown' discovered that it is possible to bypass same-origin protections, allowing a malicious site to inject script into content from another site, which could allow the malicious page to steal information such as cookies or passwords from the other site, or perform transactions on the user's behalf if the user were already logged in. [MFSA-2006-17] - CVE-2006-1733 'moz_bug_r_a4' discovered that the compilation scope of privileged built-in XBL bindings is not fully protected from web content and can still be executed which could be used to execute arbitrary JavaScript, which could allow an attacker to install malware such as viruses and password sniffers. [MFSA-2006-16] - CVE-2006-1734 'shutdown' discovered that it is possible to access an internal function object which could then be used to run arbitrary JavaScript code with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-15] - CVE-2006-1735 It is possible to create JavaScript functions that would get compiled with the wrong privileges, allowing an attacker to run code of their choice with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-14] - CVE-2006-1736 It is possible to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable. [MFSA-2006-13] - CVE-2006-1737 An integer overflow allows remote attackers to cause a denial of service and possibly execute arbitrary bytecode via JavaScript with a large regular expression. [MFSA-2006-11] - CVE-2006-1738 An unspecified vulnerability allows remote attackers to cause a denial of service. [MFSA-2006-11] - CVE-2006-1739 Certain Cascading Style Sheets (CSS) can cause an out-of-bounds array write and buffer overflow that could lead to a denial of service and the possible execution of arbitrary code. [MFSA-2006-11] - CVE-2006-1740 It is possible for remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site. [MFSA-2006-12] - CVE-2006-1741 'shutdown' discovered that it is possible to inject arbitrary JavaScript code into a page on another site using a modal alert to suspend an event handler while a new page is being loaded. This could be used to steal confidential information. [MFSA-2006-09] - CVE-2006-1742 Igor Bukanov discovered that the JavaScript engine does not properly handle temporary variables, which might allow remote attackers to trigger operations on freed memory and cause memory corruption. [MFSA-2006-10] - CVE-2006-1790 A regression fix that could lead to memory corruption allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-11]
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 22593
    published 2006-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22593
    title Debian DSA-1051-1 : mozilla-thunderbird - several vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2006-411.NASL
    description Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox. (CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 21251
    published 2006-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21251
    title Fedora Core 5 : firefox-1.5.0.2-1.1.fc5 (2006-411)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2006-0328.NASL
    description Updated firefox packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include CVE-2006-0748, an issue fixed by these erratum packages but which was not public at the time of release. No changes have been made to the packages. Mozilla Firefox is an open source Web browser. Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) Users of Firefox are advised to upgrade to these updated packages containing Firefox version 1.0.8 which corrects these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 21993
    published 2006-07-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21993
    title CentOS 4 : firefox (CESA-2006:0328)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_X86_120672.NASL
    description Mozilla 1.7_x86 for Solaris 8 and 9. Date this patch was last updated by Sun : Sep/02/08
    last seen 2018-09-02
    modified 2016-12-09
    plugin id 23772
    published 2006-12-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=23772
    title Solaris 8 (x86) : 120672-08
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_120671.NASL
    description Mozilla 1.7 for Solaris 8 and 9. Date this patch was last updated by Sun : Aug/29/08
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 24403
    published 2007-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24403
    title Solaris 9 (sparc) : 120671-08
  • NASL family Windows
    NASL id SEAMONKEY_101.NASL
    description The remote Windows host is using SeaMonkey, an alternative web browser and application suite. The installed version of SeaMonkey contains various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 21226
    published 2006-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21226
    title SeaMonkey < 1.0.1 Multiple Vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2006-0330.NASL
    description Updated thunderbird packages that fix various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages. Mozilla Thunderbird is a standalone mail and newsgroup client. Several bugs were found in the way Thunderbird processes malformed JavaScript. A malicious HTML mail message could modify the content of a different open HTML mail message, possibly stealing sensitive information or conducting a cross-site scripting attack. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Thunderbird processes certain JavaScript actions. A malicious HTML mail message could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-0292, CVE-2006-0296, CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Thunderbird processes malformed HTML mail messages. A carefully crafted malicious HTML mail message could cause the execution of arbitrary code as the user running Thunderbird. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Thunderbird processes certain inline content in HTML mail messages. It may be possible for a remote attacker to send a carefully crafted mail message to the victim, which will fetch remote content, even if Thunderbird is configured not to fetch remote content. (CVE-2006-1045) A bug was found in the way Thunderbird executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'. (CVE-2006-0884) Users of Thunderbird are advised to upgrade to these updated packages containing Thunderbird version 1.0.8, which is not vulnerable to these issues.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 21288
    published 2006-04-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21288
    title RHEL 4 : thunderbird (RHSA-2006:0330)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_84630F4ACD8C11DAB7B9000C6EC775D9.NASL
    description A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program. - MFSA 2006-29 Spoofing with translucent windows - MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented - MFSA 2006-26 Mail Multiple Information Disclosure - MFSA 2006-25 Privilege escalation through Print Preview - MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest - MFSA 2006-23 File stealing by changing input type - MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability - MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2) - MFSA 2006-19 Cross-site scripting using .valueOf.call() - MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability - MFSA 2006-17 cross-site scripting through window.controllers - MFSA 2006-16 Accessing XBL compilation scope via valueOf.call() - MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent - MFSA 2006-14 Privilege escalation via XBL.method.eval - MFSA 2006-13 Downloading executables with 'Save Image As...' - MFSA 2006-12 Secure-site spoof (requires security warning dialog) - MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8) - MFSA 2006-10 JavaScript garbage-collection hazard audit - MFSA 2006-09 Cross-site JavaScript injection using event handlers
    last seen 2019-02-21
    modified 2018-12-19
    plugin id 21461
    published 2006-05-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21461
    title FreeBSD : mozilla -- multiple vulnerabilities (84630f4a-cd8c-11da-b7b9-000c6ec775d9)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-276-1.NASL
    description Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious mail with embedded JavaScript could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file 'localstore.rdf', which is read and evaluated at startup. This could include JavaScript commands that would be run with the user's privileges. (CVE-2006-0296) Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious HTML email could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0748) An invalid ordering of table-related tags caused Thunderbird to use a negative array index. A malicious HTML email could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0749) Georgi Guninski discovered that forwarding mail in-line while using the default HTML 'rich mail' editor executed JavaScript embedded in the email message. Forwarding mail in-line is not the default setting but it is easily accessed through the 'Forward As' menu item. (CVE-2006-0884) As a privacy measure to prevent senders (primarily spammers) from tracking when email is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files. It was discovered that it was possible to bypass this restriction by indirectly including remote content through an intermediate inline CSS script or frame. (CVE-2006-1045) Georgi Guninski discovered that embedded XBL scripts could escalate their (normally reduced) privileges to get full privileges of the user if the email is viewed with 'Print Preview'. (CVE-2006-1727) The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges. (CVE-2006-1728) An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious HTML email could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730) The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious email with embedded JavaScript code could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages. (CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack. The privileged built-in XBL bindings were not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. A malicious email could exploit this to run arbitrary JavaScript code with the user's privileges. (CVE-2006-1733) It was possible to use the Object.watch() method to access an internal function object (the 'clone parent'). A malicious email containing JavaScript code could exploit this to execute arbitrary code with the user's privileges. (CVE-2006-1734) By calling the XBL.method.eval() method in a special way it was possible to create JavaScript functions that would get compiled with the wrong privileges. A malicious email could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1735) Several crashes have been fixed which could be triggered by specially crafted HTML content and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) The 'enigmail' plugin has been updated to work with the new Thunderbird and Mozilla versions. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-15
    plugin id 21321
    published 2006-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21321
    title Ubuntu 5.04 / 5.10 : mozilla-thunderbird vulnerabilities (USN-276-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2006-0328.NASL
    description Updated firefox packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include CVE-2006-0748, an issue fixed by these erratum packages but which was not public at the time of release. No changes have been made to the packages. Mozilla Firefox is an open source Web browser. Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) Users of Firefox are advised to upgrade to these updated packages containing Firefox version 1.0.8 which corrects these issues.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 21232
    published 2006-04-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21232
    title RHEL 4 : firefox (RHSA-2006:0328)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-075.NASL
    description A number of vulnerabilities have been discovered in the Mozilla Firefox browser that could allow a remote attacker to craft malicious web pages that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, cookies, or other information from web pages. As well, some of these vulnerabilities can be exploited to execute arbitrary code with the privileges of the user running the browser. As well, two crasher bugs have been fixed as well. The updated packages have been patched to fix these problems.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 21282
    published 2006-04-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21282
    title Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:075)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_119116.NASL
    description Mozilla 1.7_x86 patch. Date this patch was last updated by Sun : Aug/05/09 This plugin has been deprecated and either replaced with individual 119116 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22987
    published 2006-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22987
    title Solaris 10 (x86) : 119116-35 (deprecated)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1046.NASL
    description Several security related problems have been discovered in Mozilla. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-2353 The 'run-mozilla.sh' script allows local users to create or overwrite arbitrary files when debugging is enabled via a symlink attack on temporary files. - CVE-2005-4134 Web pages with extremely long titles cause subsequent launches of the browser to appear to 'hang' for up to a few minutes, or even crash if the computer has insufficient memory. [MFSA-2006-03] - CVE-2006-0292 The JavaScript interpreter does not properly dereference objects, which allows remote attackers to cause a denial of service or execute arbitrary code. [MFSA-2006-01] - CVE-2006-0293 The function allocation code allows attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-01] - CVE-2006-0296 XULDocument.persist() did not validate the attribute name, allowing an attacker to inject arbitrary XML and JavaScript code into localstore.rdf that would be read and acted upon during startup. [MFSA-2006-05] - CVE-2006-0748 An anonymous researcher for TippingPoint and the Zero Day Initiative reported that an invalid and nonsensical ordering of table-related tags can be exploited to execute arbitrary code. [MFSA-2006-27] - CVE-2006-0749 A particular sequence of HTML tags can cause memory corruption that can be exploited to execute arbitrary code. [MFSA-2006-18] - CVE-2006-0884 Georgi Guninski reports that forwarding mail in-line while using the default HTML 'rich mail' editor will execute JavaScript embedded in the e-mail message with full privileges of the client. [MFSA-2006-21] - CVE-2006-1045 The HTML rendering engine does not properly block external images from inline HTML attachments when 'Block loading of remote images in mail messages' is enabled, which could allow remote attackers to obtain sensitive information. [MFSA-2006-26] - CVE-2006-1529 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1530 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1531 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1723 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1724 A vulnerability potentially allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-20] - CVE-2006-1725 Due to an interaction between XUL content windows and the history mechanism, some windows may to become translucent, which might allow remote attackers to execute arbitrary code. [MFSA-2006-29] - CVE-2006-1726 'shutdown' discovered that the security check of the function js_ValueToFunctionObject() can be circumvented and exploited to allow the installation of malware. [MFSA-2006-28] - CVE-2006-1727 Georgi Guninski reported two variants of using scripts in an XBL control to gain chrome privileges when the page is viewed under 'Print Preview'. [MFSA-2006-25] - CVE-2006-1728 'shutdown' discovered that the crypto.generateCRMFRequest method can be used to run arbitrary code with the privilege of the user running the browser, which could enable an attacker to install malware. [MFSA-2006-24] - CVE-2006-1729 Claus Jorgensen reported that a text input box can be pre-filled with a filename and then turned into a file-upload control, allowing a malicious website to steal any local file whose name they can guess. [MFSA-2006-23] - CVE-2006-1730 An anonymous researcher for TippingPoint and the Zero Day Initiative discovered an integer overflow triggered by the CSS letter-spacing property, which could be exploited to execute arbitrary code. [MFSA-2006-22] - CVE-2006-1731 'moz_bug_r_a4' discovered that some internal functions return prototypes instead of objects, which allows remote attackers to conduct cross-site scripting attacks. [MFSA-2006-19] - CVE-2006-1732 'shutdown' discovered that it is possible to bypass same-origin protections, allowing a malicious site to inject script into content from another site, which could allow the malicious page to steal information such as cookies or passwords from the other site, or perform transactions on the user's behalf if the user were already logged in. [MFSA-2006-17] - CVE-2006-1733 'moz_bug_r_a4' discovered that the compilation scope of privileged built-in XBL bindings is not fully protected from web content and can still be executed which could be used to execute arbitrary JavaScript, which could allow an attacker to install malware such as viruses and password sniffers. [MFSA-2006-16] - CVE-2006-1734 'shutdown' discovered that it is possible to access an internal function object which could then be used to run arbitrary JavaScript code with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-15] - CVE-2006-1735 It is possible to create JavaScript functions that would get compiled with the wrong privileges, allowing an attacker to run code of their choice with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-14] - CVE-2006-1736 It is possible to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable. [MFSA-2006-13] - CVE-2006-1737 An integer overflow allows remote attackers to cause a denial of service and possibly execute arbitrary bytecode via JavaScript with a large regular expression. [MFSA-2006-11] - CVE-2006-1738 An unspecified vulnerability allows remote attackers to cause a denial of service. [MFSA-2006-11] - CVE-2006-1739 Certain Cascading Style Sheets (CSS) can cause an out-of-bounds array write and buffer overflow that could lead to a denial of service and the possible execution of arbitrary code. [MFSA-2006-11] - CVE-2006-1740 It is possible for remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site. [MFSA-2006-12] - CVE-2006-1741 'shutdown' discovered that it is possible to inject arbitrary JavaScript code into a page on another site using a modal alert to suspend an event handler while a new page is being loaded. This could be used to steal confidential information. [MFSA-2006-09] - CVE-2006-1742 Igor Bukanov discovered that the JavaScript engine does not properly handle temporary variables, which might allow remote attackers to trigger operations on freed memory and cause memory corruption. [MFSA-2006-10] - CVE-2006-1790 A regression fix that could lead to memory corruption allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-11]
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 22588
    published 2006-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22588
    title Debian DSA-1046-1 : mozilla - several vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200604-12.NASL
    description The remote host is affected by the vulnerability described in GLSA-200604-12 (Mozilla Firefox: Multiple vulnerabilities) Several vulnerabilities were found in Mozilla Firefox. Versions 1.0.8 and 1.5.0.2 were released to fix them. Impact : A remote attacker could craft malicious web pages that would leverage these issues to inject and execute arbitrary script code with elevated privileges, steal local files, cookies or other information from web pages, and spoof content. Some of these vulnerabilities might even be exploited to execute arbitrary code with the rights of the browser user. Workaround : There are no known workarounds for all the issues at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 21277
    published 2006-04-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21277
    title GLSA-200604-12 : Mozilla Firefox: Multiple vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-271-1.NASL
    description Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory. (CVE-2005-4134) Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file 'localstore.rdf', which is read and evaluated at startup. This could include JavaScript commands that would be run with the user's privileges. (CVE-2006-0296) Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious website could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0749) Georgi Guninski discovered that embedded XBL scripts of websites could escalate their (normally reduced) privileges to get full privileges of the user if that page is viewed with 'Print Preview'. (CVE-2006-1727) The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges. (CVE-2006-1728) Claus Jorgensen and Jesse Ruderman discovered that a text input box could be pre-filled with a filename and then turned into a file-upload control with the contents intact. A malicious website could exploit this to read any local file the user has read privileges for. (CVE-2006-1729) An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious website could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730) The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious website could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages. (CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack. The privileged built-in XBL bindings were not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. A malicious website could exploit this to run arbitrary JavaScript code with the user's privileges. (CVE-2006-1733) It was possible to use the Object.watch() method to access an internal function object (the 'clone parent'). A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1734) By calling the XBL.method.eval() method in a special way it was possible to create JavaScript functions that would get compiled with the wrong privileges. A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1735) Michael Krax discovered that by layering a transparent image link to an executable on top of a visible (and presumably desirable) image a malicious site could fool the user to right-click and choose 'Save image as...' from the context menu, which would download the executable instead of the image. (CVE-2006-1736) Several crashes have been fixed which could be triggered by websites and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) If the user has turned on the 'Entering secure site' modal warning dialog, it was possible to spoof the browser's secure-site indicators (the lock icon and the gold URL field background) by first loading the target secure site in a pop-up window, then changing its location to a different site, which retained the displayed secure-browsing indicators from the original site. (CVE-2006-1740). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-15
    plugin id 21270
    published 2006-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21270
    title Ubuntu 4.10 / 5.04 / 5.10 : mozilla-firefox, firefox vulnerabilities (USN-271-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2006-0330.NASL
    description Updated thunderbird packages that fix various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages. Mozilla Thunderbird is a standalone mail and newsgroup client. Several bugs were found in the way Thunderbird processes malformed JavaScript. A malicious HTML mail message could modify the content of a different open HTML mail message, possibly stealing sensitive information or conducting a cross-site scripting attack. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Thunderbird processes certain JavaScript actions. A malicious HTML mail message could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-0292, CVE-2006-0296, CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Thunderbird processes malformed HTML mail messages. A carefully crafted malicious HTML mail message could cause the execution of arbitrary code as the user running Thunderbird. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Thunderbird processes certain inline content in HTML mail messages. It may be possible for a remote attacker to send a carefully crafted mail message to the victim, which will fetch remote content, even if Thunderbird is configured not to fetch remote content. (CVE-2006-1045) A bug was found in the way Thunderbird executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'. (CVE-2006-0884) Users of Thunderbird are advised to upgrade to these updated packages containing Thunderbird version 1.0.8, which is not vulnerable to these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 21994
    published 2006-07-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21994
    title CentOS 4 : thunderbird (CESA-2006:0330)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200604-18.NASL
    description The remote host is affected by the vulnerability described in GLSA-200604-18 (Mozilla Suite: Multiple vulnerabilities) Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact : A remote attacker could craft malicious web pages or emails that would leverage these issues to inject and execute arbitrary script code with elevated privileges, steal local files, cookies or other information from web pages or emails, and spoof content. Some of these vulnerabilities might even be exploited to execute arbitrary code with the rights of the user running the client. Workaround : There are no known workarounds for all the issues at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 21315
    published 2006-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21315
    title GLSA-200604-18 : Mozilla Suite: Multiple vulnerabilities
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_X86_120672.NASL
    description Mozilla 1.7_x86 for Solaris 8 and 9. Date this patch was last updated by Sun : Sep/02/08
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 23773
    published 2006-12-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=23773
    title Solaris 9 (x86) : 120672-08
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_108.NASL
    description The installed version of Firefox contains various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 29744
    published 2007-12-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29744
    title Firefox < 1.0.8 Multiple Vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-275-1.NASL
    description Web pages with extremely long titles caused subsequent launches of Mozilla browser to hang for up to a few minutes, or caused Mozilla to crash on computers with insufficient memory. (CVE-2005-4134) Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables. Under some rare circumstances, a malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0292, CVE-2006-1742) The function XULDocument.persist() did not sufficiently validate the names of attributes. An attacker could exploit this to inject arbitrary XML code into the file 'localstore.rdf', which is read and evaluated at startup. This could include JavaScript commands that would be run with the user's privileges. (CVE-2006-0296) Due to a flaw in the HTML tag parser a specific sequence of HTML tags caused memory corruption. A malicious website could exploit this to crash the browser or even execute arbitrary code with the user's privileges. (CVE-2006-0748) An invalid ordering of table-related tags caused Mozilla to use a negative array index. A malicious website could exploit this to execute arbitrary code with the privileges of the user. (CVE-2006-0749) Georgi Guninski discovered that embedded XBL scripts of websites could escalate their (normally reduced) privileges to get full privileges of the user if that page is viewed with 'Print Preview'. (CVE-2006-1727) The crypto.generateCRMFRequest() function had a flaw which could be exploited to run arbitrary code with the user's privileges. (CVE-2006-1728) Claus Jorgensen and Jesse Ruderman discovered that a text input box could be pre-filled with a filename and then turned into a file-upload control with the contents intact. A malicious website could exploit this to read any local file the user has read privileges for. (CVE-2006-1729) An integer overflow was detected in the handling of the CSS property 'letter-spacing'. A malicious website could exploit this to run arbitrary code with the user's privileges. (CVE-2006-1730) The methods valueOf.call() and .valueOf.apply() returned an object whose privileges were not properly confined to those of the caller, which made them vulnerable to cross-site scripting attacks. A malicious website could exploit this to modify the contents or steal confidential data (such as passwords) from other opened web pages. (CVE-2006-1731) The window.controllers array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were vulnerable to a similar attack. The privileged built-in XBL bindings were not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. A malicious website could exploit this to run arbitrary JavaScript code with the user's privileges. (CVE-2006-1733) It was possible to use the Object.watch() method to access an internal function object (the 'clone parent'). A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1734) By calling the XBL.method.eval() method in a special way it was possible to create JavaScript functions that would get compiled with the wrong privileges. A malicious website could exploit this to execute arbitrary JavaScript code with the user's privileges. (CVE-2006-1735) Michael Krax discovered that by layering a transparent image link to an executable on top of a visible (and presumably desirable) image a malicious site could fool the user to right-click and choose 'Save image as...' from the context menu, which would download the executable instead of the image. (CVE-2006-1736) Several crashes have been fixed which could be triggered by websites and involve memory corruption. These could potentially be exploited to execute arbitrary code with the user's privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) If the user has turned on the 'Entering secure site' modal warning dialog, it was possible to spoof the browser's secure-site indicators (the lock icon and the gold URL field background) by first loading the target secure site in a pop-up window, then changing its location to a different site, which retained the displayed secure-browsing indicators from the original site. (CVE-2006-1740). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-15
    plugin id 21301
    published 2006-04-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21301
    title Ubuntu 4.10 / 5.04 / 5.10 : mozilla vulnerabilities (USN-275-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1044.NASL
    description Several security related problems have been discovered in Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-4134 Web pages with extremely long titles cause subsequent launches of the browser to appear to 'hang' for up to a few minutes, or even crash if the computer has insufficient memory. [MFSA-2006-03] - CVE-2006-0292 The JavaScript interpreter does not properly dereference objects, which allows remote attackers to cause a denial of service or execute arbitrary code. [MFSA-2006-01] - CVE-2006-0293 The function allocation code allows attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-01] - CVE-2006-0296 XULDocument.persist() did not validate the attribute name, allowing an attacker to inject arbitrary XML and JavaScript code into localstore.rdf that would be read and acted upon during startup. [MFSA-2006-05] - CVE-2006-0748 An anonymous researcher for TippingPoint and the Zero Day Initiative reported that an invalid and nonsensical ordering of table-related tags can be exploited to execute arbitrary code. [MFSA-2006-27] - CVE-2006-0749 A particular sequence of HTML tags can cause memory corruption that can be exploited to execute arbitrary code. [MFSA-2006-18] - CVE-2006-1727 Georgi Guninski reported two variants of using scripts in an XBL control to gain chrome privileges when the page is viewed under 'Print Preview'. [MFSA-2006-25] - CVE-2006-1728 'shutdown' discovered that the crypto.generateCRMFRequest method can be used to run arbitrary code with the privilege of the user running the browser, which could enable an attacker to install malware. [MFSA-2006-24] - CVE-2006-1729 Claus Jorgensen reported that a text input box can be pre-filled with a filename and then turned into a file-upload control, allowing a malicious website to steal any local file whose name they can guess. [MFSA-2006-23] - CVE-2006-1730 An anonymous researcher for TippingPoint and the Zero Day Initiative discovered an integer overflow triggered by the CSS letter-spacing property, which could be exploited to execute arbitrary code. [MFSA-2006-22] - CVE-2006-1731 'moz_bug_r_a4' discovered that some internal functions return prototypes instead of objects, which allows remote attackers to conduct cross-site scripting attacks. [MFSA-2006-19] - CVE-2006-1732 'shutdown' discovered that it is possible to bypass same-origin protections, allowing a malicious site to inject script into content from another site, which could allow the malicious page to steal information such as cookies or passwords from the other site, or perform transactions on the user's behalf if the user were already logged in. [MFSA-2006-17] - CVE-2006-1733 'moz_bug_r_a4' discovered that the compilation scope of privileged built-in XBL bindings is not fully protected from web content and can still be executed which could be used to execute arbitrary JavaScript, which could allow an attacker to install malware such as viruses and password sniffers. [MFSA-2006-16] - CVE-2006-1734 'shutdown' discovered that it is possible to access an internal function object which could then be used to run arbitrary JavaScript code with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-15] - CVE-2006-1735 It is possible to create JavaScript functions that would get compiled with the wrong privileges, allowing an attacker to run code of their choice with full permissions of the user running the browser, which could be used to install spyware or viruses. [MFSA-2006-14] - CVE-2006-1736 It is possible to trick users into downloading and saving an executable file via an image that is overlaid by a transparent image link that points to the executable. [MFSA-2006-13] - CVE-2006-1737 An integer overflow allows remote attackers to cause a denial of service and possibly execute arbitrary bytecode via JavaScript with a large regular expression. [MFSA-2006-11] - CVE-2006-1738 An unspecified vulnerability allows remote attackers to cause a denial of service. [MFSA-2006-11] - CVE-2006-1739 Certain Cascading Style Sheets (CSS) can cause an out-of-bounds array write and buffer overflow that could lead to a denial of service and the possible execution of arbitrary code. [MFSA-2006-11] - CVE-2006-1740 It is possible for remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in a popup window, then changing the location to a malicious site. [MFSA-2006-12] - CVE-2006-1741 'shutdown' discovered that it is possible to inject arbitrary JavaScript code into a page on another site using a modal alert to suspend an event handler while a new page is being loaded. This could be used to steal confidential information. [MFSA-2006-09] - CVE-2006-1742 Igor Bukanov discovered that the JavaScript engine does not properly handle temporary variables, which might allow remote attackers to trigger operations on freed memory and cause memory corruption. [MFSA-2006-10] - CVE-2006-1790 A regression fix that could lead to memory corruption allows remote attackers to cause a denial of service and possibly execute arbitrary code. [MFSA-2006-11]
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 22586
    published 2006-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22586
    title Debian DSA-1044-1 : mozilla-firefox - several vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2006-0329.NASL
    description Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs were found in the way Mozilla processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Mozilla processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Mozilla processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Mozilla. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Mozilla displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Mozilla allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) A bug was found in the way Mozilla executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'. (CVE-2006-0884) Users of Mozilla are advised to upgrade to these updated packages containing Mozilla version 1.7.13 which corrects these issues.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 21257
    published 2006-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21257
    title RHEL 2.1 / 3 / 4 : mozilla (RHSA-2006:0329)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200605-09.NASL
    description The remote host is affected by the vulnerability described in GLSA-200605-09 (Mozilla Thunderbird: Multiple vulnerabilities) Several vulnerabilities were found and fixed in Mozilla Thunderbird. Impact : A remote attacker could craft malicious emails that would leverage these issues to inject and execute arbitrary script code with elevated privileges, steal local files or other information from emails, and spoof content. Some of these vulnerabilities might even be exploited to execute arbitrary code with the rights of the user running Thunderbird. Workaround : There are no known workarounds for all the issues at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 21351
    published 2006-05-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21351
    title GLSA-200605-09 : Mozilla Thunderbird: Multiple vulnerabilities
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2006-0329.NASL
    description Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several bugs were found in the way Mozilla processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Mozilla processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Mozilla processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Mozilla. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Mozilla displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Mozilla allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) A bug was found in the way Mozilla executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'. (CVE-2006-0884) Users of Mozilla are advised to upgrade to these updated packages containing Mozilla version 1.7.13 which corrects these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 21898
    published 2006-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21898
    title CentOS 3 / 4 : mozilla (CESA-2006:0329)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_120671.NASL
    description Mozilla 1.7 for Solaris 8 and 9. Date this patch was last updated by Sun : Aug/29/08
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 24395
    published 2007-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24395
    title Solaris 8 (sparc) : 120671-08
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2006-410.NASL
    description Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741) Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742) Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox. (CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740) A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 21250
    published 2006-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21250
    title Fedora Core 4 : firefox-1.0.8-1.1.fc4 (2006-410)
oval via4
  • accepted 2013-04-29T04:12:18.063-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
    family unix
    id oval:org.mitre.oval:def:11202
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
    version 23
  • accepted 2007-03-21T16:16:47.157-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Jonathan Baker
      organization The MITRE Corporation
    description A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
    family windows
    id oval:org.mitre.oval:def:1266
    status accepted
    submitted 2006-05-07T09:05:00.000-04:00
    title Mozilla Crashes with Evidence of Memory Corruption (Firefox Regression Fix)
    version 3
redhat via4
advisories
  • bugzilla
    id 188844
    title CVE-2006-0748 Table Rebuilding Code Execution Vulnerability
    oval
    AND
    comment Red Hat Enterprise Linux 4 is installed
    oval oval:com.redhat.rhba:tst:20070304001
    rhsa
    id RHSA-2006:0328
    released 2006-04-14
    severity Critical
    title RHSA-2006:0328: firefox security update (Critical)
  • bugzilla
    id 188810
    title CVE-2006-0748 Table Rebuilding Code Execution Vulnerability
    oval
    OR
    • AND
      comment Red Hat Enterprise Linux 3 is installed
      oval oval:com.redhat.rhba:tst:20070026001
    • AND
      comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304001
    rhsa
    id RHSA-2006:0329
    released 2006-04-18
    severity Critical
    title RHSA-2006:0329: mozilla security update (Critical)
  • bugzilla
    id 189181
    title CVE-2006-0296 XULDocument.persist() RDF data injection
    oval
    AND
    comment Red Hat Enterprise Linux 4 is installed
    oval oval:com.redhat.rhba:tst:20070304001
    rhsa
    id RHSA-2006:0330
    released 2006-04-21
    severity Critical
    title RHSA-2006:0330: thunderbird security update (Critical)
refmap via4
bid 17516
confirm
debian
  • DSA-1044
  • DSA-1046
  • DSA-1051
fedora
  • FEDORA-2006-410
  • FEDORA-2006-411
  • FLSA:189137-1
  • FLSA:189137-2
gentoo
  • GLSA-200604-12
  • GLSA-200604-18
  • GLSA-200605-09
hp
  • HPSBUX02122
  • SSRT061158
mandriva
  • MDKSA-2006:075
  • MDKSA-2006:076
sco SCOSA-2006.26
secunia
  • 19631
  • 19714
  • 19721
  • 19729
  • 19746
  • 19759
  • 19780
  • 19794
  • 19811
  • 19852
  • 19862
  • 19863
  • 19902
  • 19941
  • 19950
  • 20051
  • 21033
  • 21622
sgi 20060404-01-U
sunalert
  • 102550
  • 228526
suse SUSE-SA:2006:021
ubuntu
  • USN-271-1
  • USN-275-1
  • USN-276-1
vupen ADV-2006-1356
xf mozilla-installtrigger-memory-corruption(25809)
Last major update 07-03-2011 - 21:34
Published 14-04-2006 - 15:02
Last modified 18-10-2018 - 12:36
Back to Top