RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
BID:35326
Info
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
| Bugtraq ID: | 35326 |
| Class: | Unknown |
| CVE: |
CVE-2009-1392 CVE-2009-1832 CVE-2009-1833 CVE-2009-1836 CVE-2009-1838 CVE-2009-1840 CVE-2009-1841 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 11 2009 12:00AM |
| Updated: | Jul 07 2009 08:17PM |
| Credit: | Bob Clary, Jesse Ruderman, Alexander Sack, Bret McMillan, Tomeo Vizoso, Matt McCutchen, Martijn Warger, Jesse Ruderman, Adam Hauner, Igor Bukanov, Pavel Cvrcek, Gregory Fleischer, Microsoft security researchers Shuo Chen, Ziqing Mao, Yi-Min Wang, and Ming |
| Vulnerable: |
Pardus Linux 2008 0 Mozilla Thunderbird 2.0 .9 Mozilla Thunderbird 2.0 .8 Mozilla Thunderbird 2.0 .6 Mozilla Thunderbird 2.0 .5 Mozilla Thunderbird 2.0 .4 Mozilla Thunderbird 2.0 .19 Mozilla Thunderbird 2.0 .17 Mozilla Thunderbird 2.0 .16 Mozilla Thunderbird 2.0 .15 Mozilla Thunderbird 2.0 .14 Mozilla Thunderbird 2.0 .13 Mozilla Thunderbird 2.0 .12 Mozilla Thunderbird 1.5 beta 2 Mozilla Thunderbird 1.5 .9 Mozilla Thunderbird 1.5 .13 Mozilla Thunderbird 1.5 Mozilla Thunderbird 1.0.8 Mozilla Thunderbird 1.0.7 Mozilla Thunderbird 1.0.6 Mozilla Thunderbird 1.0.5 Mozilla Thunderbird 1.0.2 Mozilla Thunderbird 1.0.1 Mozilla Thunderbird 1.0 Mozilla Thunderbird 0.9 Mozilla Thunderbird 0.8 Mozilla Thunderbird 0.7.3 Mozilla Thunderbird 0.7.2 Mozilla Thunderbird 0.7.1 Mozilla Thunderbird 0.7 Mozilla Thunderbird 0.6 Mozilla Thunderbird 2.0.0.21 Mozilla Thunderbird 2.0.0.18 Mozilla Thunderbird 1.5.0.8 Mozilla Thunderbird 1.5.0.7 Mozilla Thunderbird 1.5.0.5 Mozilla Thunderbird 1.5.0.4 Mozilla Thunderbird 1.5.0.2 Mozilla Thunderbird 1.5.0.14 Mozilla Thunderbird 1.5.0.12 Mozilla Thunderbird 1.5.0.10 Mozilla Thunderbird 1.5.0.1 Mozilla SeaMonkey 1.1.16 Mozilla SeaMonkey 1.1.15 Mozilla SeaMonkey 1.1.15 Mozilla SeaMonkey 1.1.14 Mozilla SeaMonkey 1.1.13 Mozilla SeaMonkey 1.1.12 Mozilla SeaMonkey 1.1.11 Mozilla SeaMonkey 1.1.10 Mozilla SeaMonkey 1.1.9 Mozilla SeaMonkey 1.1.8 Mozilla SeaMonkey 1.1.7 Mozilla SeaMonkey 1.1.6 Mozilla SeaMonkey 1.1.5 Mozilla SeaMonkey 1.1.4 Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey 1.1.2 Mozilla SeaMonkey 1.1.1 Mozilla SeaMonkey 1.0.99 Mozilla SeaMonkey 1.0.9 Mozilla SeaMonkey 1.0.8 Mozilla SeaMonkey 1.0.7 Mozilla SeaMonkey 1.0.6 Mozilla SeaMonkey 1.0.5 Mozilla SeaMonkey 1.0.3 Mozilla SeaMonkey 1.0.2 Mozilla SeaMonkey 1.0.1 Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey 1.0 dev Mozilla SeaMonkey 1.0 Mozilla Firefox 3.0.10 Mozilla Firefox 3.0.9 Mozilla Firefox 3.0.8 Mozilla Firefox 3.0.7 Beta Mozilla Firefox 3.0.7 Mozilla Firefox 3.0.6 Mozilla Firefox 3.0.5 Mozilla Firefox 3.0.4 Mozilla Firefox 3.0.3 Mozilla Firefox 3.0.2 Mozilla Firefox 3.0.1 Mozilla Firefox 2.0 20 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .8 Mozilla Firefox 2.0 .7 Mozilla Firefox 2.0 .6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .19 Mozilla Firefox 2.0 .17 Mozilla Firefox 2.0 .16 Mozilla Firefox 2.0 .10 Mozilla Firefox 2.0 .1 Mozilla Firefox 1.5 beta 2 Mozilla Firefox 1.5 beta 1 Mozilla Firefox 1.5 12 Mozilla Firefox 1.5 .8 Mozilla Firefox 1.5 .6 Mozilla Firefox 1.5 Mozilla Firefox 1.0.8 Mozilla Firefox 1.0.7 Mozilla Firefox 1.0.6 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.4 Mozilla Firefox 1.0.3 Mozilla Firefox 1.0.2 Mozilla Firefox 1.0.1 Mozilla Firefox 1.0 Mozilla Firefox 0.10.1 Mozilla Firefox 0.10 Mozilla Firefox 0.9.3 Mozilla Firefox 0.9.2 Mozilla Firefox 0.9.1 Mozilla Firefox 0.9 rc Mozilla Firefox 0.9 Mozilla Firefox 0.8 Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3.0 Mozilla Firefox 2.0.0.3 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0.0.18 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.13 Mozilla Firefox 2.0.0.12 Mozilla Firefox 2.0.0.11 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0.0.10 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 Mozilla Firefox 1.5.0.9 Mozilla Firefox 1.5.0.8 Mozilla Firefox 1.5.0.7 Mozilla Firefox 1.5.0.6 Mozilla Firefox 1.5.0.5 Mozilla Firefox 1.5.0.4 Mozilla Firefox 1.5.0.3 Mozilla Firefox 1.5.0.2 Mozilla Firefox 1.5.0.2 Mozilla Firefox 1.5.0.11 Mozilla Firefox 1.5.0.11 Mozilla Firefox 1.5.0.10 Mozilla Firefox 1.5.0.1 |
| Not Vulnerable: |
Mozilla Thunderbird 2.0.0.22 Mozilla SeaMonkey 1.1.17 Mozilla Firefox 3.0.11 |
Discussion
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox, Thunderbird, and SeaMonkey.
Attackers can exploit these issues to bypass same-origin restrictions, obtain potentially sensitive information, and execute arbitrary script code with elevated privileges; other attacks are also possible.
NOTE: This BID is being retired because the following individual records have been created to better document issues previously mentioned in this BID:
35360 Mozilla Firefox 'NPObject' Access Remote Code Execution Vulnerability
35370 Mozilla Firefox/Thunderbird/SeaMonkey Multiple Browser Engine Memory Corruption Vulnerabilities
35373 Mozilla Firefox and SeaMonkey JavaScript Chrome Privilege Escalation Vulnerability
35371 Mozilla Firefox/Thunderbird/SeaMonkey Double Frame Construction Memory Corruption Vulnerability
35372 Mozilla Firefox/Thunderbird/SeaMonkey Multiple JavaScript Engine Memory Corruption Vulnerabilities
35377 Mozilla Firefox/Thunderbird/SeaMonkey XUL Scripts Content-Policy Check Security Bypass
Vulnerability
35380 Mozilla Firefox/Thunderbird/SeaMonkey Malicious Proxy HTTPS Man In The Middle Vulnerability
35383 Mozilla Firefox/Thunderbird/SeaMonkey Null Owner Document Arbitrary Code Execution Vulnerability
35386 Mozilla Firefox/Thunderbird/SeaMonkey 'file://' URI Security Bypass Vulnerability
35386 Mozilla Firefox/Thunderbird/SeaMonkey 'file://' URI Security Bypass Vulnerability
35388 Mozilla Firefox/SeaMonkey Address Bar URI Spoofing Vulnerability
The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox, Thunderbird, and SeaMonkey.
Attackers can exploit these issues to bypass same-origin restrictions, obtain potentially sensitive information, and execute arbitrary script code with elevated privileges; other attacks are also possible.
NOTE: This BID is being retired because the following individual records have been created to better document issues previously mentioned in this BID:
35360 Mozilla Firefox 'NPObject' Access Remote Code Execution Vulnerability
35370 Mozilla Firefox/Thunderbird/SeaMonkey Multiple Browser Engine Memory Corruption Vulnerabilities
35373 Mozilla Firefox and SeaMonkey JavaScript Chrome Privilege Escalation Vulnerability
35371 Mozilla Firefox/Thunderbird/SeaMonkey Double Frame Construction Memory Corruption Vulnerability
35372 Mozilla Firefox/Thunderbird/SeaMonkey Multiple JavaScript Engine Memory Corruption Vulnerabilities
35377 Mozilla Firefox/Thunderbird/SeaMonkey XUL Scripts Content-Policy Check Security Bypass
Vulnerability
35380 Mozilla Firefox/Thunderbird/SeaMonkey Malicious Proxy HTTPS Man In The Middle Vulnerability
35383 Mozilla Firefox/Thunderbird/SeaMonkey Null Owner Document Arbitrary Code Execution Vulnerability
35386 Mozilla Firefox/Thunderbird/SeaMonkey 'file://' URI Security Bypass Vulnerability
35386 Mozilla Firefox/Thunderbird/SeaMonkey 'file://' URI Security Bypass Vulnerability
35388 Mozilla Firefox/SeaMonkey Address Bar URI Spoofing Vulnerability
Exploit / POC
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
Some of the vulnerabilities described in this BID may not require exploits.
Some of the vulnerabilities described in this BID may not require exploits.
Solution / Fix
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through 32 Multiple Vulnerabilities
References:
References:
- Mozilla Homepage (Mozilla Foundation)
- MFSA 2009-24: Crashes with evidence of memory corruption (rv:1.9.0.11) (Mozilla)
- MFSA 2009-25: URL spoofing with invalid unicode characters (Mozilla)
- MFSA 2009-26: Arbitrary domain cookie access by local file: resources (Mozilla)
- MFSA 2009-27: SSL tampering via non-200 responses to proxy CONNECT requests (Mozilla)
- MFSA 2009-28: Race condition while accessing the private data of a NPObject JS w (Mozilla)
- MFSA 2009-29: Arbitrary code execution using event listeners attached to an elem (Mozilla)
- MFSA 2009-30: Incorrect principal set for file: resources loaded via location ba (Mozilla)
- MFSA 2009-31: XUL scripts bypass content-policy checks (Mozilla)
- MFSA 2009-32: JavaScript chrome privilege escalation (Mozilla)