BID:43045

RETIRED: Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Through -63 Multiple Vulnerabilities

Info

RETIRED: Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Through -63 Multiple Vulnerabilities

Bugtraq ID:	43045
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2010 12:00AM
Updated:	Sep 07 2010 12:00AM
Credit:	Peter Van der Beken, Jason Oster, Jesse Ruderman, Igor Bukanov, Jeff Walden, Gary Kwong, Olli Pettay, Michal Zalewski, Chris Rohlf of Matasano Security, Sergey Glazunov, wushi of team509, regenrecht, Marc Schoenefeld, Blake Kaplan, moz_bug_r_a4 , David Hua
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.10 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 LTS Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 RedHat Desktop 3.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server Mozilla Thunderbird 3.0.5 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.2 Mozilla Thunderbird 3.0.1 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.1 Mozilla Thunderbird 3.0.6 Mozilla Thunderbird 3.0 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.3 Mozilla SeaMonkey 2.0.2 Mozilla SeaMonkey 2.0.1 Mozilla SeaMonkey 2.0.6 Mozilla SeaMonkey 2.0 Rc2 Mozilla SeaMonkey 2.0 Rc1 Mozilla SeaMonkey 2.0 Beta 2 Mozilla SeaMonkey 2.0 Beta 1 Mozilla SeaMonkey 2.0 Alpha 3 Mozilla SeaMonkey 2.0 Alpha 2 Mozilla SeaMonkey 2.0 Alpha 1 Mozilla SeaMonkey 2.0 Mozilla Firefox 3.6.8 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.4 Mozilla Firefox 3.6.3 Mozilla Firefox 3.6.2 Mozilla Firefox 3.6.2 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.9 Mozilla Firefox 3.5.8 Mozilla Firefox 3.5.7 Mozilla Firefox 3.5.6 Mozilla Firefox 3.5.5 Mozilla Firefox 3.5.4 Mozilla Firefox 3.5.3 Mozilla Firefox 3.5.2 Mozilla Firefox 3.5.1 Mozilla Firefox 3.5 Mozilla Firefox 3.6.7 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6 Mozilla Firefox 3.5.11 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0

Not Vulnerable:	Mozilla Thunderbird 3.1.3 Mozilla Thunderbird 3.0.7 Mozilla SeaMonkey 2.0.7 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 3.5.12

Discussion

RETIRED: Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Through -63 Multiple Vulnerabilities

The Mozilla Foundation has released 15 security advisories specifying vulnerabilities in Mozilla Firefox, Seamonkey, and Thunderbird.

These vulnerabilities allow attackers to execute arbitrary machine code in the context of the vulnerable application, crash affected applications, elevate privileges, conduct cross-site scripting attacks, and disclose potentially sensitive information; other attacks may also be possible.

These issues are fixed in:

Firefox 3.6.9
Firefox 3.5.12
Thunderbird 3.0.7
Thunderbird 3.1.3
SeaMonkey 2.0.7

This BID is being retired. The following individual records exist to better document the issues:

43091 Mozilla Firefox, Thunderbird, and SeaMonkey 'XULTreeSelection' Remote Code Execution Vulnerability
43092 Mozilla Firefox and Thunderbird 'XPCSafeJSObjectWrapper' Chrome Privilege Escalation Vulnerability
43094 Mozilla Firefox/SeaMonkey/Thunderbird Cross Domain Scripting Vulnerability
43093 Mozilla Firefox, Thunderbird, and SeaMonkey 'navigator.plugin' Remote Code Execution Vulnerability
43095 Mozilla Firefox, Thunderbird, and SeaMonkey HTML Frameset Element Integer Overflow Vulnerability
43096 Mozilla Firefox, Thunderbird, and SeaMonkey Crafted Font Remote Code Execution Vulnerability
43097 Mozilla Firefox, Thunderbird, and SeaMonkey 'nsTreeContentView' Remote Code Execution Vulnerability
43100 Mozilla Firefox, Thunderbird, and SeaMonkey 'normalizeDocument' Remote Code Execution Vulnerability
43101 Mozilla Firefox, Thunderbird, and SeaMonkey UTF-7 Charset Cross Site Scripting Vulnerability
43102 Mozilla Firefox, SeaMonkey, and Thunderbird Transform Text Heap Buffer Overflow Vulnerability
43104 Multiple Mozilla Products 'XMLHttpRequest' Cross Domain Information Disclosure Vulnerability
43106 Mozilla Firefox/SeaMonkey/Thunderbird 'designMode' Cross Domain Scripting Vulnerability
43108 Mozilla Firefox, Thunderbird, and SeaMonkey CVE-2010-3168 Remote Code Execution Vulnerability
43118 Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Multiple Memory-Corruption Vulnerabilities

Exploit / POC

RETIRED: Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Through -63 Multiple Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Some of these issues may not require specific exploit code and may be trivial to exploit.

Solution / Fix

RETIRED: Mozilla Firefox SeaMonkey and Thunderbird MFSA 2010-49 Through -63 Multiple Vulnerabilities

Solution:
New versions of Firefox and Thunderbird are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.

Please see the referenced advisories for information on obtaining and applying fixes.

Debian Linux 5.0 ia-64