RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64 -72 Multiple Vulnerabilities

Bugtraq ID:	44228
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Oct 19 2010 12:00AM
Updated:	Oct 20 2010 02:59PM
Credit:	Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary Kwong, Martijn Wargers, Siddharth Agarwal, Alexander Miller, Sergey Glazunov, regenrecht, Robert Swiecki, Eduardo Vela Nava, Ehsan Akhgari, Dmitri Gribenko, and Nelson Bolyard
Vulnerable:	Mozilla Thunderbird 3.1.4 Mozilla Thunderbird 3.0.5 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.2 Mozilla Thunderbird 3.0.1 Mozilla Thunderbird 3.1.3 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.1 Mozilla Thunderbird 3.0.7 Mozilla Thunderbird 3.0.6 Mozilla Thunderbird 3.0 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.3 Mozilla SeaMonkey 2.0.2 Mozilla SeaMonkey 2.0.1 Mozilla SeaMonkey 2.0.7 Mozilla SeaMonkey 2.0.6 Mozilla SeaMonkey 2.0 Mozilla Firefox 3.6.10 Mozilla Firefox 3.6.9 Mozilla Firefox 3.6.8 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.4 Mozilla Firefox 3.6.3 Mozilla Firefox 3.6.2 Mozilla Firefox 3.6.2 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.9 Mozilla Firefox 3.5.8 Mozilla Firefox 3.5.7 Mozilla Firefox 3.5.6 Mozilla Firefox 3.5.5 Mozilla Firefox 3.5.4 Mozilla Firefox 3.5.3 Mozilla Firefox 3.5.2 Mozilla Firefox 3.5.1 Mozilla Firefox 3.5 Mozilla Firefox 3.6.7 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6 Mozilla Firefox 3.5.12 Mozilla Firefox 3.5.11
Not Vulnerable:	Mozilla Thunderbird 3.1.5 Mozilla Thunderbird 3.0.9 Mozilla SeaMonkey 2.0.9 Mozilla Firefox 3.5.14 Mozilla Firefox 3.6.11

RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64 -72 Multiple Vulnerabilities

The Mozilla Foundation has released eight security advisories specifying vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey.

These vulnerabilities allow attackers to execute arbitrary machine code in the context of the vulnerable application, crash affected applications, elevate privileges, and disclose potentially sensitive information; other attacks may also be possible.

These issues are fixed in:

Firefox 3.6.11
Firefox 3.5.14
Thunderbird 3.0.9
Thunderbird 3.1.5
SeaMonkey 2.0.9

This BID is being retired. The following individual BIDs exist to better document the issues:

44243 Mozilla Firefox SeaMonkey and Thunderbird CVE-2010-3176 Multiple Memory-Corruption Vulnerabilities
44245 Mozilla Firefox and Thunderbird CVE-2010-3175 Multiple Memory-Corruption Vulnerabilities
44246 Mozilla Firefox SeaMonkey and Thunderbird CVE-2010-3174 Memory-Corruption Vulnerability
44247 Mozilla Firefox SeaMonkey and Thunderbird 'document.write' Memory Corruption Vulnerability
44248 Mozilla Firefox SeaMonkey and Thunderbird 'nsBarProp' Use-After-Free Memory Corruption Vulnerability
44249 Mozilla Firefox SeaMonkey and Thunderbird 'LookupGetterOrSetter' Memory Corruption Vulnerability
44250 Mozilla Firefox SeaMonkey and Thunderbird DLL Loading Arbitrary Code Execution Vulnerability
44251 Mozilla Firefox SeaMonkey and Thunderbird 'LD_LIBRARY_PATH' Local Privilege Escalation Vulnerability
44252 Mozilla Firefox SeaMonkey Thunderbird Modal Calls Cross Domain Information Disclosure Vulnerability
44253 Mozilla Firefox and SeaMonkey Gopher Parser Cross Site Scripting Vulnerability

RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64 -72 Multiple Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Some of these issues may not require specific exploit code and may be trivial to exploit.

RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64 -72 Multiple Vulnerabilities

Solution:
New versions of Firefox, SeaMonkey, and Thunderbird are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.

Please see the referenced advisories for information on obtaining and applying fixes.

RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-64 -72 Multiple Vulnerabilities

References:

• Mozilla Foundation Security Advisory 2010-69 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-64 (Mozilla )
  
• Mozilla Foundation Security Advisory 2010-65 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-66 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-67 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-68 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-71 (Mozilla)
  
• Mozilla Foundation Security Advisory 2010-72 (Mozilla)
  
• ZDI-10-219 Mozilla Firefox LookupGetterOrSetter Remote Code Execution Vulnerabil (Zero Day Initiative)