RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
BID:47635
Info
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
| Bugtraq ID: | 47635 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 28 2011 12:00AM |
| Updated: | May 02 2011 07:43PM |
| Credit: | Scoobidiver; Alcidion web development team; Ian Beer; Bob Clary; Henri Sivonen; Marco Bonardo; Mats Palmgren; Jesse Ruderman; Aki Helin; Martin Barbella; regenrecht; Paul Stone; David Remahl of Apple Product Security; Soroush Dalili; Nils; Christoph Diehl; |
| Vulnerable: |
RedHat Enterprise Linux WS 4 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux AS 4 RedHat Enterprise Linux Desktop version 4 RedHat Enterprise Linux 5 server Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Mozilla Thunderbird 3.1.7 Mozilla Thunderbird 3.1.5 Mozilla Thunderbird 3.1.5 Mozilla Thunderbird 3.1.4 Mozilla Thunderbird 3.0.11 Mozilla Thunderbird 3.0.9 Mozilla Thunderbird 3.0.9 Mozilla Thunderbird 3.0.8 Mozilla Thunderbird 3.0.5 Mozilla Thunderbird 3.0.5 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.2 Mozilla Thunderbird 3.0.1 Mozilla Thunderbird 3.1.9 Mozilla Thunderbird 3.1.8 Mozilla Thunderbird 3.1.7 Mozilla Thunderbird 3.1.6 Mozilla Thunderbird 3.1.3 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.1 Mozilla Thunderbird 3.1 Mozilla Thunderbird 3.0.7 Mozilla Thunderbird 3.0.6 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.3 Mozilla Thunderbird 3.0.11 Mozilla Thunderbird 3.0.10 Mozilla Thunderbird 3.0 Mozilla SeaMonkey 2.0.11 Mozilla SeaMonkey 2.0.11 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.8 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.3 Mozilla SeaMonkey 2.0.2 Mozilla SeaMonkey 2.0.1 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.7 Mozilla SeaMonkey 2.0.6 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.13 Mozilla SeaMonkey 2.0.12 Mozilla SeaMonkey 2.0.10 Mozilla SeaMonkey 2.0 Rc2 Mozilla SeaMonkey 2.0 Rc1 Mozilla SeaMonkey 2.0 Beta 2 Mozilla SeaMonkey 2.0 Beta 1 Mozilla SeaMonkey 2.0 Alpha 3 Mozilla SeaMonkey 2.0 Alpha 2 Mozilla SeaMonkey 2.0 Alpha 1 Mozilla SeaMonkey 2.0 Mozilla Firefox 3.6.13 Mozilla Firefox 3.6.13 Mozilla Firefox 3.6.10 Mozilla Firefox 3.6.9 Mozilla Firefox 3.6.8 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.4 Mozilla Firefox 3.6.3 Mozilla Firefox 3.6.2 Mozilla Firefox 3.6.2 Mozilla Firefox 3.5.17 Mozilla Firefox 3.5.16 Mozilla Firefox 3.5.14 Mozilla Firefox 3.5.13 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.9 Mozilla Firefox 3.5.9 Mozilla Firefox 3.5.8 Mozilla Firefox 3.5.7 Mozilla Firefox 3.5.6 Mozilla Firefox 3.5.5 Mozilla Firefox 3.5.4 Mozilla Firefox 3.5.3 Mozilla Firefox 3.5.2 Mozilla Firefox 3.5.1 Mozilla Firefox 3.5 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 3.6.7 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.16 Mozilla Firefox 3.6.15 Mozilla Firefox 3.6.14 Mozilla Firefox 3.6.12 Mozilla Firefox 3.6.11 Mozilla Firefox 3.6 Beta 3 Mozilla Firefox 3.6 Beta 2 Mozilla Firefox 3.6 Mozilla Firefox 3.5.18 Mozilla Firefox 3.5.17 Mozilla Firefox 3.5.15 Mozilla Firefox 3.5.12 Mozilla Firefox 3.5.11 |
| Not Vulnerable: |
Mozilla Thunderbird 3.1.10 Mozilla SeaMonkey 2.0.14 Mozilla Firefox 4.0.1 Mozilla Firefox 4.0 Mozilla Firefox 3.6.17 Mozilla Firefox 3.5.19 |
Discussion
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
The Mozilla Foundation has released multiple security advisories specifying vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey.
These vulnerabilities allow attackers to execute arbitrary code in the context of the vulnerable application, crash affected applications, and elevate privileges; other attacks may also be possible.
These issues are fixed in:
Firefox 3.6.17
Firefox 3.5.19
Thunderbird 3.1.10
SeaMonkey 2.0.14
This BID is being retired. The following individual records exist to better document the issues:
47641 Mozilla Firefox/Thunderbird/SeaMonkey HTML Content Memory Corruption Vulnerability
47646 Mozilla Firefox/Thunderbird/SeaMonkey Marquee Elements Memory Corruption Vulnerability
47647 Mozilla Firefox/Thunderbird/SeaMonkey HTML Iframe Tag Memory Corruption Vulnerability
47648 Mozilla Firefox/Thunderbird/SeaMonkey HTML Frameset Tag Interger Overflow Vulnerability
47651 Mozilla Firefox/Thunderbird/SeaMonkey Out-Of-Memory Memory Corruption Vulnerability
47653 Mozilla Firefox/Thunderbird/SeaMonkey HTML Content (CVE-2011-0081) Memory Corruption Vulnerability
47654 Mozilla Firefox/Thunderbird/SeaMonkey Double Free Memory Corruption Vulnerability
47655 Mozilla Firefox/Thunderbird/SeaMonkey Use-After-Free Memory Corruption Vulnerability
47656 Mozilla Firefox/Thunderbird/SeaMonkey Cross-Domain JavaScript Memory Corruption Vulnerability
47657 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-0079 Memory Corruption Vulnerability
47659 Mozilla Firefox/SeaMonkey CVE-2011-0065 Memory Corruption Vulnerability
47660 Mozilla Firefox/SeaMonkey CVE-2011-0076 Privilege Escalation Vulnerability
47661 Mozilla Firefox WebGLES library Multiple Memory Corruption Vulnerabilities
47662 Mozilla Firefox/SeaMonkey CVE-2011-0066 Memory Corruption Vulnerability
47663 Mozilla Firefox/SeaMonkey CVE-2011-0073 Memory Corruption Vulnerability
47666 Mozilla Firefox/Thunderbird/SeaMonkey 'resource:' Protocol Directory Traversal Vulnerability
47667 Mozilla Firefox/SeaMonkey CVE-2011-0067 Information Disclosure Vulnerability
47668 libxslt 'generate-id()' Function Information Disclosure Vulnerability
The Mozilla Foundation has released multiple security advisories specifying vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey.
These vulnerabilities allow attackers to execute arbitrary code in the context of the vulnerable application, crash affected applications, and elevate privileges; other attacks may also be possible.
These issues are fixed in:
Firefox 3.6.17
Firefox 3.5.19
Thunderbird 3.1.10
SeaMonkey 2.0.14
This BID is being retired. The following individual records exist to better document the issues:
47641 Mozilla Firefox/Thunderbird/SeaMonkey HTML Content Memory Corruption Vulnerability
47646 Mozilla Firefox/Thunderbird/SeaMonkey Marquee Elements Memory Corruption Vulnerability
47647 Mozilla Firefox/Thunderbird/SeaMonkey HTML Iframe Tag Memory Corruption Vulnerability
47648 Mozilla Firefox/Thunderbird/SeaMonkey HTML Frameset Tag Interger Overflow Vulnerability
47651 Mozilla Firefox/Thunderbird/SeaMonkey Out-Of-Memory Memory Corruption Vulnerability
47653 Mozilla Firefox/Thunderbird/SeaMonkey HTML Content (CVE-2011-0081) Memory Corruption Vulnerability
47654 Mozilla Firefox/Thunderbird/SeaMonkey Double Free Memory Corruption Vulnerability
47655 Mozilla Firefox/Thunderbird/SeaMonkey Use-After-Free Memory Corruption Vulnerability
47656 Mozilla Firefox/Thunderbird/SeaMonkey Cross-Domain JavaScript Memory Corruption Vulnerability
47657 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-0079 Memory Corruption Vulnerability
47659 Mozilla Firefox/SeaMonkey CVE-2011-0065 Memory Corruption Vulnerability
47660 Mozilla Firefox/SeaMonkey CVE-2011-0076 Privilege Escalation Vulnerability
47661 Mozilla Firefox WebGLES library Multiple Memory Corruption Vulnerabilities
47662 Mozilla Firefox/SeaMonkey CVE-2011-0066 Memory Corruption Vulnerability
47663 Mozilla Firefox/SeaMonkey CVE-2011-0073 Memory Corruption Vulnerability
47666 Mozilla Firefox/Thunderbird/SeaMonkey 'resource:' Protocol Directory Traversal Vulnerability
47667 Mozilla Firefox/SeaMonkey CVE-2011-0067 Information Disclosure Vulnerability
47668 libxslt 'generate-id()' Function Information Disclosure Vulnerability
Exploit / POC
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Solution / Fix
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
Solution:
New versions of Firefox, SeaMonkey, and Thunderbird are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.
Please see the referenced advisories for information on obtaining and applying fixes.
Solution:
New versions of Firefox, SeaMonkey, and Thunderbird are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.
Please see the referenced advisories for information on obtaining and applying fixes.
References
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities
References:
References:
- Mozilla Firefox Homepage (Mozilla)
- SeaMonkey Homepage (Mozilla)
- Thunderbird Homepage (Mozilla)
- Mozilla Foundation Security Advisory 2011-12 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-13 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-14 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-15 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-16 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-17 (Mozilla Foundation)
- Mozilla Foundation Security Advisory 2011-18 (Mozilla Foundation)