RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
BID:49800
Info
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
| Bugtraq ID: | 49800 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 27 2011 12:00AM |
| Updated: | Mar 19 2015 08:52AM |
| Credit: | Benjamin Smedberg, Bob Clary, Jesse Ruderman, Josh Aas, Bob Clary, Andrew McCreight, Andreas Gal, Gary Kwong, Igor Bukanov, Jason Orendorff, Jesse Ruderman, Marcia Knous, Mark Kaplan, Boris Zbarsky, Ian Graham, Mariusz Mlynski, Michael Jordan, Ben Hawkes, |
| Vulnerable: |
Mozilla Thunderbird 3.1.12 Mozilla Thunderbird 3.1.7 Mozilla Thunderbird 3.1.5 Mozilla Thunderbird 3.1.4 Mozilla Thunderbird 3.0.11 Mozilla Thunderbird 3.0.9 Mozilla Thunderbird 3.0.9 Mozilla Thunderbird 3.0.8 Mozilla Thunderbird 3.0.5 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.2 Mozilla Thunderbird 3.0.1 Mozilla Thunderbird 6 Mozilla Thunderbird 5 Mozilla Thunderbird 3.1.9 Mozilla Thunderbird 3.1.8 Mozilla Thunderbird 3.1.7 Mozilla Thunderbird 3.1.6 Mozilla Thunderbird 3.1.3 Mozilla Thunderbird 3.1.2 Mozilla Thunderbird 3.1.11 Mozilla Thunderbird 3.1.10 Mozilla Thunderbird 3.1.1 Mozilla Thunderbird 3.1 Mozilla Thunderbird 3.0.7 Mozilla Thunderbird 3.0.6 Mozilla Thunderbird 3.0.4 Mozilla Thunderbird 3.0.3 Mozilla Thunderbird 3.0.11 Mozilla Thunderbird 3.0.10 Mozilla Thunderbird 3.0 Mozilla SeaMonkey 2.0.11 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.8 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.3 Mozilla SeaMonkey 2.0.2 Mozilla SeaMonkey 2.0.1 Mozilla SeaMonkey 2.3 Mozilla SeaMonkey 2.2 Mozilla SeaMonkey 2.1b2 Mozilla SeaMonkey 2.1 Alpha3 Mozilla SeaMonkey 2.1 Alpha2 Mozilla SeaMonkey 2.1 Alpha1 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.7 Mozilla SeaMonkey 2.0.6 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.14 Mozilla SeaMonkey 2.0.13 Mozilla SeaMonkey 2.0.12 Mozilla SeaMonkey 2.0.10 Mozilla SeaMonkey 2.0 Rc2 Mozilla SeaMonkey 2.0 Rc1 Mozilla SeaMonkey 2.0 Beta 2 Mozilla SeaMonkey 2.0 Beta 1 Mozilla SeaMonkey 2.0 Alpha 3 Mozilla SeaMonkey 2.0 Alpha 2 Mozilla SeaMonkey 2.0 Alpha 1 Mozilla SeaMonkey 2.0 Mozilla Firefox 3.6.13 Mozilla Firefox 3.6.10 Mozilla Firefox 3.6.9 Mozilla Firefox 3.6.8 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.4 Mozilla Firefox 3.6.3 Mozilla Firefox 3.6.2 Mozilla Firefox 3.5.17 Mozilla Firefox 3.5.16 Mozilla Firefox 3.5.14 Mozilla Firefox 3.5.13 Mozilla Firefox 3.5.10 Mozilla Firefox 3.5.9 Mozilla Firefox 3.5.8 Mozilla Firefox 3.5.7 Mozilla Firefox 3.5.6 Mozilla Firefox 3.5.5 Mozilla Firefox 3.5.4 Mozilla Firefox 3.5.3 Mozilla Firefox 3.5.2 Mozilla Firefox 3.5.1 Mozilla Firefox 3.5 Mozilla Firefox 6 Mozilla Firefox 5.0 Mozilla Firefox 4.0.1 Mozilla Firefox 4.0 Beta1 Mozilla Firefox 4.0 Mozilla Firefox 3.6.7 Mozilla Firefox 3.6.6 Mozilla Firefox 3.6.20 Mozilla Firefox 3.6.19 Mozilla Firefox 3.6.18 Mozilla Firefox 3.6.17 Mozilla Firefox 3.6.16 Mozilla Firefox 3.6.15 Mozilla Firefox 3.6.14 Mozilla Firefox 3.6.12 Mozilla Firefox 3.6.11 Mozilla Firefox 3.6 Beta 3 Mozilla Firefox 3.6 Beta 2 Mozilla Firefox 3.6 Mozilla Firefox 3.5.19 Mozilla Firefox 3.5.18 Mozilla Firefox 3.5.17 Mozilla Firefox 3.5.15 Mozilla Firefox 3.5.12 Mozilla Firefox 3.5.11 |
| Not Vulnerable: |
Mozilla Thunderbird 7.0 Mozilla SeaMonkey 2.4 Mozilla Firefox 7 Mozilla Firefox 3.6.23 |
Discussion
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
The Mozilla Foundation has released multiple security advisories specifying vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey.
These vulnerabilities allow attackers to execute arbitrary code in the context of the vulnerable application, crash affected applications, and obtain potentially sensitive information; other attacks may also be possible.
These issues are fixed in the following versions:
Firefox 3.6.23
Firefox 7
Thunderbird 7
SeaMonkey 2.4
This BID is being retired. The following individual records exist to better document the issues:
49808 Mozilla Firefox/Thunderbird/SeaMonkey OGG headers Use-After-Free Memory Corruption Vulnerability
49809 Mozilla Firefox RegExp Remote Integer Underflow Vulnerability
49810 Mozilla Firefox CVE-2011-2995 Remote Memory Corruption Vulnerability
49811 Mozilla Firefox/Thunderbird/SeaMonkey Enter Key Dialog Bypass Weakness
49812 Mozilla Firefox CVE-2011-2997 Remote Memory Corruption Vulnerability
49813 Mozilla Firefox and SeaMonkey CVE-2011-3002 Remote Buffer Overflow Vulnerability
49837 Mozilla Firefox/Thunderbird/SeaMonkey Enter Key Dialog Bypass Vulnerability
49845 Mozilla Firefox CVE-2011-2996 Remote Memory Corruption Vulnerability
49847 Mozilla Firefox and SeaMonkey CVE-2011-3003 Remote Code Execution Vulnerability
49848 Mozilla Firefox/SeaMonkey/Thunderbird CVE-2011-2999 Cross Domain Scripting Vulnerability
49849 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-3000 HTTP Response Splitting Vulnerability
49850 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-3232 YARR Remote Code Execution Vulnerability
49852 Mozilla Firefox and SeaMonkey 'loadSubScript()' Security Bypass Vulnerability
The Mozilla Foundation has released multiple security advisories specifying vulnerabilities in Mozilla Firefox, Thunderbird, and SeaMonkey.
These vulnerabilities allow attackers to execute arbitrary code in the context of the vulnerable application, crash affected applications, and obtain potentially sensitive information; other attacks may also be possible.
These issues are fixed in the following versions:
Firefox 3.6.23
Firefox 7
Thunderbird 7
SeaMonkey 2.4
This BID is being retired. The following individual records exist to better document the issues:
49808 Mozilla Firefox/Thunderbird/SeaMonkey OGG headers Use-After-Free Memory Corruption Vulnerability
49809 Mozilla Firefox RegExp Remote Integer Underflow Vulnerability
49810 Mozilla Firefox CVE-2011-2995 Remote Memory Corruption Vulnerability
49811 Mozilla Firefox/Thunderbird/SeaMonkey Enter Key Dialog Bypass Weakness
49812 Mozilla Firefox CVE-2011-2997 Remote Memory Corruption Vulnerability
49813 Mozilla Firefox and SeaMonkey CVE-2011-3002 Remote Buffer Overflow Vulnerability
49837 Mozilla Firefox/Thunderbird/SeaMonkey Enter Key Dialog Bypass Vulnerability
49845 Mozilla Firefox CVE-2011-2996 Remote Memory Corruption Vulnerability
49847 Mozilla Firefox and SeaMonkey CVE-2011-3003 Remote Code Execution Vulnerability
49848 Mozilla Firefox/SeaMonkey/Thunderbird CVE-2011-2999 Cross Domain Scripting Vulnerability
49849 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-3000 HTTP Response Splitting Vulnerability
49850 Mozilla Firefox/Thunderbird/SeaMonkey CVE-2011-3232 YARR Remote Code Execution Vulnerability
49852 Mozilla Firefox and SeaMonkey 'loadSubScript()' Security Bypass Vulnerability
Exploit / POC
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Solution / Fix
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
RETIRED: Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-36 through -45 Multiple Vulnerabilities
References:
References:
- Mozilla Firefox Homepage (Mozilla)
- SeaMonkey Homepage (Mozilla)
- Thunderbird Homepage (Mozilla)
- MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23) (Mozilla)
- MFSA 2011-37 Integer underflow when using JavaScript RegExp (Mozilla)
- MFSA 2011-38 XSS via plugins and shadowed window.location object (Mozilla)
- MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection (Mozilla)
- MFSA 2011-40 Code installation through holding down Enter (Mozilla)
- MFSA 2011-41 Potentially exploitable WebGL crashes (Mozilla)
- MFSA 2011-42 Potentially exploitable crash in the YARR regular expression librar (Mozilla)
- MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter (Mozilla)
- MFSA 2011-44 Use after free reading OGG headers (Mozilla)
- MFSA 2011-45 Inferring Keystrokes from motion data (Mozilla)