The installed version of Firefox is affected by various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way in which Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)

Several flaws were found in the way in which Firefox displayed malformed web content. A web page containing specially crafted content could potentially trick a user into surrendering sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

A flaw was found in the Firefox sftp protocol handler. A malicious web page could access data from a remote sftp site, possibly stealing sensitive user data. (CVE-2007-5337)

A request-splitting flaw was found in the way in which Firefox generates a digest authentication request. If a user opened a specially crafted URL, it was possible to perform cross-site scripting attacks, web cache poisoning, or other, similar exploits.
(CVE-2007-2292)

All users of Firefox are advised to upgrade to these updated packages, which contain backported patches that correct these issues.

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way in which SeaMonkey processed certain malformed web content. A web page containing malicious content could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)

Several flaws were found in the way in which SeaMonkey displayed malformed web content. A web page containing specially crafted content could potentially trick a user into surrendering sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

A flaw was found in the SeaMonkey sftp protocol handler. A malicious web page could access data from a remote sftp site, possibly stealing sensitive user data. (CVE-2007-5337)

A request-splitting flaw was found in the way in which SeaMonkey generates a digest authentication request. If a user opened a specially crafted URL, it was possible to perform cross-site scripting attacks, web cache poisoning, or other, similar exploits.
(CVE-2007-2292)

Users of SeaMonkey are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1095     Michal Zalewski discovered that the unload event handler     had access to the address of the next page to be loaded,     which could allow information disclosure or spoofing.

  - CVE-2007-2292     Stefano Di Paola discovered that insufficient validation     of user names used in Digest authentication on a website     allows HTTP response splitting attacks.

  - CVE-2007-3511     It was discovered that insecure focus handling of the     file upload control can lead to information disclosure.
    This is a variant of CVE-2006-2894.

  - CVE-2007-5334     Eli Friedman discovered that web pages written in Xul     markup can hide the titlebar of windows, which can lead     to spoofing attacks.

  - CVE-2007-5337     Georgi Guninski discovered the insecure handling of     smb:// and sftp:// URI schemes may lead to information     disclosure. This vulnerability is only exploitable if     Gnome-VFS support is present on the system.

  - CVE-2007-5338     'moz_bug_r_a4' discovered that the protection scheme     offered by XPCNativeWrappers could be bypassed, which     might allow privilege escalation.

  - CVE-2007-5339     L. David Baron, Boris Zbarsky, Georgi Guninski, Paul     Nickerson, Olli Pettay, Jesse Ruderman, Vladimir Sukhoy,     Daniel Veditz, and Martijn Wargers discovered crashes in     the layout engine, which might allow the execution of     arbitrary code.

  - CVE-2007-5340     Igor Bukanov, Eli Friedman, and Jesse Ruderman     discovered crashes in the JavaScript engine, which might     allow the execution of arbitrary code.

The oldstable distribution (sarge) doesn't contain xulrunner.

This update fixes several security issues in Mozilla SeaMonkey 1.0.9.

Following security problems were fixed :

  - MFSA 2007-26 / CVE-2007-3844: Privilege escalation     through chrome-loaded about:blank windows

    Mozilla researcher moz_bug_r_a4 reported that a flaw was     introduced by the fix for MFSA 2007-20 that could enable     privilege escalation attacks against addons that create     'about:blank' windows and populate them in certain ways     (including implicit 'about:blank' document creation     through data: or javascript: URLs in a new window).

  - MFSA 2007-29: Crashes with evidence of memory corruption     As part of the Firefox 2.0.0.8 update releases Mozilla     developers fixed many bugs to improve the stability of     the product. Some of these crashes showed evidence of     memory corruption under certain circumstances and we     presume that with enough effort at least some of these     could be exploited to run arbitrary code.

  - CVE-2007-5339 Browser crashes

  - CVE-2007-5340 JavaScript engine crashes

  - MFSA 2007-30 / CVE-2007-1095: onUnload Tailgating

    Michal Zalewski demonstrated that onUnload event     handlers had access to the address of the new page about     to be loaded, even if the navigation was triggered from     outside the page content such as by using a bookmark,     pressing the back button, or typing an address into the     location bar. If the bookmark contained sensitive     information in the URL the attacking page might be able     to take advantage of it. An attacking page would also be     able to redirect the user, perhaps to a phishing page     that looked like the site the user thought they were     about to visit.

  - MFSA 2007-31 / CVE-2007-2292: Digest authentication     request splitting

    Security researcher Stefano Di Paola reported that     Firefox did not properly validate the user ID when     making an HTTP request using Digest Authentication to     log into a website. A malicious page could abuse this to     inject arbitrary HTTP headers by including a newline     character in the user ID followed by the injected header     data. If the user were connecting through a proxy the     attacker could inject headers that a proxy would     interpret as two separate requests for different hosts.

  - MFSA 2007-32 / CVE-2007-3511 / CVE-2006-2894: File input     focus stealing vulnerability

    A user on the Sla.ckers.org forums named hong reported     that a file upload control could be filled     programmatically by switching page focus to the label     before a file upload form control for selected keyboard     events. An attacker could use this trick to steal files     from the users' computer if the attacker knew the full     pathnames to the desired fileis and could create a     pretext that would convince the user to type long enough     to produce all the necessary characters.

  - MFSA 2007-33 / CVE-2007-5334: XUL pages can hide the     window titlebar

    Mozilla developer Eli Friedman discovered that web pages     written in the XUL markup language (rather than the     usual HTML) can hide their window's titlebar. It may     have been possible to abuse this ability to create more     convincing spoof and phishing pages.

  - MFSA 2007-34 / CVE-2007-5337: Possible file stealing     through sftp protocol

    On Linux machines with gnome-vfs support the smb: and     sftp: URI schemes are available in Firefox. Georgi     Guninski showed that if an attacker can store the attack     page in a mutually accessible location on the target     server (/tmp perhaps) and lure the victim into loading     it, the attacker could potentially read any file owned     by the victim from known locations on that server.

  - MFSA 2007-35 / CVE-2007-5338: XPCNativeWraper pollution     using Script object

    Mozilla security researcher moz_bug_r_a4 reported that     it was possible to use the Script object to modify     XPCNativeWrappers in such a way that subsequent access     by the browser chrome--such as by right-clicking to open     a context menu--can cause attacker-supplied JavaScript     to run with the same privileges as the user. This is     similar to MFSA 2007-25 fixed in Firefox 2.0.0.5

Only Windows is affected by :

  - MFSA 2007-27 / CVE-2007-3845: Unescaped URIs passed to     external programs

    This problem affects Windows only due to their handling     of URI launchers. 

  - MFSA 2007-28 / CVE-2006-4965: Code execution via     QuickTime Media-link files

    Linux does not have .lnk files, nor Quicktime. Not     affected.

  - MFSA 2007-36 / CVE-2007-4841 URIs with invalid     %-encoding mishandled by Windows

    This problem does not affected Linux.

Updated thunderbird packages that fix several security bugs are now available for Fedora Core 7.

This update has been rated as having moderate security impact by the Fedora Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way in which Thunderbird processed certain malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or potentially execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird; these issues are not exploitable unless the user has enabled JavaScript. (CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)

Several flaws were found in the way in which Thunderbird displayed malformed HTML mail content. An HTML mail message containing specially crafted content could potentially trick a user into surrendering sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

A flaw was found in the Thunderbird sftp protocol handler. A malicious HTML mail message could access data from a remote sftp site, possibly stealing sensitive user data. (CVE-2007-5337)

A request-splitting flaw was found in the way in which Thunderbird generates a digest authentication request. If a user opened a specially crafted URL, it was possible to perform cross-site scripting attacks, web cache poisoning, or other, similar exploits.
(CVE-2007-2292)

Users of Thunderbird are advised to upgrade to these erratum packages, which contain backported patches that correct these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of SeaMonkey is vulnerable to multiple flaws that may lead to execution of arbitrary code on the affected host subject to the user's privileges.

Versions of Mozilla Thunderbird prior to 2.0.0.8 suffer from a number of flaws that could lead to an attacker corrupting memory and possibly executing arbitrary code. An attacker exploiting this flaw would need to convince a Thunderbird user to open an HTML email.

The remote version of Mozilla Thunderbird suffers from a number of flaws that could lead to an attacker corrupting memory and possibly executing arbitrary code.  An attacker exploiting this flaw would need to convince a Thunderbird user to open an HTML email.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
27521	Firefox < 2.0.0.8 Multiple Vulnerabilities	Nessus	Windows	2007/10/19	2018/7/16	high
27540	CentOS 4 / 5 : firefox (CESA-2007:0979)	Nessus	CentOS Local Security Checks	2007/10/25	2021/1/4	high
27541	CentOS 3 / 4 : seamonkey (CESA-2007:0980)	Nessus	CentOS Local Security Checks	2007/10/25	2021/1/4	high
27547	Debian DSA-1392-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2007/10/25	2021/1/4	high
27581	openSUSE 10 Security Update : seamonkey (seamonkey-4596)	Nessus	SuSE Local Security Checks	2007/10/26	2021/1/14	high
28231	Fedora 7 : thunderbird-2.0.0.9-1.fc7 (2007-3431)	Nessus	Fedora Local Security Checks	2007/11/16	2021/1/11	high
4254	Mozilla Firefox < 2.0.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2007/10/19	2019/3/6	medium
4255	SeaMonkey < 1.1.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2007/10/19	2019/3/6	medium
4256	Mozilla Thunderbird < 2.0.0.8 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2007/10/19	2019/3/6	medium
800884	SeaMonkey < 1.1.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			medium
801214	Mozilla Thunderbird < 2.0.0.8 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients			high
800737	Firefox < 2.0.0.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

検出

プラグインの検索

high

high

high

high

high

high

medium

medium

medium

medium

high

high