The installed version of Firefox is earlier than 3.0.11. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could     potentially be exploited to execute arbitrary code.     (MFSA 2009-24)

  - Certain invalid Unicode characters, when used as a part     of IDN, can be displayed as a whitespace in the location     bar. An attacker could exploit this vulnerability to     spoof the location bar. (MFSA 2009-25)  

  - It may be possible for local resources loaded via     'file:' protocol to access any domain's cookies saved     on a user's system. (MFSA 2009-26)

  - It may be possible to tamper with SSL data via non-200     responses to proxy CONNECT requests. (MFSA 2009-27)

  - A race condition exists in 'NPObjWrapper_NewResolve'     when accessing the properties of a NPObject, a     wrapped JSObject. This flaw could be potentially     exploited to execute arbitrary code on the remote     system. (MFSA 2009-28)

  - If the owner document of an element becomes null after     garbage collection, then it may be possible to execute     the event listeners within the wrong JavaScript context.
    An attacker could potentially exploit this vulnerability     to execute arbitrary JavaScript with chrome privileges.
    (MFSA 2009-29)  

  - When the 'file:' resource is loaded from the location     bar, the resource inherits the principal of the     previously loaded document. This could potentially allow     unauthorized access to local files. (MFSA 2009-30)

  - While loading external scripts into XUL documents     content-loading policies are not checked.     (MFSA 2009-31)   

  - It may be possible for scripts from page content to     run with elevated privileges. (MFSA 2009-32)

Security vulnerabilities have been discovered and corrected in Mozilla Firefox 3.x :

CVE-2009-1392: Firefox browser engine crashes CVE-2009-1832: Firefox double frame construction flaw CVE-2009-1833: Firefox JavaScript engine crashes CVE-2009-1834: Firefox URL spoofing with invalid unicode characters CVE-2009-1835: Firefox Arbitrary domain cookie access by local file: resources CVE-2009-1836: Firefox SSL tampering via non-200 responses to proxy CONNECT requests CVE-2009-1837: Firefox Race condition while accessing the private data of a NPObject JS wrapper class object CVE-2009-1838: Firefox arbitrary code execution flaw CVE-2009-1839: Firefox information disclosure flaw CVE-2009-1840:
Firefox XUL scripts skip some security checks CVE-2009-1841: Firefox JavaScript arbitrary code execution CVE-2009-2043: firefox - remote TinyMCE denial of service CVE-2009-2044: firefox - remote GIF denial of service CVE-2009-2061: firefox - man-in-the-middle exploit CVE-2009-2065: firefox - man-in-the-middle exploit

This update provides the latest Mozilla Firefox 3.x to correct these issues.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues :

  - MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833     Crashes with evidence of memory corruption (rv:1.9.0.11)

  - MFSA 2009-25/CVE-2009-1834 (bmo#479413) URL spoofing     with invalid unicode characters

  - MFSA 2009-26/CVE-2009-1835 (bmo#491801) Arbitrary domain     cookie access by local file: resources

  - MFSA 2009-27/CVE-2009-1836 (bmo#479880) SSL tampering     via non-200 responses to proxy CONNECT requests

  - MFSA 2009-28/CVE-2009-1837 (bmo#486269) Race condition     while accessing the private data of a NPObject JS     wrapper class object

  - MFSA 2009-29/CVE-2009-1838 (bmo#489131) Arbitrary code     execution using event listeners attached to an element     whose owner document is null

  - MFSA 2009-30/CVE-2009-1839 (bmo#479943) Incorrect     principal set for file: resources loaded via location     bar

  - MFSA 2009-31/CVE-2009-1840 (bmo#477979) XUL scripts     bypass content-policy checks

  - MFSA 2009-32/CVE-2009-1841 (bmo#479560) JavaScript     chrome privilege escalation

A number of security vulnerabilities have been discovered for Mozilla Thunderbird version 2.0.0.21 (CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305, CVE-2009-1306, CVE-2009-1307, CVE-2009-1308, CVE-2009-1309, CVE-2009-2210, CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1838, CVE-2009-1836, CVE-2009-1840, CVE-2009-1841).

This update provides the latest Thunderbird to correct these issues.

Update to upstream version 1.1.17, fixing multiple security flaws:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey11.html#seamonkey1.1.17

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
39372	Firefox < 3.0.11 Multiple Vulnerabilities	Nessus	Windows	2009/6/12	2026/6/23	high
39443	Mandriva Linux Security Advisory : firefox (MDVSA-2009:134)	Nessus	Mandriva Local Security Checks	2009/6/18	2021/1/6	high
40174	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1000)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
39581	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:141)	Nessus	Mandriva Local Security Checks	2009/6/28	2021/1/6	high
39846	Fedora 11 : seamonkey-1.1.17-1.fc11 (2009-7614)	Nessus	Fedora Local Security Checks	2009/7/17	2021/1/11	high

検出

プラグインの検索

high

high

high

high

high