The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues :

  - MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833     Crashes with evidence of memory corruption (rv:1.9.0.11)

  - MFSA 2009-25/CVE-2009-1834 (bmo#479413) URL spoofing     with invalid unicode characters

  - MFSA 2009-26/CVE-2009-1835 (bmo#491801) Arbitrary domain     cookie access by local file: resources

  - MFSA 2009-27/CVE-2009-1836 (bmo#479880) SSL tampering     via non-200 responses to proxy CONNECT requests

  - MFSA 2009-28/CVE-2009-1837 (bmo#486269) Race condition     while accessing the private data of a NPObject JS     wrapper class object

  - MFSA 2009-29/CVE-2009-1838 (bmo#489131) Arbitrary code     execution using event listeners attached to an element     whose owner document is null

  - MFSA 2009-30/CVE-2009-1839 (bmo#479943) Incorrect     principal set for file: resources loaded via location     bar

  - MFSA 2009-31/CVE-2009-1840 (bmo#477979) XUL scripts     bypass content-policy checks

  - MFSA 2009-32/CVE-2009-1841 (bmo#479560) JavaScript     chrome privilege escalation

Mozilla Thunderbird was updated to the 2.0.0.22 security release. It fixes various bugs and security issues :

  - MFSA-2009-14/CVE-2009-1302/CVE-2009-1303/CVE-2009-1304     CVE-2009-1305 Crashes with evidence of memory corruption     (rv:1.9.0.9)

  - MFSA 2009-17/CVE-2009-1307 (bmo#481342) Same-origin     violations when Adobe Flash loaded via view-source:
    scheme

  - MFSA 2009-24/CVE-2009-1392/CVE-2009-1832/CVE-2009-1833     Crashes with evidence of memory corruption (rv:1.9.0.11)

  - MFSA 2009-27/CVE-2009-1836 (bmo#479880) SSL tampering     via non-200 responses to proxy CONNECT requests

  - MFSA 2009-29/CVE-2009-1838 (bmo#489131) Arbitrary code     execution using event listeners attached to an element     whose owner document is null

  - MFSA 2009-32/CVE-2009-1841 (bmo#479560) JavaScript     chrome privilege escalation

  - MFSA 2009-33 (bmo#495057) Crash viewing     multipart/alternative message with text/enhanced part

The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues :

  - Crashes with evidence of memory corruption     (rv:1.9.0.11). (MFSA 2009-24 / CVE-2009-1392 /     CVE-2009-1832 / CVE-2009-1833)

  - (bmo#479413) URL spoofing with invalid unicode     characters. (MFSA 2009-25 / CVE-2009-1834)

  - (bmo#491801) Arbitrary domain cookie access by local     file: resources. (MFSA 2009-26 / CVE-2009-1835)

  - (bmo#479880) SSL tampering via non-200 responses to     proxy CONNECT requests. (MFSA 2009-27 / CVE-2009-1836)

  - (bmo#486269) Race condition while accessing the private     data of a NPObject JS wrapper class object. (MFSA     2009-28 / CVE-2009-1837)

  - (bmo#489131) Arbitrary code execution using event     listeners attached to an element whose owner document is     null. (MFSA 2009-29 / CVE-2009-1838)

  - (bmo#479943) Incorrect principal set for file: resources     loaded via location bar. (MFSA 2009-30 / CVE-2009-1839)

  - (bmo#477979) XUL scripts bypass content-policy checks.
    (MFSA 2009-31 / CVE-2009-1840)

  - (bmo#479560) JavaScript chrome privilege escalation.
    (MFSA 2009-32 / CVE-2009-1841)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841)

A flaw was found in the processing of malformed, local file content.
If a user loaded malicious, local content via the file:// URL, it was possible for that content to access other local data. (CVE-2009-1835)

After installing the update, SeaMonkey must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
39891	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1000)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
40176	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-1091)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
41356	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1001)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
60594	Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical

検出

プラグインの検索

high

high

high

high

critical