The Mozilla Firefox browser was updated to version 3.0.11, fixing various bugs and security issues :

  - Crashes with evidence of memory corruption     (rv:1.9.0.11). (MFSA 2009-24 / CVE-2009-1392 /     CVE-2009-1832 / CVE-2009-1833)

  - (bmo#479413) URL spoofing with invalid unicode     characters. (MFSA 2009-25 / CVE-2009-1834)

  - (bmo#491801) Arbitrary domain cookie access by local     file: resources. (MFSA 2009-26 / CVE-2009-1835)

  - (bmo#479880) SSL tampering via non-200 responses to     proxy CONNECT requests. (MFSA 2009-27 / CVE-2009-1836)

  - (bmo#486269) Race condition while accessing the private     data of a NPObject JS wrapper class object. (MFSA     2009-28 / CVE-2009-1837)

  - (bmo#489131) Arbitrary code execution using event     listeners attached to an element whose owner document is     null. (MFSA 2009-29 / CVE-2009-1838)

  - (bmo#479943) Incorrect principal set for file: resources     loaded via location bar. (MFSA 2009-30 / CVE-2009-1839)

  - (bmo#477979) XUL scripts bypass content-policy checks.
    (MFSA 2009-31 / CVE-2009-1840)

  - (bmo#479560) JavaScript chrome privilege escalation.
    (MFSA 2009-32 / CVE-2009-1841)

Mozilla Foundation reports :

MFSA 2009-32 JavaScript chrome privilege escalation

MFSA 2009-31 XUL scripts bypass content-policy checks

MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar

MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null

MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object

MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests

MFSA 2009-26 Arbitrary domain cookie access by local file : resources

MFSA 2009-25 URL spoofing with invalid unicode characters

MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

Versions of Firefox prior to 3.0.11 are affected by the following security issues : 

 - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-24)
 - Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to spoof the location bar. (MFSA 2009-25)
 - It may be possible for local resources loaded via 'file: ' protocol to access any domain's cookies saved on a user's system. (MFSA 2009-26)
 - It may be possible to tamper with SSL date via non-200 responses to proxy CONNECT requests. (MFSA 2009-27)
 - A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. (MFSA 2009-28)
 - If the owner document of an element becomes a null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-29)
 - When the 'file: ' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files. (MFSA-2009-30)
 - While loading external scripts into XUL documents content-loading policies are not checked. (MFSA 2009-31)
 - It may also be possible for scripts from page content to run with elevated privileges. (MFSA 2009-32)

The remote host is running a version of SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

The installed version of Firefox is earlier than 3.0.11. Such versions are potentially affected by the following security issues : 

  - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-24)

  - Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to spoof the location bar. (MFSA 2009-25)

  - It may be possible for local resources loaded via 'file: ' protocol to access any domain's cookies saved on a user's system. (MFSA 2009-26)

  - It may be possible to tamper with SSL date via non-200 responses to proxy CONNECT requests. (MFSA 2009-27)

  - A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. (MFSA 2009-28)

  - If the owner document of an element becomes a null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-29)

  - When the 'file: ' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files. (MFSA-2009-30)

  - While loading external scripts into XUL documents content-loading policies are not checked. (MFSA 2009-31)

  - It may also be possible for scripts from page content to run with elevated privileges. (MFSA 2009-32)

The remote host is running a version of Mozilla SeaMonkey earlier than 1.1.17. Such versions are reportedly affected by multiple vulnerabilities : 

  - Multiple remote memory-corruption vulnerabilities.

  - Content injection vulnerabilities.

  - An information disclosure vulnerability.

  - A cross-site scripting vulnerability.

  - A privilege escalation vulnerability.

  - A security bypass vulnerability.

  - A URI spoofing vulnerability.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
41356	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1001)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
39376	FreeBSD : mozilla -- multiple vulnerabilities (da185955-5738-11de-b857-000f20797ede)	Nessus	FreeBSD Local Security Checks	2009/6/15	2021/1/6	high
39560	Slackware 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : mozilla-thunderbird (SSA:2009-178-01)	Nessus	Slackware Local Security Checks	2009/6/28	2021/1/14	high
5072	Mozilla Firefox < 3.0.11 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
5084	SeaMonkey < 1.1.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2004/8/18	2019/3/6	medium
800755	Firefox < 3.0.11 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
801255	Mozilla SeaMonkey < 1.1.17 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high

検出

プラグインの検索

high

high

high

medium

medium

high

high