Mozilla Project reports :

MFSA 2009-71 GeckoActiveXObject exception messages can be used to enumerate installed COM objects

MFSA 2009-70 Privilege escalation via chrome window.opener

MFSA 2009-69 Location bar spoofing vulnerabilities

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-67 Integer overflow, crash in libtheora video library

MFSA 2009-66 Memory safety fixes in liboggplay media library

MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/ 1.9.0.16)

Update to new upstream SeaMonkey version 2.0.1, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.html#seamonkey2.0.1 CVE-2009-3979 CVE-2009-3980 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986 CVE-2009-3388 CVE-2009-3389

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream Firefox version 3.5.6, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox35.html#firefox3.5.6 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. CVE-2009-3979 CVE-2009-3980 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986 CVE-2009-3388 CVE-2009-3389

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2009-3979, CVE-2009-3981, CVE-2009-3986)

A flaw was found in the Firefox NT Lan Manager (NTLM) authentication protocol implementation. If an attacker could trick a local user that has NTLM credentials into visiting a specially crafted web page, they could send arbitrary requests, authenticated with the user's NTLM credentials, to other applications on the user's system.
(CVE-2009-3983)

A flaw was found in the way Firefox displayed the SSL location bar indicator. An attacker could create an unencrypted web page that appears to be encrypted, possibly tricking the user into believing they are visiting a secure page. (CVE-2009-3984)

A flaw was found in the way Firefox displayed blank pages after a user navigates to an invalid address. If a user visits an attacker-controlled web page that results in a blank page, the attacker could inject content into that blank page, possibly tricking the user into believing they are viewing a legitimate page.
(CVE-2009-3985)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.16. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.16, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3979, CVE-2009-3980, CVE-2009-3982, CVE-2009-3986)

Takehiro Takahashi discovered flaws in the NTLM implementation in Firefox. If an NTLM authenticated user visited a malicious website, a remote attacker could send requests to other applications, authenticated as the user. (CVE-2009-3983)

Jonathan Morgan discovered that Firefox did not properly display SSL indicators under certain circumstances. This could be used by an attacker to spoof an encrypted page, such as in a phishing attack.
(CVE-2009-3984)

Jordi Chancel discovered that Firefox did not properly display invalid URLs for a blank page. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. (CVE-2009-3985)

David Keeler, Bob Clary, and Dan Kaminsky discovered several flaws in third party media libraries. If a user were tricked into opening a crafted media file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-3388, CVE-2009-3389).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Firefox was updated to version 3.5.6, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3980/CVE-2009-3982     Crashes with evidence of memory corruption (rv:1.9.1.6)

  - MFSA 2009-66/CVE-2009-3388 (bmo#504843,bmo#523816)     Memory safety fixes in liboggplay media library

  - MFSA 2009-67/CVE-2009-3389 (bmo#515882,bmo#504613)     Integer overflow, crash in libtheora video library

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

The Mozilla SeaMonkey browser suite was updated to version 2.0.1, fixing lots of bugs and various security issues.

The following issues were fixed :

  - MFSA 2009-65/CVE-2009-3979/CVE-2009-3981 Crashes with     evidence of memory corruption (1.9.0.16)

  - MFSA 2009-68/CVE-2009-3983 (bmo#487872) NTLM reflection     vulnerability

  - MFSA 2009-69/CVE-2009-3984/CVE-2009-3985     (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities

  - MFSA 2009-70/CVE-2009-3986 (bmo#522430) Privilege     escalation via chrome window.opener

  - MFSA 2009-71/CVE-2009-3987: COM object enumeration only     affects Windows operating systems.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
43176	FreeBSD : mozilla -- multiple vulnerabilities (01c57d20-ea26-11de-bd39-00248c9b4be7)	Nessus	FreeBSD Local Security Checks	2009/12/17	2021/1/6	high
43336	Fedora 12 : seamonkey-2.0.1-1.fc12 (2009-13362)	Nessus	Fedora Local Security Checks	2009/12/18	2021/1/11	high
43339	Fedora 12 : Miro-2.5.2-7.fc12 / blam-1.8.5-21.fc12 / firefox-3.5.6-1.fc12 / galeon-2.0.7-19.fc12 / etc (2009-13366)	Nessus	Fedora Local Security Checks	2009/12/18	2021/1/11	high
43356	CentOS 4 / 5 : firefox (CESA-2009:1674)	Nessus	CentOS Local Security Checks	2009/12/21	2021/1/4	high
43367	Ubuntu 9.10 : firefox-3.5, xulrunner-1.9.1 vulnerabilities (USN-874-1)	Nessus	Ubuntu Local Security Checks	2009/12/21	2021/1/19	high
43383	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1708)	Nessus	SuSE Local Security Checks	2009/12/22	2021/1/14	high
43619	openSUSE Security Update : seamonkey (seamonkey-1738)	Nessus	SuSE Local Security Checks	2010/1/3	2021/1/14	high

検出

プラグインの検索

high

high

high

high

high

high

high