Executive Summary

Summary
Title Thunderbird vulnerabilities
Informations
NameUSN-668-1First vendor Publication2008-11-26
VendorUbuntuLast vendor Modification2008-11-26
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080614h-0ubuntu0.6.06.1

Ubuntu 7.10:
thunderbird 2.0.0.18+nobinonly-0ubuntu0.7.10.1

Ubuntu 8.04 LTS:
thunderbird 2.0.0.18+nobinonly-0ubuntu0.8.04.1

Ubuntu 8.10:
thunderbird 2.0.0.18+nobinonly-0ubuntu0.8.10.1

After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.

Details follow:

Georgi Guninski, Michal Zalewsk and Chris Evans discovered that the same-origin
check in Thunderbird could be bypassed. If a user were tricked into opening a
malicious website, an attacker could obtain private information from data
stored in the images, or discover information about software on the user's
computer. (CVE-2008-5012)

Jesse Ruderman discovered that Thunderbird did not properly guard locks on
non-native objects. If a user had JavaScript enabled and were tricked into
opening malicious web content, an attacker could cause a browser crash and
possibly execute arbitrary code with user privileges. (CVE-2008-5014)

Several problems were discovered in the browser, layout and JavaScript engines.
If a user had JavaScript enabled, these problems could allow an attacker to
crash Thunderbird and possibly execute arbitrary code with user privileges.
(CVE-2008-5016, CVE-2008-5017, CVE-2008-5018)

A flaw was discovered in Thunderbird's DOM constructing code. If a user were
tricked into opening a malicious website while having JavaScript enabled, an
attacker could cause the browser to crash and potentially execute arbitrary
code with user privileges. (CVE-2008-5021)

It was discovered that the same-origin check in Thunderbird could be bypassed.
If a user had JavaScript enabled and were tricked into opening malicious web
content, an attacker could execute JavaScript in the context of a different
website. (CVE-2008-5022)

Chris Evans discovered that Thunderbird did not properly parse E4X documents,
leading to quote characters in the namespace not being properly escaped.
(CVE-2008-5024)

Boris Zbarsky discovered that Thunderbird did not properly process comments in
forwarded in-line messages. If a user had JavaScript enabled and opened a
malicious email, an attacker may be able to obtain information about the
recipient.


Original Source

Url : http://www.ubuntu.com/usn/USN-668-1

CAPEC : Common Attack Pattern Enumeration & Classification

idName
CAPEC-26Leveraging Race Conditions
CAPEC-29Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
CAPEC-172Time and State Attacks

CWE : Common Weakness Enumeration

idName
CWE-362Race Condition
CWE-665Improper Initialization
CWE-399Resource Management Errors
CWE-287Improper Authentication
CWE-200Information Exposure
CWE-189Numeric Errors
CWE-94Failure to Control Generation of Code ('Code Injection')
CWE-20Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10750
 
Oval ID: oval:org.mitre.oval:def:10750
Title: Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
Description: Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5012
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9157
 
Oval ID: oval:org.mitre.oval:def:9157
Title: jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.
Description: jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5014
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11356
 
Oval ID: oval:org.mitre.oval:def:11356
Title: The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.
Description: The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5016
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11436
 
Oval ID: oval:org.mitre.oval:def:11436
Title: Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Description: Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5017
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9872
 
Oval ID: oval:org.mitre.oval:def:9872
Title: The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class.
Description: The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5018
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9642
 
Oval ID: oval:org.mitre.oval:def:9642
Title: nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.
Description: nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5021
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11186
 
Oval ID: oval:org.mitre.oval:def:11186
Title: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
Description: The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5022
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9063
 
Oval ID: oval:org.mitre.oval:def:9063
Title: Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
Description: Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5024
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application72
Application31
Application53

OpenVAS Exploits

DateDescription
2009-10-13Name : SLES10: Security update for MozillaFirefox
File : nvt/sles10_MozillaFirefox6.nasl
2009-10-13Name : SLES10: Security update for gecko-sdk and mozilla-xulrunner
File : nvt/sles10_gecko-sdk0.nasl
2009-10-13Name : SLES10: Security update for MozillaFirefox
File : nvt/sles10_MozillaFirefox0.nasl
2009-06-03Name : Solaris Update for Mozilla 1.7 125539-06
File : nvt/gb_solaris_125539_06.nasl
2009-06-03Name : Solaris Update for Mozilla Firefox Web browser 125540-06
File : nvt/gb_solaris_125540_06.nasl
2009-04-09Name : Mandriva Update for mozilla-firefox MDVSA-2008:228 (mozilla-firefox)
File : nvt/gb_mandriva_MDVSA_2008_228.nasl
2009-04-09Name : Mandriva Update for firefox MDVSA-2008:230 (firefox)
File : nvt/gb_mandriva_MDVSA_2008_230.nasl
2009-04-09Name : Mandriva Update for mozilla-thunderbird MDVSA-2008:235 (mozilla-thunderbird)
File : nvt/gb_mandriva_MDVSA_2008_235.nasl
2009-03-23Name : Ubuntu Update for firefox, firefox-3.0, xulrunner-1.9 vulnerabilities USN-667-1
File : nvt/gb_ubuntu_USN_667_1.nasl
2009-03-23Name : Ubuntu Update for mozilla-thunderbird, thunderbird vulnerabilities USN-668-1
File : nvt/gb_ubuntu_USN_668_1.nasl
2009-03-06Name : RedHat Update for thunderbird RHSA-2008:0976-01
File : nvt/gb_RHSA-2008_0976-01_thunderbird.nasl
2009-03-06Name : RedHat Update for seamonkey RHSA-2008:0977-01
File : nvt/gb_RHSA-2008_0977-01_seamonkey.nasl
2009-03-06Name : RedHat Update for firefox RHSA-2008:0978-01
File : nvt/gb_RHSA-2008_0978-01_firefox.nasl
2009-02-27Name : CentOS Update for thunderbird CESA-2008:0976 centos4 i386
File : nvt/gb_CESA-2008_0976_thunderbird_centos4_i386.nasl
2009-02-27Name : CentOS Update for thunderbird CESA-2008:0976 centos4 x86_64
File : nvt/gb_CESA-2008_0976_thunderbird_centos4_x86_64.nasl
2009-02-27Name : CentOS Update for seamonkey CESA-2008:0977-01 centos2 i386
File : nvt/gb_CESA-2008_0977-01_seamonkey_centos2_i386.nasl
2009-02-27Name : CentOS Update for seamonkey CESA-2008:0977 centos3 i386
File : nvt/gb_CESA-2008_0977_seamonkey_centos3_i386.nasl
2009-02-27Name : CentOS Update for seamonkey CESA-2008:0977 centos3 x86_64
File : nvt/gb_CESA-2008_0977_seamonkey_centos3_x86_64.nasl
2009-02-27Name : CentOS Update for seamonkey CESA-2008:0977 centos4 i386
File : nvt/gb_CESA-2008_0977_seamonkey_centos4_i386.nasl
2009-02-27Name : CentOS Update for seamonkey CESA-2008:0977 centos4 x86_64
File : nvt/gb_CESA-2008_0977_seamonkey_centos4_x86_64.nasl
2009-02-27Name : CentOS Update for firefox CESA-2008:0978 centos4 i386
File : nvt/gb_CESA-2008_0978_firefox_centos4_i386.nasl
2009-02-27Name : CentOS Update for firefox CESA-2008:0978 centos4 x86_64
File : nvt/gb_CESA-2008_0978_firefox_centos4_x86_64.nasl
2009-02-17Name : Fedora Update for Miro FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_Miro_fc8.nasl
2009-02-17Name : Fedora Update for blam FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_blam_fc8.nasl
2009-02-17Name : Fedora Update for cairo-dock FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_cairo-dock_fc8.nasl
2009-02-17Name : Fedora Update for chmsee FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_chmsee_fc8.nasl
2009-02-17Name : Fedora Update for devhelp FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_devhelp_fc8.nasl
2009-02-17Name : Fedora Update for epiphany-extensions FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_epiphany-extensions_fc8.nasl
2009-02-17Name : Fedora Update for epiphany FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_epiphany_fc8.nasl
2009-02-17Name : Fedora Update for evolution-rss FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_evolution-rss_fc8.nasl
2009-02-17Name : Fedora Update for firefox FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_firefox_fc8.nasl
2009-02-17Name : Fedora Update for galeon FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_galeon_fc8.nasl
2009-02-17Name : Fedora Update for gnome-python2-extras FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_gnome-python2-extras_fc8.nasl
2009-02-17Name : Fedora Update for gnome-web-photo FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_gnome-web-photo_fc8.nasl
2009-02-17Name : Fedora Update for kazehakase FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_kazehakase_fc8.nasl
2009-02-17Name : Fedora Update for liferea FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_liferea_fc8.nasl
2009-02-17Name : Fedora Update for openvrml FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_openvrml_fc8.nasl
2009-02-17Name : Fedora Update for ruby-gnome2 FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_ruby-gnome2_fc8.nasl
2009-02-17Name : Fedora Update for seamonkey FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_seamonkey_fc8.nasl
2009-02-17Name : Fedora Update for yelp FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_yelp_fc8.nasl
2009-02-17Name : Fedora Update for Miro FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_Miro_fc9.nasl
2009-02-17Name : Fedora Update for cairo-dock FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_cairo-dock_fc9.nasl
2009-02-17Name : Fedora Update for chmsee FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_chmsee_fc9.nasl
2009-02-17Name : Fedora Update for devhelp FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_devhelp_fc9.nasl
2009-02-17Name : Fedora Update for epiphany-extensions FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_epiphany-extensions_fc9.nasl
2009-02-17Name : Fedora Update for epiphany FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_epiphany_fc9.nasl
2009-02-17Name : Fedora Update for evolution-rss FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_evolution-rss_fc9.nasl
2009-02-17Name : Fedora Update for firefox FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_firefox_fc9.nasl
2009-02-17Name : Fedora Update for galeon FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_galeon_fc9.nasl
2009-02-17Name : Fedora Update for gnome-python2-extras FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gnome-python2-extras_fc9.nasl
2009-02-17Name : Fedora Update for gnome-web-photo FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gnome-web-photo_fc9.nasl
2009-02-17Name : Fedora Update for google-gadgets FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_google-gadgets_fc9.nasl
2009-02-17Name : Fedora Update for gtkmozembedmm FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gtkmozembedmm_fc9.nasl
2009-02-17Name : Fedora Update for kazehakase FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_kazehakase_fc9.nasl
2009-02-17Name : Fedora Update for mozvoikko FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_mozvoikko_fc9.nasl
2009-02-17Name : Fedora Update for mugshot FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_mugshot_fc9.nasl
2009-02-17Name : Fedora Update for ruby-gnome2 FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_ruby-gnome2_fc9.nasl
2009-02-17Name : Fedora Update for seamonkey FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_seamonkey_fc9.nasl
2009-02-17Name : Fedora Update for totem FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_totem_fc9.nasl
2009-02-17Name : Fedora Update for xulrunner FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_xulrunner_fc9.nasl
2009-02-17Name : Fedora Update for yelp FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_yelp_fc9.nasl
2009-02-17Name : Fedora Update for thunderbird FEDORA-2008-9807
File : nvt/gb_fedora_2008_9807_thunderbird_fc8.nasl
2009-02-17Name : Fedora Update for thunderbird FEDORA-2008-9859
File : nvt/gb_fedora_2008_9859_thunderbird_fc9.nasl
2009-02-17Name : Fedora Update for thunderbird FEDORA-2008-9901
File : nvt/gb_fedora_2008_9901_thunderbird_fc10.nasl
2009-01-23Name : SuSE Update for MozillaFirefox,MozillaThunderbird,seamonkey SUSE-SA:2008:055
File : nvt/gb_suse_2008_055.nasl
2009-01-13Name : Debian Security Advisory DSA 1696-1 (icedove)
File : nvt/deb_1696_1.nasl
2009-01-13Name : Debian Security Advisory DSA 1697-1 (iceape)
File : nvt/deb_1697_1.nasl
2008-12-03Name : Debian Security Advisory DSA 1671-1 (iceweasel)
File : nvt/deb_1671_1.nasl
2008-11-24Name : Debian Security Advisory DSA 1669-1 (xulrunner)
File : nvt/deb_1669_1.nasl
2008-11-21Name : Mozilla Firefox Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_firefox_mult_vuln_nov08_lin.nasl
2008-11-21Name : Mozilla Firefox Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_firefox_mult_vuln_nov08_win.nasl
2008-11-21Name : Mozilla Seamonkey Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_seamonkey_mult_vuln_nov08_lin.nasl
2008-11-21Name : Mozilla Seamonkey Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_seamonkey_mult_vuln_nov08_win.nasl
2008-11-21Name : Mozilla Thunderbird Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_thunderbird_mult_vuln_nov08_lin.nasl
2008-11-21Name : Mozilla Thunderbird Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_thunderbird_mult_vuln_nov08_win.nasl
2008-11-19Name : FreeBSD Ports: firefox
File : nvt/freebsd_firefox35.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
50210Mozilla Multiple Products Layout Engine Multiple Function DoS
50181Mozilla Multiple Products nsXMLHttpRequest::NotifyEventListeners Method Same-...
50179Mozilla Multiple Products nsFrameManager File Input Element Modification Blur...
50177Mozilla Multiple Products JavaScript Engine Date Class Unspecified Remote DoS
50176Mozilla Multiple Products Browser Engine xpcom/io/nsEscape.cpp Unspecified Ov...
50141Mozilla Multiple Products jslock.cpp OBJ_IS_NATIVE Function Non-Native Object...
50139Mozilla Multiple Products Canvas Element Handling Same-policy Origin Bypass
49995Mozilla Multiple Products EX4 Document Handling Remote XML Injection

Snort® IPS/IDS

DateDescription
2014-01-10Mozilla Firefox file type memory corruption attempt
RuleID : 17603 - Revision : 5 - Type : BROWSER-FIREFOX
2014-01-10Mozilla Firefox file type memory corruption attempt
RuleID : 17601 - Revision : 11 - Type : BROWSER-FIREFOX

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0977.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0978.nasl - Type : ACT_GATHER_INFO
2013-01-08Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20081112_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20081112_seamonkey_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing a security update.
File : sl_20081119_thunderbird_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-01-06Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2010-01-06Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0978.nasl - Type : ACT_GATHER_INFO
2009-09-24Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gecko-sdk-5813.nasl - Type : ACT_GATHER_INFO
2009-09-24Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-5826.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for mozilla-xulrunner181
File : suse_11_0_mozilla-xulrunner181-081122.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for seamonkey
File : suse_11_0_seamonkey-081122.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for MozillaFirefox
File : suse_11_0_MozillaFirefox-081124.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for MozillaThunderbird
File : suse_11_0_MozillaThunderbird-081124.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-228.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-230.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-235.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0977.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-667-1.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-668-1.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Fedora host is missing a security update.
File : fedora_2008-9901.nasl - Type : ACT_GATHER_INFO
2009-01-08Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1696.nasl - Type : ACT_GATHER_INFO
2009-01-08Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1697.nasl - Type : ACT_GATHER_INFO
2008-11-26Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gecko-sdk-5811.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote SuSE system is missing the security patch MozillaThunderbird-5825
File : suse_MozillaThunderbird-5825.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote SuSE system is missing the security patch seamonkey-5815
File : suse_seamonkey-5815.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote SuSE system is missing the security patch MozillaFirefox-5812
File : suse_MozillaFirefox-5812.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote SuSE system is missing the security patch mozilla-xulrunner181-5820
File : suse_mozilla-xulrunner181-5820.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1671.nasl - Type : ACT_GATHER_INFO
2008-11-24Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-5786.nasl - Type : ACT_GATHER_INFO
2008-11-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1669.nasl - Type : ACT_GATHER_INFO
2008-11-21Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2008-11-21Name : The remote Fedora host is missing a security update.
File : fedora_2008-9807.nasl - Type : ACT_GATHER_INFO
2008-11-21Name : The remote Fedora host is missing a security update.
File : fedora_2008-9859.nasl - Type : ACT_GATHER_INFO
2008-11-20Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_20018.nasl - Type : ACT_GATHER_INFO
2008-11-16Name : The remote Fedora host is missing one or more security updates.
File : fedora_2008-9667.nasl - Type : ACT_GATHER_INFO
2008-11-16Name : The remote Fedora host is missing one or more security updates.
File : fedora_2008-9669.nasl - Type : ACT_GATHER_INFO
2008-11-14Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_f29fea8fb19f11dda55e00163e000016.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_304.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0977.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0978.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : A web browser on the remote host is affected by multiple vulnerabilities.
File : seamonkey_1113.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_20018.nasl - Type : ACT_GATHER_INFO
2008-09-24Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_302.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:05:24
  • Multiple Updates