Информационная безопасность
[RU] switch to English


Многочисленные уязвимости в Mozilla Firefox, Thunderbird, Seamonkey (multiple bugs)
Опубликовано:19 июля 2007 г.
Источник:
SecurityVulns ID:7941
Тип:клиент
Уровень опасности:
8/10
Описание:Выполнение кода, повреждение памяти, подмена содержимого, межсайтовый скриптинг, DoS.
Затронутые продукты:MOZILLA : Firefox 2.0
 MOZILLA : Thunderbird 2.0
 XULRUNNER : xulrunner 1.8
 ICEWEASEL : iceweasel 2.0
CVE:CVE-2007-3738 (Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.)
 CVE-2007-3737 (Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document.")
 CVE-2007-3736 (Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.)
 CVE-2007-3735 (Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.)
 CVE-2007-3734 (Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.)
 CVE-2007-3285 (Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.)
 CVE-2007-3089 (Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568.)
Оригинальный текстdocumentMOZILLA, Mozilla Foundation Security Advisory 2007-25 (19.07.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-22 (19.07.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-21 (19.07.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-20 (19.07.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-19 (19.07.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-18 (19.07.2007)
 documentCERT, US-CERT Technical Cyber Security Alert TA07-199A -- Mozilla Updates for Multiple Vulnerabilities (19.07.2007)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород