| Zusammenfassung: | The remote host is missing updates announced in;advisory RHSA-2009:0437.;;SeaMonkey is an open source Web browser, email and newsgroup client, IRC;chat client, and HTML editor.;;Several flaws were found in the processing of malformed web content. A web;page containing malicious content could cause SeaMonkey to crash or,;potentially, execute arbitrary code as the user running SeaMonkey.;(CVE-2009-1303, CVE-2009-1305);;Several flaws were found in the way malformed web content was processed. A;web page containing malicious content could execute arbitrary JavaScript in;the context of the site, possibly presenting misleading data to a user, or;stealing sensitive information such as login credentials. (CVE-2009-0652,;CVE-2009-1306, CVE-2009-1307, CVE-2009-1309, CVE-2009-1312);;A flaw was found in the way SeaMonkey saved certain web pages to a local;file. If a user saved the inner frame of a web page containing POST data,;the POST data could be revealed to the inner frame, possibly surrendering;sensitive information such as login credentials. (CVE-2009-1311);;All SeaMonkey users should upgrade to these updated packages, which correct;these issues. After installing the update, SeaMonkey must be restarted for;the changes to take effect. |
| Beschreibung: | Summary:
The remote host is missing updates announced in
advisory RHSA-2009:0437.
SeaMonkey is an open source Web browser, email and newsgroup client, IRC
chat client, and HTML editor.
Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-1303, CVE-2009-1305)
Several flaws were found in the way malformed web content was processed. A
web page containing malicious content could execute arbitrary JavaScript in
the context of the site, possibly presenting misleading data to a user, or
stealing sensitive information such as login credentials. (CVE-2009-0652,
CVE-2009-1306, CVE-2009-1307, CVE-2009-1309, CVE-2009-1312)
A flaw was found in the way SeaMonkey saved certain web pages to a local
file. If a user saved the inner frame of a web page containing POST data,
the POST data could be revealed to the inner frame, possibly surrendering
sensitive information such as login credentials. (CVE-2009-1311)
All SeaMonkey users should upgrade to these updated packages, which correct
these issues. After installing the update, SeaMonkey must be restarted for
the changes to take effect.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
