English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 75096 CVE descriptions
and 39644 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.801467
Category:General
Title:Mozilla Products Multiple Vulnerabilities October-10 (Windows)
Summary:Check for the version of Mozilla Products
Description:
Overview:
The host is installed with Mozilla Firefox/Seamonkey/Thunderbird and is prone
to multiple vulnerabilities.

Vulnerability Insight:
The flaws are due to:
- A wildcard IP address in the 'subject&qts' Common Name field of an X.509
certificate.
- not properly setting the minimum key length for 'Diffie-Hellman Ephemeral'
(DHE) mode, which makes it easier for remote attackers to defeat
cryptographic protection mechanisms via a brute-force attack.
- Passing an excessively long string to 'document.write' could cause text
rendering routines to end up in an inconsistent state with sections of
stack memory being overwritten with the string data.
- not properly handling certain modal calls made by 'javascript: URLs' in
circumstances related to opening a new window and performing cross-domain
navigation.
- an untrusted search path vulnerability.
- Use-after-free vulnerability in the nsBarProp function.
- error in 'LookupGetterOrSetter' function, which does not properly support
'window.__lookupGetter__ function' calls that lack arguments.

Impact:
Successful exploitation will let attackers to to cause a denial of service
or execute arbitrary code.

Impact Level: Application

Affected Software/OS:
Seamonkey version prior to 2.0.9
Firefox version prior to 3.5.14 and 3.6.x before 3.6.11
Thunderbird version proior to 3.0.9 and 3.1.x before 3.1.5

Fix:
Upgrade to Firefox version 3.6.11 or 3.5.14 or later
http://www.mozilla.com/en-US/firefox/all.html

Upgrade to Seamonkey version 2.0.9 or later
http://www.seamonkey-project.org/releases/

Upgrade to Thunderbird version 3.0.9 or 3.1.5 or later
http://www.mozillamessaging.com/en-US/thunderbird/

References:
http://www.mozilla.org/security/announce/2010/mfsa2010-70.html
http://www.mozilla.org/security/announce/2010/mfsa2010-72.html
http://www.mozilla.org/security/announce/2010/mfsa2010-65.html
http://www.mozilla.org/security/announce/2010/mfsa2010-69.html
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-3170
Debian Security Information: DSA-2123 (Google Search)
http://www.debian.org/security/2010/dsa-2123
http://www.mandriva.com/security/advisories?name=MDVSA-2010:210
http://www.redhat.com/support/errata/RHSA-2010-0781.html
http://www.redhat.com/support/errata/RHSA-2010-0782.html
SuSE Security Announcement: SUSE-SR:2010:020 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
http://www.ubuntu.com/usn/USN-1007-1
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12254
http://secunia.com/advisories/41839
http://secunia.com/advisories/42867
http://www.vupen.com/english/advisories/2011/0061
Common Vulnerability Exposure (CVE) ID: CVE-2010-3173
http://www.mandriva.com/security/advisories?name=MDVSA-2010:211
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12118
Common Vulnerability Exposure (CVE) ID: CVE-2010-3179
Debian Security Information: DSA-2124 (Google Search)
http://www.debian.org/security/2010/dsa-2124
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html
http://www.redhat.com/support/errata/RHSA-2010-0861.html
http://www.redhat.com/support/errata/RHSA-2010-0896.html
http://www.ubuntu.com/usn/USN-997-1
http://www.ubuntu.com/usn/USN-998-1
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11675
Common Vulnerability Exposure (CVE) ID: CVE-2010-3178
BugTraq ID: 44252
http://www.securityfocus.com/bid/44252
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12120
Common Vulnerability Exposure (CVE) ID: CVE-2010-3181
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12116
Common Vulnerability Exposure (CVE) ID: CVE-2010-3180
http://www.redhat.com/support/errata/RHSA-2010-0780.html
BugTraq ID: 44248
http://www.securityfocus.com/bid/44248
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12158
Common Vulnerability Exposure (CVE) ID: CVE-2010-3183
http://www.zerodayinitiative.com/advisories/ZDI-10-219/
BugTraq ID: 44249
http://www.securityfocus.com/bid/44249
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11891
CopyrightCopyright (C) 2010 Greenbone Networks GmbH

This is only one of 39644 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.