Vulnerability   
Search   
    Search 324607 CVE descriptions
and 145615 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.801450
Category:General
Title:Mozilla Products Multiple Vulnerabilities (MFSA2010-51, MFSA2010-54, MFSA2010-56, MFSA2010-57) - Windows
Summary:Mozilla Firefox/Seamonkey/Thunderbird are prone to multiple vulnerabilities.
Description:Summary:
Mozilla Firefox/Seamonkey/Thunderbird are prone to multiple vulnerabilities.

Vulnerability Insight:
The flaws are due to:

- Some pointer held by a 'XUL' tree selection could be freed and then later
reused, potentially resulting in the execution of attacker-controlled memory.

- Information leak via 'XMLHttpRequest' statusText.

- Dangling pointer vulnerability using 'DOM' plugin array.

- 'Frameset' integer overflow vulnerability.

- type attribute of an '' tag, which override the charset of a framed
HTML document.

- Dangling pointer vulnerability in the implementation of 'navigator.plugins'
in which the navigator object could retain a pointer to the plugins array
even after it had been destroyed.

- Copy-and-paste or drag-and-drop into 'designMode' document allows XSS.

- Heap buffer overflow in 'nsTextFrameUtils::TransformText'

- Dangling pointer vulnerability in 'XUL 's content view.

Vulnerability Impact:
Successful exploitation will let attackers to cause a denial of service,
execute arbitrary code, or cause buffer overflow.

Affected Software/OS:
Seamonkey version before 2.0.7

Firefox version 3.5.x before 3.5.12 and 3.6.x before 3.6.9

Thunderbird version 3.0.x before 3.0.7 and 3.1.x before 3.1.3

Solution:
Upgrade to Firefox version 3.5.12 or 3.6.9 or later

Upgrade to Seamonkey version 2.0.7 or later

Upgrade to Thunderbird version 3.0.7 or 3.1.3 or later

CVSS Score:
9.3

CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-2760
Debian Security Information: DSA-2106 (Google Search)
http://www.debian.org/security/2010/dsa-2106
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:173
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11799
http://secunia.com/advisories/42867
SuSE Security Announcement: SUSE-SA:2010:049 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
http://www.vupen.com/english/advisories/2010/2323
http://www.vupen.com/english/advisories/2011/0061
XForce ISS Database: mozilla-nstreeselection-code-execution(61660)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61660
Common Vulnerability Exposure (CVE) ID: CVE-2010-2764
BugTraq ID: 43104
http://www.securityfocus.com/bid/43104
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11684
XForce ISS Database: firefox-xmlhttprequest-info-disclosure(61662)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61662
Common Vulnerability Exposure (CVE) ID: CVE-2010-2766
BugTraq ID: 43100
http://www.securityfocus.com/bid/43100
http://www.zerodayinitiative.com/advisories/ZDI-10-176/
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11778
Common Vulnerability Exposure (CVE) ID: CVE-2010-2765
BugTraq ID: 43095
http://www.securityfocus.com/bid/43095
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11519
Common Vulnerability Exposure (CVE) ID: CVE-2010-2768
BugTraq ID: 43101
http://www.securityfocus.com/bid/43101
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11735
Common Vulnerability Exposure (CVE) ID: CVE-2010-2767
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11969
XForce ISS Database: mozilla-pointer-code-execution(61658)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61658
Common Vulnerability Exposure (CVE) ID: CVE-2010-2769
BugTraq ID: 43106
http://www.securityfocus.com/bid/43106
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12192
Common Vulnerability Exposure (CVE) ID: CVE-2010-3166
BugTraq ID: 43102
http://www.securityfocus.com/bid/43102
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12186
Common Vulnerability Exposure (CVE) ID: CVE-2010-3167
BugTraq ID: 43097
http://www.securityfocus.com/bid/43097
http://www.zerodayinitiative.com/advisories/ZDI-10-171/
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12136
XForce ISS Database: mozilla-nstreecontentview-code-execution(61661)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61661
Common Vulnerability Exposure (CVE) ID: CVE-2010-3169
BugTraq ID: 43118
http://www.securityfocus.com/bid/43118
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12145
XForce ISS Database: mozilla-safety-code-execution(61657)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61657
Common Vulnerability Exposure (CVE) ID: CVE-2010-3168
BugTraq ID: 43108
http://www.securityfocus.com/bid/43108
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12001
XForce ISS Database: firefox-xultree-objects-code-exec(61653)
https://exchange.xforce.ibmcloud.com/vulnerabilities/61653
CopyrightCopyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2025 E-Soft Inc. All rights reserved.