CVE-2006-3812
CVSS2.6
发布时间 :2006-07-28 20:04:00
修订时间 :2011-03-07 21:39:31
NMCOPS    

[原文]Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links.


[CNNVD]Mozilla Firefox/SeaMonkey/Thunderbird chrome参数中URL连接漏洞(CNNVD-200607-506)

        Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
        上述产品中存在多个安全漏洞,具体如下:
        允许远程攻击者关联远程文件同时可能读取chrome参数中URL,并复制地址或欺骗连接.

- CVSS (基础分值)

CVSS分值: 2.6 [轻微(LOW)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:mozilla:thunderbird:1.5.0.4Mozilla Thunderbird 1.5.0.4
cpe:/a:mozilla:thunderbird:1.5.0.3Mozilla Thunderbird 1.5.0.3
cpe:/a:mozilla:firefox:1.5:beta1Mozilla Firefox 1.5 Beta 1
cpe:/a:mozilla:firefox:1.5.0.1Mozilla Firefox 1.5.0.1
cpe:/a:mozilla:thunderbird:1.5.0.2Mozilla Thunderbird 1.5.0.2
cpe:/a:mozilla:thunderbird:1.5Mozilla Thunderbird 1.5
cpe:/a:mozilla:thunderbird:1.5.2Mozilla Thunderbird 1.5.2
cpe:/a:mozilla:thunderbird:1.5.1Mozilla Thunderbird 1.5.1
cpe:/a:mozilla:seamonkey:1.0:betaMozilla SeaMonkey 1.0 beta
cpe:/a:mozilla:seamonkey:1.0Mozilla SeaMonkey 1.0
cpe:/a:mozilla:seamonkey:1.0::dev
cpe:/a:mozilla:thunderbird:1.5:beta2Mozilla Thunderbird 1.5 Beta 2
cpe:/a:mozilla:firefox:1.5Mozilla Firefox 1.5
cpe:/a:mozilla:firefox:1.5.0.4Mozilla Firefox 1.5.0.4
cpe:/a:mozilla:seamonkey:1.0.2Mozilla SeaMonkey 1.0.2
cpe:/a:mozilla:thunderbird:1.5.0.1Mozilla Thunderbird 1.5.0.1
cpe:/a:mozilla:firefox:1.5.0.2Mozilla Firefox 1.5.0.2
cpe:/a:mozilla:firefox:1.5:beta2Mozilla Firefox 1.5 Beta 2
cpe:/a:mozilla:seamonkey:1.0::alpha
cpe:/a:mozilla:seamonkey:1.0.1Mozilla SeaMonkey 1.0.1
cpe:/a:mozilla:firefox:1.5.0.3Mozilla Firefox 1.5.0.3

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:11013Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3812
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200607-506
(官方数据源) CNNVD

- 其它链接及资源

http://www.kb.cert.org/vuls/id/398492
(UNKNOWN)  CERT-VN  VU#398492
https://issues.rpath.com/browse/RPL-536
(PATCH)  CONFIRM  https://issues.rpath.com/browse/RPL-536
http://www.securityfocus.com/bid/19181
(PATCH)  BID  19181
http://www.securityfocus.com/archive/1/archive/1/441333/100/0/threaded
(PATCH)  BUGTRAQ  20060727 rPSA-2006-0137-1 firefox
http://securitytracker.com/id?1016587
(PATCH)  SECTRACK  1016587
http://securitytracker.com/id?1016586
(PATCH)  SECTRACK  1016586
http://secunia.com/advisories/21229
(VENDOR_ADVISORY)  SECUNIA  21229
http://secunia.com/advisories/21216
(VENDOR_ADVISORY)  SECUNIA  21216
http://secunia.com/advisories/19873
(VENDOR_ADVISORY)  SECUNIA  19873
http://www.vupen.com/english/advisories/2008/0083
(UNKNOWN)  VUPEN  ADV-2008-0083
http://www.vupen.com/english/advisories/2006/3748
(UNKNOWN)  VUPEN  ADV-2006-3748
http://www.ubuntulinux.org/support/documentation/usn/usn-329-1
(UNKNOWN)  UBUNTU  USN-329-1
http://www.ubuntulinux.org/support/documentation/usn/usn-327-1
(UNKNOWN)  UBUNTU  USN-327-1
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  SSRT061181
http://www.redhat.com/support/errata/RHSA-2006-0608.html
(UNKNOWN)  REDHAT  RHSA-2006:0608
http://www.mozilla.org/security/announce/2006/mfsa2006-56.html
(UNKNOWN)  CONFIRM  http://www.mozilla.org/security/announce/2006/mfsa2006-56.html
http://xforce.iss.net/xforce/xfdb/27993
(UNKNOWN)  XF  mozilla-chrome-information-disclosure(27993)
http://www.ubuntu.com/usn/usn-354-1
(UNKNOWN)  UBUNTU  USN-354-1
http://www.ubuntu.com/usn/usn-350-1
(UNKNOWN)  UBUNTU  USN-350-1
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  HPSBUX02153
http://www.redhat.com/support/errata/RHSA-2006-0610.html
(UNKNOWN)  REDHAT  RHSA-2006:0610
http://www.redhat.com/support/errata/RHSA-2006-0594.html
(UNKNOWN)  REDHAT  RHSA-2006:0594
http://www.novell.com/linux/security/advisories/2006_48_seamonkey.html
(UNKNOWN)  SUSE  SUSE-SA:2006:048
http://www.mandriva.com/security/advisories?name=MDKSA-2006:146
(UNKNOWN)  MANDRIVA  MDKSA-2006:146
http://www.mandriva.com/security/advisories?name=MDKSA-2006:145
(UNKNOWN)  MANDRIVA  MDKSA-2006:145
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
(UNKNOWN)  MANDRIVA  MDKSA-2006:143
http://www.gentoo.org/security/en/glsa/glsa-200608-03.xml
(UNKNOWN)  GENTOO  GLSA-200608-03
http://security.gentoo.org/glsa/glsa-200608-04.xml
(UNKNOWN)  GENTOO  GLSA-200608-04
http://security.gentoo.org/glsa/glsa-200608-02.xml
(UNKNOWN)  GENTOO  GLSA-200608-02
http://secunia.com/advisories/22210
(UNKNOWN)  SECUNIA  22210
http://secunia.com/advisories/22066
(UNKNOWN)  SECUNIA  22066
http://secunia.com/advisories/22055
(UNKNOWN)  SECUNIA  22055
http://secunia.com/advisories/21631
(UNKNOWN)  SECUNIA  21631
http://secunia.com/advisories/21607
(UNKNOWN)  SECUNIA  21607
http://secunia.com/advisories/21532
(UNKNOWN)  SECUNIA  21532
http://secunia.com/advisories/21529
(UNKNOWN)  SECUNIA  21529
http://secunia.com/advisories/21361
(UNKNOWN)  SECUNIA  21361
http://secunia.com/advisories/21343
(UNKNOWN)  SECUNIA  21343
http://secunia.com/advisories/21336
(UNKNOWN)  SECUNIA  21336
http://secunia.com/advisories/21275
(UNKNOWN)  SECUNIA  21275
http://secunia.com/advisories/21270
(UNKNOWN)  SECUNIA  21270
http://secunia.com/advisories/21262
(UNKNOWN)  SECUNIA  21262
http://secunia.com/advisories/21246
(UNKNOWN)  SECUNIA  21246
http://secunia.com/advisories/21243
(UNKNOWN)  SECUNIA  21243
http://rhn.redhat.com/errata/RHSA-2006-0609.html
(UNKNOWN)  REDHAT  RHSA-2006:0609
ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc
(UNKNOWN)  SGI  20060703-01-P

- 漏洞信息

Mozilla Firefox/SeaMonkey/Thunderbird chrome参数中URL连接漏洞
低危 资料不足
2006-07-28 00:00:00 2006-08-01 00:00:00
远程  
        Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
        上述产品中存在多个安全漏洞,具体如下:
        允许远程攻击者关联远程文件同时可能读取chrome参数中URL,并复制地址或欺骗连接.

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://lwn.net/Alerts/193397/?format=printable
        http://lwn.net/Alerts/193396/?format=printable
        http://lwn.net/Alerts/193263/?format=printable

- 漏洞信息 (F48662)

Ubuntu Security Notice 327-1 (PacketStormID:F48662)
2006-07-28 00:00:00
Ubuntu  security.ubuntu.com
advisory,javascript,vulnerability
linux,ubuntu
CVE-2006-3113,CVE-2006-3677,CVE-2006-3801,CVE-2006-3802,CVE-2006-3803,CVE-2006-3805,CVE-2006-3806,CVE-2006-3807,CVE-2006-3808,CVE-2006-3809,CVE-2006-3810,CVE-2006-3811,CVE-2006-3812
[点击下载]

Ubuntu Security Notice USN-327-1 - A multitude of javascript related vulnerabilities have been patched in Firefox.

=========================================================== 
Ubuntu Security Notice USN-327-1              July 27, 2006
firefox vulnerabilities
CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
CVE-2006-3812
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  firefox                      1.5.dfsg+1.5.0.5-0ubuntu6.06

After a standard system upgrade you need to restart Firefox to effect
the necessary changes.

Please note that Firefox 1.0.8 in Ubuntu 5.10 and Ubuntu 5.04 are also
affected by these problems. Updates for these Ubuntu releases will be
delayed due to upstream dropping support for this Firefox version. We
strongly advise that you disable JavaScript to disable the attack
vectors for most vulnerabilities if you use one of these Ubuntu
versions.

Details follow:

Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious URL. (CVE-2006-3113, CVE-2006-3677, CVE-2006-3801,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3809, CVE-2006-3811, CVE-2006-3812)

cross-site scripting vulnerabilities were found in the
XPCNativeWrapper() function and native DOM method handlers. A
malicious web site could exploit these to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-3802, CVE-2006-3810)

A bug was found in the script handler for automatic proxy
configuration. A malicious proxy could send scripts which could
execute arbitrary code with the user's privileges. (CVE-2006-3808)

Please see 

  http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox

for technical details of these vulnerabilities.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.diff.gz
      Size/MD5:   174602 7be6f5862219ac4cf44f05733f372f2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.dsc
      Size/MD5:     1109 252d6acf45b009008a6bc88166e2632f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5.orig.tar.gz
      Size/MD5: 44067762 749933c002e158576ec15782fc451e43

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    49190 850dd650e7f876dd539e605d9b3026c8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    50078 c1fa4a40187d9c5b58bd049edb00ce54

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5: 47269292 167aadc3f03b4e1b7cb9ed826e672983
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  2796768 b54592d0bd736f6ee12a90987771bc59
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   216136 79fa6c69ffb0dd6037e56d1ba538ff64
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:    82358 e2e026d582a7b5352cee4453cef0fe45
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  9400544 a9d0b804a4374dc636bb79968a2bce5c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   218822 a09476caea7d8d73d6a2f534bd494493
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   161876 0e0e65348dba8167b4891b173baa8f0d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   235746 064fc1434a315f857ee92f60fd49d772
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   757458 bd6a5e28e05a04a5deca731ab29f70e4

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5: 43837610 a7e4a535262f8a5d5cb0ace7ed785237
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  2796700 4509dbf62e3fd2cda7168c20aa65ba4f
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   209546 50e174c1c7290fca51f9e1ee71ebb56c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:    74732 25ba86caeeb1a88da4493875178a3636
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  7916536 40ebfe4330af25c2359f8b25b039ed5e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   218822 6066f59acbce1b4de2dc284b5801efc5
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   146570 c1a5c5cc4371b228093d03d9ed7ad607
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   235754 0e9a1a89f63a9869b875ee6a50547c2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   669556 d537a4771b80e5c06f18b2c5d7e5d384

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5: 48648192 479d29e08ff2b9cef89a6da3285c0aad
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  2796790 60b97738bfc3b8b32914487bb4aba239
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   212982 a396e119a32303afc024d513b997c84e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:    77894 ef7841bb2ab8de0e0c44e59c893b1622
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  9019132 ed3927484eea5fccf84a2840640febf3
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   218826 a2338c3c8064a304deb752bf32a291f8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   159112 7d5d6100727ceb894695b219cec11e43
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   235754 69085beb145222fea07d2d6c19158a2d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   768332 8dc6cc8c54185d57af14bab3bee39f9d

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5: 45235424 f5a07188af5802fffbd3cfdd64b109cf
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  2796756 cb13c7ea0e3b7af2f1e12db1f8dc38a2
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   210488 17f7723b697110c8f132422bc059d447
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:    76340 c38ccb8b71b9c3783a1c9816ecd9cf5d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  8411310 4b3865b2df3924d094e0b18f207bf33d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   218814 a0e67d0d425cea2cd5835e2c2faa930f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   149018 73108368f0ef745188ebd1c48ea10c88
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   235746 695a6122710fb30201daaa239ba6d48d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   681612 896721beb3cdcea12bab98223c0796c2
    

- 漏洞信息

27564
Mozilla Multiple Products Chrome Scheme Remote Script Execution
Remote / Network Access
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-07-25 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Mozilla Multiple Products Remote Vulnerabilities
Unknown 19181
Yes No
2006-07-26 12:00:00 2007-09-05 03:42:00
Thilo Girmann, Secunia, Thor Larholm, TippingPoint and the Zero Day Initiative, H. D. Moore, Igor Bukanov, shutdown, Georgi Guninski, moz_bug_r_a4, Benjamin Smedberg, Daniel Veditz, and Mozilla developers are credited with reporting these vulnerabilities.

- 受影响的程序版本

Ubuntu Ubuntu Linux 5.10 sparc
Ubuntu Ubuntu Linux 5.10 powerpc
Ubuntu Ubuntu Linux 5.10 i386
Ubuntu Ubuntu Linux 5.10 amd64
Ubuntu Ubuntu Linux 5.0 4 powerpc
Ubuntu Ubuntu Linux 5.0 4 i386
Ubuntu Ubuntu Linux 5.0 4 amd64
Ubuntu Ubuntu Linux 6.06 LTS sparc
Ubuntu Ubuntu Linux 6.06 LTS powerpc
Ubuntu Ubuntu Linux 6.06 LTS i386
Ubuntu Ubuntu Linux 6.06 LTS amd64
SuSE SUSE Linux Enterprise Server 10
SuSE SUSE Linux Enterprise SDK 10
Sun Solaris 9_x86
Sun Solaris 9
Sun Solaris 8_x86
Sun Solaris 8_sparc
Sun Solaris 10_x86
Sun Solaris 10.0_x86
Sun Solaris 10.0
Sun Solaris 10
Slackware Linux 10.2
Slackware Linux -current
SGI ProPack 3.0 SP6
S.u.S.E. Novell Linux Desktop 9.0
S.u.S.E. Linux Professional 10.0 OSS
S.u.S.E. Linux Professional 10.0
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 10.1
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
rPath rPath Linux 1
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Desktop 4.0
RedHat Desktop 3.0
RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
RedHat Advanced Workstation for the Itanium Processor 2.1
Red Hat Enterprise Linux AS 4
Red Hat Enterprise Linux AS 3
Red Hat Enterprise Linux AS 2.1 IA64
Red Hat Enterprise Linux AS 2.1
Mozilla Thunderbird 1.5 beta 2
Mozilla Thunderbird 1.5
Mozilla Thunderbird 1.0.8
Mozilla Thunderbird 1.0.7
Mozilla Thunderbird 1.0.6
Mozilla Thunderbird 1.0.5
Mozilla Thunderbird 1.0.2
Mozilla Thunderbird 1.0.1
Mozilla Thunderbird 1.0
Mozilla Thunderbird 0.9
Mozilla Thunderbird 0.8
Mozilla Thunderbird 0.7.3
Mozilla Thunderbird 0.7.2
Mozilla Thunderbird 0.7.1
Mozilla Thunderbird 0.7
Mozilla Thunderbird 0.6
Mozilla Thunderbird 1.5.0.2
Mozilla Thunderbird 1.5.0.1
Mozilla SeaMonkey 1.0.2
Mozilla SeaMonkey 1.0.1
Mozilla SeaMonkey 1.0 dev
Mozilla SeaMonkey 1.0
Mozilla Firefox 1.5 beta 2
Mozilla Firefox 1.5 beta 1
Mozilla Firefox 1.5
Mozilla Firefox 1.0.8
Mozilla Firefox 1.0.7
Mozilla Firefox 1.0.6
Mozilla Firefox 1.0.5
Mozilla Firefox 1.0.5
Mozilla Firefox 1.0.4
Mozilla Firefox 1.0.3
+ Gentoo Linux
Mozilla Firefox 1.0.2
+ Mandriva Linux Mandrake 10.2 x86_64
+ Mandriva Linux Mandrake 10.2
+ Mandriva Linux Mandrake 10.2
+ Red Hat Enterprise Linux AS 4
+ Red Hat Enterprise Linux AS 4
+ RedHat Desktop 4.0
+ RedHat Desktop 4.0
+ RedHat Enterprise Linux ES 4
+ RedHat Enterprise Linux ES 4
+ RedHat Enterprise Linux WS 4
+ RedHat Enterprise Linux WS 4
Mozilla Firefox 1.0.1
+ Red Hat Fedora Core3
Mozilla Firefox 1.0
+ Gentoo Linux
+ Gentoo Linux
+ S.u.S.E. Linux Personal 9.2 x86_64
+ S.u.S.E. Linux Personal 9.2 x86_64
+ S.u.S.E. Linux Personal 9.2
+ S.u.S.E. Linux Personal 9.2
+ S.u.S.E. Linux Personal 9.1 x86_64
+ S.u.S.E. Linux Personal 9.1 x86_64
+ S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.0 x86_64
+ S.u.S.E. Linux Personal 9.0 x86_64
+ S.u.S.E. Linux Personal 9.0
+ S.u.S.E. Linux Personal 9.0
+ Slackware Linux 10.1
+ Slackware Linux 10.0
+ Slackware Linux 10.0
+ Slackware Linux 9.1
+ Slackware Linux 9.1
+ Slackware Linux -current
+ Slackware Linux -current
Mozilla Firefox 0.10.1
Mozilla Firefox 0.10
Mozilla Firefox 0.9.3
Mozilla Firefox 0.9.2
Mozilla Firefox 0.9.1
Mozilla Firefox 0.9 rc
Mozilla Firefox 0.9
Mozilla Firefox 0.8
Mozilla Firefox Preview Release
Mozilla Firefox 1.5.0.4
Mozilla Firefox 1.5.0.3
Mozilla Firefox 1.5.0.2
Mozilla Firefox 1.5.0.2
Mozilla Firefox 1.5.0.1
Mandriva Linux Mandrake 2006.0 x86_64
Mandriva Linux Mandrake 2006.0
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
HP HP-UX B.11.31
HP HP-UX B.11.23
HP HP-UX B.11.11
HP HP-UX B.11.11
Gentoo Linux
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1
Avaya Interactive Response 2.0
Mozilla Thunderbird 1.5.0.4
Mozilla SeaMonkey 1.0.3
Mozilla Firefox 1.5.0.5

- 不受影响的程序版本

Mozilla Thunderbird 1.5.0.4
Mozilla SeaMonkey 1.0.3
Mozilla Firefox 1.5.0.5

- 漏洞讨论

The Mozilla Foundation has released thirteen security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- run arbitrary script code with elevated privileges
- gain access to potentially sensitive information
- carry out cross-domain scripting attacks.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as more information becomes available.

These issues are fixed in:

- Mozilla Firefox 1.5.0.5
- Mozilla Thunderbird 1.5.0.5
- Mozilla SeaMonkey 1.0.3

- 漏洞利用

Some of the vulnerabilities described in this BID do not require exploits.

Proof-of-concept exploits are available in the Mozilla Bugzilla database, but they are not currently available to the general public.

- 解决方案

New versions of Firefox, SeaMonkey, Camino, and Thunderbird are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.

Please see the referenced advisories for information on obtaining and applying fixes.


Sun Solaris 10.0

Mozilla Firefox 1.5.0.3

Mozilla Firefox 1.5.0.2

Sun Solaris 8_sparc

Mozilla Firefox 1.5.0.1

Mozilla Thunderbird 1.5.0.2

Sun Solaris 10.0_x86

Mozilla Firefox 0.10

Mozilla Thunderbird 0.7.2

Mozilla Thunderbird 0.7.3

Mozilla Firefox 0.8

Mozilla Thunderbird 0.8

Mozilla Firefox 0.9

Mozilla Thunderbird 0.9

Mozilla Firefox 0.9.1

Mozilla Firefox 0.9.2

Mozilla Firefox 0.9.3

Mozilla Firefox 1.0

Mozilla Firefox 1.0.1

Mozilla Thunderbird 1.0.1

Mozilla SeaMonkey 1.0.1

Mozilla SeaMonkey 1.0.2

Mozilla Firefox 1.0.2

Mozilla Firefox 1.0.3

Mozilla Firefox 1.0.4

Mozilla Firefox 1.0.5

Mozilla Firefox 1.0.5

Mozilla Thunderbird 1.0.5

Mozilla Firefox 1.0.6

Mozilla Thunderbird 1.0.6

Mozilla Thunderbird 1.0.7

Mozilla Firefox 1.0.8

Mozilla Firefox 1.5

Mozilla Firefox 1.5 beta 2

Mozilla Thunderbird 1.5

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站