Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to DHTML.

Mozilla 1.7 for Solaris 8 and 9.
Date this patch was last updated by Sun : Aug/29/08

Mozilla 1.7_x86 for Solaris 8 and 9.
Date this patch was last updated by Sun : Sep/02/08

Several security related problems have been discovered in Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-2353     The 'run-mozilla.sh' script allows local users to create     or overwrite arbitrary files when debugging is enabled     via a symlink attack on temporary files.

  - CVE-2005-4134     Web pages with extremely long titles cause subsequent     launches of the browser to appear to 'hang' for up to a     few minutes, or even crash if the computer has     insufficient memory. [MFSA-2006-03]

  - CVE-2006-0292     The JavaScript interpreter does not properly dereference     objects, which allows remote attackers to cause a denial     of service or execute arbitrary code. [MFSA-2006-01]

  - CVE-2006-0293     The function allocation code allows attackers to cause a     denial of service and possibly execute arbitrary code.
    [MFSA-2006-01]

  - CVE-2006-0296     XULDocument.persist() did not validate the attribute     name, allowing an attacker to inject arbitrary XML and     JavaScript code into localstore.rdf that would be read     and acted upon during startup. [MFSA-2006-05]

  - CVE-2006-0748     An anonymous researcher for TippingPoint and the Zero     Day Initiative reported that an invalid and nonsensical     ordering of table-related tags can be exploited to     execute arbitrary code. [MFSA-2006-27]

  - CVE-2006-0749     A particular sequence of HTML tags can cause memory     corruption that can be exploited to execute arbitrary     code. [MFSA-2006-18]

  - CVE-2006-0884     Georgi Guninski reports that forwarding mail in-line     while using the default HTML 'rich mail' editor will     execute JavaScript embedded in the e-mail message with     full privileges of the client. [MFSA-2006-21]

  - CVE-2006-1045     The HTML rendering engine does not properly block     external images from inline HTML attachments when 'Block     loading of remote images in mail messages' is enabled,     which could allow remote attackers to obtain sensitive     information. [MFSA-2006-26]

  - CVE-2006-1529     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1530     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1531     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1723     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1724     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1727     Georgi Guninski reported two variants of using scripts     in an XBL control to gain chrome privileges when the     page is viewed under 'Print Preview'. [MFSA-2006-25]

  - CVE-2006-1728     'shutdown' discovered that the     crypto.generateCRMFRequest method can be used to run     arbitrary code with the privilege of the user running     the browser, which could enable an attacker to install     malware. [MFSA-2006-24]

  - CVE-2006-1729     Claus Jorgensen reported that a text input box can be     pre-filled with a filename and then turned into a     file-upload control, allowing a malicious website to     steal any local file whose name they can guess.
    [MFSA-2006-23]

  - CVE-2006-1730     An anonymous researcher for TippingPoint and the Zero     Day Initiative discovered an integer overflow triggered     by the CSS letter-spacing property, which could be     exploited to execute arbitrary code. [MFSA-2006-22]

  - CVE-2006-1731     'moz_bug_r_a4' discovered that some internal functions     return prototypes instead of objects, which allows     remote attackers to conduct cross-site scripting     attacks. [MFSA-2006-19]

  - CVE-2006-1732     'shutdown' discovered that it is possible to bypass     same-origin protections, allowing a malicious site to     inject script into content from another site, which     could allow the malicious page to steal information such     as cookies or passwords from the other site, or perform     transactions on the user's behalf if the user were     already logged in. [MFSA-2006-17]

  - CVE-2006-1733     'moz_bug_r_a4' discovered that the compilation scope of     privileged built-in XBL bindings is not fully protected     from web content and can still be executed which could     be used to execute arbitrary JavaScript, which could     allow an attacker to install malware such as viruses and     password sniffers. [MFSA-2006-16]

  - CVE-2006-1734     'shutdown' discovered that it is possible to access an     internal function object which could then be used to run     arbitrary JavaScript code with full permissions of the     user running the browser, which could be used to install     spyware or viruses. [MFSA-2006-15]

  - CVE-2006-1735     It is possible to create JavaScript functions that would     get compiled with the wrong privileges, allowing an     attacker to run code of their choice with full     permissions of the user running the browser, which could     be used to install spyware or viruses. [MFSA-2006-14]

  - CVE-2006-1736     It is possible to trick users into downloading and     saving an executable file via an image that is overlaid     by a transparent image link that points to the     executable. [MFSA-2006-13]

  - CVE-2006-1737     An integer overflow allows remote attackers to cause a     denial of service and possibly execute arbitrary     bytecode via JavaScript with a large regular expression.
    [MFSA-2006-11]

  - CVE-2006-1738     An unspecified vulnerability allows remote attackers to     cause a denial of service. [MFSA-2006-11]

  - CVE-2006-1739     Certain Cascading Style Sheets (CSS) can cause an     out-of-bounds array write and buffer overflow that could     lead to a denial of service and the possible execution     of arbitrary code. [MFSA-2006-11]

  - CVE-2006-1740     It is possible for remote attackers to spoof secure site     indicators such as the locked icon by opening the     trusted site in a popup window, then changing the     location to a malicious site. [MFSA-2006-12]

  - CVE-2006-1741     'shutdown' discovered that it is possible to inject     arbitrary JavaScript code into a page on another site     using a modal alert to suspend an event handler while a     new page is being loaded. This could be used to steal     confidential information. [MFSA-2006-09]

  - CVE-2006-1742     Igor Bukanov discovered that the JavaScript engine does     not properly handle temporary variables, which might     allow remote attackers to trigger operations on freed     memory and cause memory corruption. [MFSA-2006-10]

  - CVE-2006-1790     A regression fix that could lead to memory corruption     allows remote attackers to cause a denial of service and     possibly execute arbitrary code. [MFSA-2006-11]

Several security related problems have been discovered in Mozilla. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-2353     The 'run-mozilla.sh' script allows local users to create     or overwrite arbitrary files when debugging is enabled     via a symlink attack on temporary files.

  - CVE-2005-4134     Web pages with extremely long titles cause subsequent     launches of the browser to appear to 'hang' for up to a     few minutes, or even crash if the computer has     insufficient memory. [MFSA-2006-03]

  - CVE-2006-0292     The JavaScript interpreter does not properly dereference     objects, which allows remote attackers to cause a denial     of service or execute arbitrary code. [MFSA-2006-01]

  - CVE-2006-0293     The function allocation code allows attackers to cause a     denial of service and possibly execute arbitrary code.
    [MFSA-2006-01]

  - CVE-2006-0296     XULDocument.persist() did not validate the attribute     name, allowing an attacker to inject arbitrary XML and     JavaScript code into localstore.rdf that would be read     and acted upon during startup. [MFSA-2006-05]

  - CVE-2006-0748     An anonymous researcher for TippingPoint and the Zero     Day Initiative reported that an invalid and nonsensical     ordering of table-related tags can be exploited to     execute arbitrary code. [MFSA-2006-27]

  - CVE-2006-0749     A particular sequence of HTML tags can cause memory     corruption that can be exploited to execute arbitrary     code. [MFSA-2006-18]

  - CVE-2006-0884     Georgi Guninski reports that forwarding mail in-line     while using the default HTML 'rich mail' editor will     execute JavaScript embedded in the e-mail message with     full privileges of the client. [MFSA-2006-21]

  - CVE-2006-1045     The HTML rendering engine does not properly block     external images from inline HTML attachments when 'Block     loading of remote images in mail messages' is enabled,     which could allow remote attackers to obtain sensitive     information. [MFSA-2006-26]

  - CVE-2006-1529     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1530     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1531     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1723     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1724     A vulnerability potentially allows remote attackers to     cause a denial of service and possibly execute arbitrary     code. [MFSA-2006-20]

  - CVE-2006-1725     Due to an interaction between XUL content windows and     the history mechanism, some windows may to become     translucent, which might allow remote attackers to     execute arbitrary code. [MFSA-2006-29]

  - CVE-2006-1726     'shutdown' discovered that the security check of the     function js_ValueToFunctionObject() can be circumvented     and exploited to allow the installation of malware.
    [MFSA-2006-28]

  - CVE-2006-1727     Georgi Guninski reported two variants of using scripts     in an XBL control to gain chrome privileges when the     page is viewed under 'Print Preview'. [MFSA-2006-25]

  - CVE-2006-1728     'shutdown' discovered that the     crypto.generateCRMFRequest method can be used to run     arbitrary code with the privilege of the user running     the browser, which could enable an attacker to install     malware. [MFSA-2006-24]

  - CVE-2006-1729     Claus Jorgensen reported that a text input box can be     pre-filled with a filename and then turned into a     file-upload control, allowing a malicious website to     steal any local file whose name they can guess.
    [MFSA-2006-23]

  - CVE-2006-1730     An anonymous researcher for TippingPoint and the Zero     Day Initiative discovered an integer overflow triggered     by the CSS letter-spacing property, which could be     exploited to execute arbitrary code. [MFSA-2006-22]

  - CVE-2006-1731     'moz_bug_r_a4' discovered that some internal functions     return prototypes instead of objects, which allows     remote attackers to conduct cross-site scripting     attacks. [MFSA-2006-19]

  - CVE-2006-1732     'shutdown' discovered that it is possible to bypass     same-origin protections, allowing a malicious site to     inject script into content from another site, which     could allow the malicious page to steal information such     as cookies or passwords from the other site, or perform     transactions on the user's behalf if the user were     already logged in. [MFSA-2006-17]

  - CVE-2006-1733     'moz_bug_r_a4' discovered that the compilation scope of     privileged built-in XBL bindings is not fully protected     from web content and can still be executed which could     be used to execute arbitrary JavaScript, which could     allow an attacker to install malware such as viruses and     password sniffers. [MFSA-2006-16]

  - CVE-2006-1734     'shutdown' discovered that it is possible to access an     internal function object which could then be used to run     arbitrary JavaScript code with full permissions of the     user running the browser, which could be used to install     spyware or viruses. [MFSA-2006-15]

  - CVE-2006-1735     It is possible to create JavaScript functions that would     get compiled with the wrong privileges, allowing an     attacker to run code of their choice with full     permissions of the user running the browser, which could     be used to install spyware or viruses. [MFSA-2006-14]

  - CVE-2006-1736     It is possible to trick users into downloading and     saving an executable file via an image that is overlaid     by a transparent image link that points to the     executable. [MFSA-2006-13]

  - CVE-2006-1737     An integer overflow allows remote attackers to cause a     denial of service and possibly execute arbitrary     bytecode via JavaScript with a large regular expression.
    [MFSA-2006-11]

  - CVE-2006-1738     An unspecified vulnerability allows remote attackers to     cause a denial of service. [MFSA-2006-11]

  - CVE-2006-1739     Certain Cascading Style Sheets (CSS) can cause an     out-of-bounds array write and buffer overflow that could     lead to a denial of service and the possible execution     of arbitrary code. [MFSA-2006-11]

  - CVE-2006-1740     It is possible for remote attackers to spoof secure site     indicators such as the locked icon by opening the     trusted site in a popup window, then changing the     location to a malicious site. [MFSA-2006-12]

  - CVE-2006-1741     'shutdown' discovered that it is possible to inject     arbitrary JavaScript code into a page on another site     using a modal alert to suspend an event handler while a     new page is being loaded. This could be used to steal     confidential information. [MFSA-2006-09]

  - CVE-2006-1742     Igor Bukanov discovered that the JavaScript engine does     not properly handle temporary variables, which might     allow remote attackers to trigger operations on freed     memory and cause memory corruption. [MFSA-2006-10]

  - CVE-2006-1790     A regression fix that could lead to memory corruption     allows remote attackers to cause a denial of service and     possibly execute arbitrary code. [MFSA-2006-11]

Updated thunderbird packages that fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several bugs were found in the way Thunderbird processes malformed JavaScript. A malicious HTML mail message could modify the content of a different open HTML mail message, possibly stealing sensitive information or conducting a cross-site scripting attack. Please note that JavaScript support is disabled by default in Thunderbird.
(CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Thunderbird processes certain JavaScript actions. A malicious HTML mail message could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-0292, CVE-2006-0296, CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Thunderbird processes malformed HTML mail messages. A carefully crafted malicious HTML mail message could cause the execution of arbitrary code as the user running Thunderbird. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Thunderbird processes certain inline content in HTML mail messages. It may be possible for a remote attacker to send a carefully crafted mail message to the victim, which will fetch remote content, even if Thunderbird is configured not to fetch remote content. (CVE-2006-1045)

A bug was found in the way Thunderbird executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'.
(CVE-2006-0884)

Users of Thunderbird are advised to upgrade to these updated packages containing Thunderbird version 1.0.8, which is not vulnerable to these issues.

Updated firefox packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 24 Apr 2006] The erratum text has been updated to include CVE-2006-0748, an issue fixed by these erratum packages but which was not public at the time of release. No changes have been made to the packages.

Mozilla Firefox is an open source Web browser.

Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740)

A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729)

Users of Firefox are advised to upgrade to these updated packages containing Firefox version 1.0.8 which corrects these issues.

Updated mozilla packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several bugs were found in the way Mozilla processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Mozilla processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Mozilla processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Mozilla.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Mozilla displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740)

A bug was found in the way Mozilla allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729)

A bug was found in the way Mozilla executes in-line mail forwarding.
If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'. (CVE-2006-0884)

Users of Mozilla are advised to upgrade to these updated packages containing Mozilla version 1.7.13 which corrects these issues.

A Mozilla Foundation Security Advisory reports of multiple issues.
Several of which can be used to run arbitrary code with the privilege of the user running the program.

- MFSA 2006-29 Spoofing with translucent windows

- MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented

- MFSA 2006-26 Mail Multiple Information Disclosure

- MFSA 2006-25 Privilege escalation through Print Preview

- MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest

- MFSA 2006-23 File stealing by changing input type

- MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability

- MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)

- MFSA 2006-19 Cross-site scripting using .valueOf.call()

- MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability

- MFSA 2006-17 cross-site scripting through window.controllers

- MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()

- MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent

- MFSA 2006-14 Privilege escalation via XBL.method.eval

- MFSA 2006-13 Downloading executables with 'Save Image As...'

- MFSA 2006-12 Secure-site spoof (requires security warning dialog)

- MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)

- MFSA 2006-10 JavaScript garbage-collection hazard audit

- MFSA 2006-09 Cross-site JavaScript injection using event handlers

Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox.
(CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790) 

A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740)

A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Windows host is using SeaMonkey, an alternative web browser and application suite. 

The installed version of SeaMonkey contains various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

The remote Windows host is using Firefox, an alternative web browser. 

The installed version of Firefox contains various security issues, some of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

The remote host is using SeaMonkey. The installed version of SeaMonkey contains various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.  The version of SeaMonkey is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a user to browse to a malicious URI.

Versions of Mozilla Firefox prior to 1.7.13 are affected by various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host. Additionally, these versions are affected by multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a Mozilla user to browse to a malicious URI. 

The remote host is running a vulnerable version of Mozilla Thunderbird mail client. This version of Thunderbird is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a user to open or read a malicious email.  Successful exploitation would give the attacker the ability to execute arbitrary code with the permissions of the user running Thunderbird. 

Versions of Mozilla Firefox prior to 1.5.0.2 or 1.0.8 are affected by various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.  The version of Firefox is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker  exploiting these flaws would need to be able to convince a Firefox user to browse to a malicious URI. 

The remote host is running a vulnerable version of Mozilla Thunderbird mail client. This version of Thunderbird is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a user to open or read a malicious email.  Successful exploitation would give the attacker the ability to execute arbitrary code with the permissions of the user running Thunderbird.

The remote host is using Mozilla. The installed version of Mozilla contains various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.  The version of Mozilla is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker exploiting these flaws would need to be able to convince a Mozilla user to browse to a malicious URI.

The remote host is using Firefox. The installed version of Firefox contains various security issues, several of which are critical as they can be easily exploited to execute arbitrary shell code on the remote host.  The version of Firefox is vulnerable to multiple denial of service attacks, overflows, information disclosure, privilege escalation, and other issues.  An attacker  exploiting these flaws would need to be able to convince a Firefox user to browse to a malicious URI.

ID	Name	Product	Family	Severity
24403	Solaris 9 (sparc) : 120671-08	Nessus	Solaris Local Security Checks	critical
24395	Solaris 8 (sparc) : 120671-08	Nessus	Solaris Local Security Checks	critical
23773	Solaris 9 (x86) : 120672-08	Nessus	Solaris Local Security Checks	critical
23772	Solaris 8 (x86) : 120672-08	Nessus	Solaris Local Security Checks	critical
22593	Debian DSA-1051-1 : mozilla-thunderbird - several vulnerabilities	Nessus	Debian Local Security Checks	critical
22588	Debian DSA-1046-1 : mozilla - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21994	CentOS 4 : thunderbird (CESA-2006:0330)	Nessus	CentOS Local Security Checks	critical
21993	CentOS 4 : firefox (CESA-2006:0328)	Nessus	CentOS Local Security Checks	critical
21898	CentOS 3 / 4 : mozilla (CESA-2006:0329)	Nessus	CentOS Local Security Checks	critical
21461	FreeBSD : mozilla -- multiple vulnerabilities (84630f4a-cd8c-11da-b7b9-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	critical
21288	RHEL 4 : thunderbird (RHSA-2006:0330)	Nessus	Red Hat Local Security Checks	critical
21257	RHEL 2.1 / 3 / 4 : mozilla (RHSA-2006:0329)	Nessus	Red Hat Local Security Checks	critical
21251	Fedora Core 5 : firefox-1.5.0.2-1.1.fc5 (2006-411)	Nessus	Fedora Local Security Checks	critical
21250	Fedora Core 4 : firefox-1.0.8-1.1.fc4 (2006-410)	Nessus	Fedora Local Security Checks	critical
21232	RHEL 4 : firefox (RHSA-2006:0328)	Nessus	Red Hat Local Security Checks	critical
21226	SeaMonkey < 1.0.1 Multiple Vulnerabilities	Nessus	Windows	high
21225	Firefox < 1.5.0.2 Multiple Vulnerabilities	Nessus	Windows	high
3516	SeaMonkey < 1.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3514	Mozilla Firefox < 1.7.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3513	Mozilla Thunderbird < 1.5.0.2 or 1.0.8 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	SMTP Clients	medium
3512	Mozilla Firefox < 1.0.8 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
801357	Mozilla Thunderbird < 1.5.0.2 or 1.0.8 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
801226	Mozilla Browser < 1.7.13 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801220	Mozilla Firefox < 1.5.0.2 or 1.0.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2006-1724

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

medium

medium

medium

medium

high

high

high