Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running Firefox process.

Mozilla Thunderbird was updated to 3.1.12 fixing various bugs and security issues :

Mozilla Foundation Security Advisory 2011-32 (MFSA 2011-32) http://www.mozilla.org/security/announce/2011/mfsa2011-32.html

Many of the issues listed below are not exploitable through mail since JavaScript is disabled by default in Thunderbird. These particular issues may be triggered while viewing RSS feeds and displaying full remote content rather than the feed summary. Addons that expose browser functionality may also enable such issues to be exploited.

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Miscellaneous memory safety hazards (rv:1.9.2.20)

Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Thunderbird 3.1 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Gary Kwong, Igor Bukanov, Nils and Bob Clary reported memory safety issues which affected Thunderbird 3.1. (CVE-2011-2982)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Crash in SVGTextElement.getCharNumAtPosition()

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability. (CVE-2011-0084)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Privilege escalation using event handlers

Mozilla security researcher moz_bug_r_a_4 reported a vulnerability in event management code that would permit JavaScript to be run in the wrong context, including that of a different website or potentially in a chrome-privileged context. (CVE-2011-2981)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Dangling pointer vulnerability in appendChild

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that appendChild did not correctly account for DOM objects it operated upon and could be exploited to dereference an invalid pointer. (CVE-2011-2378)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Privilege escalation dropping a tab element in content area

Mozilla security researcher moz_bug_r_a4 reported that web content could receive chrome privileges if it registered for drop events and a browser tab element was dropped into the content area. (CVE-2011-2984)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Binary planting vulnerability in ThinkPadSensor::Startup

Security researcher Mitja Kolsek of Acros Security reported that ThinkPadSensor::Startup could potentially be exploited to load a malicious DLL into the running process. (CVE-2011-2980)

dbg114-MozillaThunderbird-5050 MozillaThunderbird-5050 new_updateinfo Private data leakage using RegExp.input

Security researcher shutdown reported that data from other domains could be read when RegExp.input was set. (CVE-2011-2983)

Mozilla XULRunner was updated to version 1.9.2.20.

The update fixes bugs and security issues. Following security issues were fixed:
http://www.mozilla.org/security/announce/2011/mfsa2011-30.html Mozilla Foundation Security Advisory 2011-30 (MFSA 2011-30)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Miscellaneous memory safety hazards

Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Firefox 3.6 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Gary Kwong, Igor Bukanov, Nils and Bob Clary reported memory safety issues which affected Firefox 3.6. (CVE-2011-2982)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Crash in SVGTextElement.getCharNumAtPosition()

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability. (CVE-2011-0084)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Privilege escalation using event handlers

Mozilla security researcher moz_bug_r_a_4 reported a vulnerability in event management code that would permit JavaScript to be run in the wrong context, including that of a different website or potentially in a chrome-privileged context. (CVE-2011-2981)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Dangling pointer vulnerability in appendChild

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that appendChild did not correctly account for DOM objects it operated upon and could be exploited to dereference an invalid pointer. (CVE-2011-2378)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Privilege escalation dropping a tab element in content area

Mozilla security researcher moz_bug_r_a4 reported that web content could receive chrome privileges if it registered for drop events and a browser tab element was dropped into the content area. (CVE-2011-2984)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Binary planting vulnerability in ThinkPadSensor::Startup

Security researcher Mitja Kolsek of Acros Security reported that ThinkPadSensor::Startup could potentially be exploited to load a malicious DLL into the running process. (CVE-2011-2980) (This issue is likely Windows only)

dbg114-mozilla-js192-5010 mozilla-js192-5010 new_updateinfo Private data leakage using RegExp.input

Security researcher shutdown reported that data from other domains could be read when RegExp.input was set. (CVE-2011-2983)

Mozilla Thunderbird was updated to 3.1.12 fixing various bugs and security issues :

Mozilla Foundation Security Advisory 2011-32 (MFSA 2011-32) http://www.mozilla.org/security/announce/2011/mfsa2011-32.html

Many of the issues listed below are not exploitable through mail since JavaScript is disabled by default in Thunderbird. These particular issues may be triggered while viewing RSS feeds and displaying full remote content rather than the feed summary. Addons that expose browser functionality may also enable such issues to be exploited.

  - Miscellaneous memory safety hazards (rv:1.9.2.20)

    Mozilla developers and community members identified and     fixed several memory safety bugs in the browser engine     used in Thunderbird 3.1 and other Mozilla-based     products. Some of these bugs showed evidence of memory     corruption under certain circumstances, and we presume     that with enough effort at least some of these could be     exploited to run arbitrary code.

    Gary Kwong, Igor Bukanov, Nils and Bob Clary reported     memory safety issues which affected Thunderbird 3.1.
    (CVE-2011-2982)

  - Crash in SVGTextElement.getCharNumAtPosition()

    Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that a SVG text     manipulation routine contained a dangling pointer     vulnerability. (CVE-2011-0084)

  - Privilege escalation using event handlers

    Mozilla security researcher moz_bug_r_a_4 reported a     vulnerability in event management code that would permit     JavaScript to be run in the wrong context, including     that of a different website or potentially in a     chrome-privileged context. (CVE-2011-2981)

  - Dangling pointer vulnerability in appendChild

    Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that appendChild did     not correctly account for DOM objects it operated upon     and could be exploited to dereference an invalid     pointer. (CVE-2011-2378)

  - Privilege escalation dropping a tab element in content     area

    Mozilla security researcher moz_bug_r_a4 reported that     web content could receive chrome privileges if it     registered for drop events and a browser tab element was     dropped into the content area. (CVE-2011-2984)

  - Binary planting vulnerability in ThinkPadSensor::Startup

    Security researcher Mitja Kolsek of Acros Security     reported that ThinkPadSensor::Startup could potentially     be exploited to load a malicious DLL into the running     process. (CVE-2011-2980)

  - Private data leakage using RegExp.input

    Security researcher shutdown reported that data from     other domains could be read when RegExp.input was set.
    (CVE-2011-2983)

Mozilla Firefox was updated to version 3.6.20.

It fixes bugs and security issues. Following security issues were fixed: http://www.mozilla.org/security/announce/2011/mfsa2011-30.html Mozilla Foundation Security Advisory 2011-30 (MFSA 2011-30)

  - Miscellaneous memory safety hazards

    Mozilla developers and community members identified and     fixed several memory safety bugs in the browser engine     used in Firefox 3.6 and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption     under certain circumstances, and we presume that with     enough effort at least some of these could be exploited     to run arbitrary code.

    Gary Kwong, Igor Bukanov, Nils and Bob Clary reported     memory safety issues which affected Firefox 3.6.
    (CVE-2011-2982)

  - Crash in SVGTextElement.getCharNumAtPosition()

    Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that a SVG text     manipulation routine contained a dangling pointer     vulnerability. (CVE-2011-0084)

  - Privilege escalation using event handlers

    Mozilla security researcher moz_bug_r_a_4 reported a     vulnerability in event management code that would permit     JavaScript to be run in the wrong context, including     that of a different website or potentially in a     chrome-privileged context. (CVE-2011-2981)

  - Dangling pointer vulnerability in appendChild

    Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that appendChild did     not correctly account for DOM objects it operated upon     and could be exploited to dereference an invalid     pointer. (CVE-2011-2378)

  - Privilege escalation dropping a tab element in content     area

    Mozilla security researcher moz_bug_r_a4 reported that     web content could receive chrome privileges if it     registered for drop events and a browser tab element was     dropped into the content area. (CVE-2011-2984)

  - Binary planting vulnerability in ThinkPadSensor::Startup

    Security researcher Mitja Kolsek of Acros Security     reported that ThinkPadSensor::Startup could potentially     be exploited to load a malicious DLL into the running     process. (CVE-2011-2980) (This issue is likely Windows     only)

  - Private data leakage using RegExp.input

    Security researcher shutdown reported that data from     other domains could be read when RegExp.input was set.
    (CVE-2011-2983)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Mozilla Firefox was updated to version 3.6.20.

It fixes bugs and security issues. Following security issues were fixed: Mozilla Foundation Security Advisory 2011-30 - MFSA 2011-30

  - Miscellaneous memory safety hazards Mozilla developers     and community members identified and fixed several     memory safety bugs in the browser engine used in Firefox     3.6 and other Mozilla-based products. Some of these bugs     showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code.

    Gary Kwong, Igor Bukanov, Nils and Bob Clary reported     memory safety issues which affected Firefox 3.6.
    (CVE-2011-2982)

  - Crash in SVGTextElement.getCharNumAtPosition() Security     researcher regenrecht reported via TippingPoint's Zero     Day Initiative that a SVG text manipulation routine     contained a dangling pointer vulnerability.
    (CVE-2011-0084)

  - Privilege escalation using event handlers Mozilla     security researcher moz_bug_r_a_4 reported a     vulnerability in event management code that would permit     JavaScript to be run in the wrong context, including     that of a different website or potentially in a     chrome-privileged context. (CVE-2011-2981)

  - Dangling pointer vulnerability in appendChild Security     researcher regenrecht reported via TippingPoint's Zero     Day Initiative that appendChild did not correctly     account for DOM objects it operated upon and could be     exploited to dereference an invalid pointer.
    (CVE-2011-2378)

  - Privilege escalation dropping a tab element in content     area Mozilla security researcher moz_bug_r_a4 reported     that web content could receive chrome privileges if it     registered for drop events and a browser tab element was     dropped into the content area. (CVE-2011-2984)

  - Binary planting vulnerability in ThinkPadSensor::Startup     Security researcher Mitja Kolsek of Acros Security     reported that ThinkPadSensor::Startup could potentially     be exploited to load a malicious DLL into the running     process. (CVE-2011-2980) (This issue is likely Windows     only)

  - Private data leakage using RegExp.input Security     researcher shutdown reported that data from other     domains could be read when RegExp.input was set.
    (CVE-2011-2983)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 3.6 earlier than 3.6.20 are potentially affected by the following security issues : 

  - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)

.  -A DOM accounting error exists in the 'appendChild' JavaScript function that can allow an invalid pointer to be dereferenced. (CVE-2011-2378)

  - An error exists in 'ThinkPadSensor: : Startup' that can allow malicious DLLs to be loaded. (CVE-2011-2980)

  - An error exists in the event management code that can allow JavaScript to execute in the context of a different website and possibly in the chrome-privileged context. (CVE-2011-2981)

  - Various unspecified memory safety issues exist. (CVE-2011-2982)

  - A cross-domain information disclosure vulnerability exists if the configuration option 'RegExp.input' is set. (CVE-2011-2983)

  - A privilege escalation vulnerability exists if web content is registered to handle 'drop' events and a browser tab is dropped in that element's area.  This can allow the web content to execute with browser chrome privileges. (CVE-2011-2984)

Versions of Thunderbird 3.1 earlier than 3.1.12 are potentially affected by multiple vulnerabilities :

  - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2982)

  - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)

  - A dangling pointer vulnerability exists in appendChild, which did not correctly account for DOM objects it operated upon. (CVE-2011-2378)

  - A privilege escalation vulnerability in the event management code could permit JavaScript to be run in the wrong context. (CVE-2011-2981)

  - A privilege escalation vulnerability exists if a web page registered for drop events and a browser tab element was dropped into the content area. (CVE-2011-2984)

  - A binary planing vulnerability in ThinkPadSensor::Startup could permit loading a malicious DLL into the running process. (CVE-2011-2980)

  - A data leakage vulnerability triggered when RegExp.input was set could allow data from other domains to be read. (CVE-2011-2983)&lt;

Versions of Mozilla Thunderbird 3.1.x prior to 3.1.12 are affected by the following vulnerabilities :

 - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2982)
 - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)
 - A dangling pointer vulnerability exists in appendChild, which did not correctly account for DOM objects it operated upon. (CVE-2011-2378)
 - A privilege escalation vulnerability in the event management code could permit JavaScript to be run in the wrong context. (CVE-2011-2981)
 - A privilege escalation vulnerability exists if a web page registered for drop events and a browser tab element was dropped into the content area. (CVE-2011-2984)
 - A binary planing vulnerability in 'ThinkPadSensor::Startup' could permit loading a malicious DLL into the running process. (CVE-2011-2980)
 - A data leakage vulnerability triggered when RegExp.input was set could allow data from other domains to be read. (CVE-2011-2983)<

Versions of Firefox 3.6.x prior to 3.6.20 are affected by the following security issues :

 - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)
. -A DOM accounting error exists in the 'appendChild' JavaScript function that can allow an invalid pointer to be dereferenced. (CVE-2011-2378)
 - An error exists in 'ThinkPadSensor: : Startup' that can allow malicious DLLs to be loaded. (CVE-2011-2980)
 - An error exists in the event management code that can allow JavaScript to execute in the context of a different website and possibly in the chrome-privileged context. (CVE-2011-2981)
 - Various unspecified memory safety issues exist. (CVE-2011-2982)
 - A cross-domain information disclosure vulnerability exists if the configuration option 'RegExp.input' is set. (CVE-2011-2983)
 - A privilege escalation vulnerability exists if web content is registered to handle 'drop' events and a browser tab is dropped in that element's area.  This can allow the web content to execute with browser chrome privileges. (CVE-2011-2984)

The installed version of Firefox 3.6 is earlier than 3.6.20.  As such, it is potentially affected by the following security issues :

  - A dangling pointer vulnerability exists in an SVG text     manipulation routine. (CVE-2011-0084)

  - A DOM accounting error exists in the 'appendChild'     JavaScript function that can allow an invalid pointer     to be dereferenced. (CVE-2011-2378)

  - An error exists in 'ThinkPadSensor::Startup' that can     allow malicious DLLs to be loaded. (CVE-2011-2980)

  - An error exists in the event management code that can     allow JavaScript to execute in the context of a     different website and possibly in the     chrome-privileged context. (CVE-2011-2981)

  - Various unspecified memory safety issues exist.     (CVE-2011-2982)

  - A cross-domain information disclosure vulnerability     exists if the configuration option 'RegExp.input' is     set. (CVE-2011-2983)

  - A privilege escalation vulnerability exists if web     content is registered to handle 'drop' events and a     browser tab is dropped in that element's area. This     can allow the web content to execute with browser     chrome privileges. (CVE-2011-2984)

Security issues were identified and fixed in mozilla firefox and thunderbird :

Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Firefox 3.6 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2011-2982).

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability (CVE-2011-0084).

Mozilla security researcher moz_bug_r_a_4 reported a vulnerability in event management code that would permit JavaScript to be run in the wrong context, including that of a different website or potentially in a chrome-privileged context (CVE-2011-2981).

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that appendChild did not correctly account for DOM objects it operated upon and could be exploited to dereference an invalid pointer (CVE-2011-2378).

Mozilla security researcher moz_bug_r_a4 reported that web content could receive chrome privileges if it registered for drop events and a browser tab element was dropped into the content area (CVE-2011-2984).

Security researcher Mitja Kolsek of Acros Security reported that ThinkPadSensor::Startup could potentially be exploited to load a malicious DLL into the running process (CVE-2011-2980).

Security researcher shutdown reported that data from other domains could be read when RegExp.input was set (CVE-2011-2983).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The installed version of Thunderbird 3.1 is earlier than 3.1.12.  As such, it is potentially affected by the following security issues :

  - Several memory safety bugs exist in the browser engine     that may permit remote code execution. (CVE-2011-2982)

  - A dangling pointer vulnerability exists in an SVG text     manipulation routine. (CVE-2011-0084)

  - A dangling pointer vulnerability exists in appendChild,     which did not correctly account for DOM objects it     operated upon. (CVE-2011-2378)

  - A privilege escalation vulnerability in the event     management code could permit JavaScript to be run in the     wrong context. (CVE-2011-2981)

  - A privilege escalation vulnerability exists if a web page     registered for drop events and a browser tab element was     dropped into the content area. (CVE-2011-2984)

  - A binary planting vulnerability in     ThinkPadSensor::Startup could permit loading a     malicious DLL into the running process. (CVE-2011-2980)

  - A data leakage vulnerability triggered when RegExp.input     was set could allow data from other domains to be read.
    (CVE-2011-2983)

The Mozilla Project reports :

MFSA 2011-29 Security issues addressed in Firefox 6

MFSA 2011-28 Security issues addressed in Firefox 3.6.20

ID	Name	Product	Family	Severity
75966	openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-5050)	Nessus	SuSE Local Security Checks	critical
75958	openSUSE Security Update : mozilla-js192 (mozilla-js192-5010)	Nessus	SuSE Local Security Checks	critical
75666	openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2011:0935-2)	Nessus	SuSE Local Security Checks	critical
75654	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:0958-1)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
57150	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7713)	Nessus	SuSE Local Security Checks	critical
56005	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7712)	Nessus	SuSE Local Security Checks	critical
56003	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5057)	Nessus	SuSE Local Security Checks	critical
801343	Mozilla Firefox 3.6 < 3.6.20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801256	Mozilla Thunderbird 3.1 < 3.1.12 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6011	Mozilla Thunderbird 3.1.x < 3.1.12 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6009	Mozilla Firefox 3.6.x < 3.6.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
55901	Firefox 3.6 < 3.6.20 Multiple Vulnerabilities	Nessus	Windows	high
55894	Mandriva Linux Security Advisory : mozilla (MDVSA-2011:127)	Nessus	Mandriva Local Security Checks	critical
55886	Mozilla Thunderbird 3.1 < 3.1.12 Multiple Vulnerabilities	Nessus	Windows	critical
55878	FreeBSD : mozilla -- multiple vulnerabilities (834591a9-c82f-11e0-897d-6c626dd55a41)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-2980

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

critical

critical

critical