The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement WebGL, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

Mozilla SeaMonkey suite was updated to version 2.3.

The update fixes bugs and security issues. Following security issues were fixed:
http://www.mozilla.org/security/announce/2011/mfsa2011-33.html Mozilla Foundation Security Advisory 2011-33 (MFSA 2011-33) Mozilla Foundation Security Advisory 2011-33

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Miscellaneous memory safety hazards (rv:4.0) Mozilla identified and fixed several memory safety bugs in the browser engine used in SeaMonkey 2.2 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Aral Yaman reported a WebGL crash which affected SeaMonkey 2.2.
(CVE-2011-2989)

Vivekanand Bolajwar reported a JavaScript crash which affected SeaMonkey 2.2. (CVE-2011-2991)

Bert Hubert and Theo Snelleman of Fox-IT reported a crash in the Ogg reader which affected SeaMonkey 2.2. (CVE-2011-2992)

Mozilla developers and community members Robert Kaiser, Jesse Ruderman, moz_bug_r_a4, Mardeg, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary and Jonathan Watt reported memory safety issues which affected SeaMonkey 2.2. (CVE-2011-2985)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Unsigned scripts can call script inside signed JAR

Rafael Gieschke reported that unsigned JavaScript could call into script inside a signed JAR thereby inheriting the identity of the site that signed the JAR as well as any permissions that a user had granted the signed JAR. (CVE-2011-2993)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 String crash using WebGL shaders

Michael Jordon of Context IS reported that an overly long shader program could cause a buffer overrun and crash in a string class used to store the shader source code. (CVE-2011-2988)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Heap overflow in ANGLE library

Michael Jordon of Context IS reported a potentially exploitable heap overflow in the ANGLE library used by Mozilla's WebGL implementation.
(CVE-2011-2987)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Crash in SVGTextElement.getCharNumAtPosition()

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability. (CVE-2011-0084)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Credential leakage using Content Security Policy reports

Mike Cardwell reported that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. Daniel Veditz reported that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy. (CVE-2011-2990)

dbg114-seamonkey-5024 new_updateinfo seamonkey-5024 Cross-origin data theft using canvas and Windows D2D

nasalislarvatus3000 reported that when using Windows D2D hardware acceleration, image data from one domain could be inserted into a canvas and read by a different domain. (CVE-2011-2986)

Mozilla Firefox was updated to version 6.

It brings new features, fixes bugs and security issues. Following security issues were fixed:
http://www.mozilla.org/security/announce/2011/mfsa2011-29.html Mozilla Foundation Security Advisory 2011-29 (MFSA 2011-29)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Miscellaneous memory safety hazards: Mozilla identified and fixed several memory safety bugs in the browser engine used in Firefox 4, Firefox 5 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Aral Yaman reported a WebGL crash which affected Firefox 4 and Firefox 5. (CVE-2011-2989)

Vivekanand Bolajwar reported a JavaScript crash which affected Firefox 4 and Firefox 5. (CVE-2011-2991)

Bert Hubert and Theo Snelleman of Fox-IT reported a crash in the Ogg reader which affected Firefox 4 and Firefox 5. (CVE-2011-2992)

Mozilla developers and community members Robert Kaiser, Jesse Ruderman, moz_bug_r_a4, Mardeg, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary and Jonathan Watt reported memory safety issues which affected Firefox 4 and Firefox 5. (CVE-2011-2985)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Unsigned scripts can call script inside signed JAR Rafael Gieschke reported that unsigned JavaScript could call into script inside a signed JAR thereby inheriting the identity of the site that signed the JAR as well as any permissions that a user had granted the signed JAR.
(CVE-2011-2993)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo String crash using WebGL shaders Michael Jordon of Context IS reported that an overly long shader program could cause a buffer overrun and crash in a string class used to store the shader source code.
(CVE-2011-2988)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Heap overflow in ANGLE library Michael Jordon of Context IS reported a potentially exploitable heap overflow in the ANGLE library used by Mozilla's WebGL implementation. (CVE-2011-2987)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Crash in SVGTextElement.getCharNumAtPosition() Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a SVG text manipulation routine contained a dangling pointer vulnerability.
(CVE-2011-0084)

dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Credential leakage using Content Security Policy reports Mike Cardwell reported that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. Daniel Veditz reported that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy. (CVE-2011-2990) dbg114-MozillaFirefox-5020 MozillaFirefox-5020 new_updateinfo Cross-origin data theft using canvas and Windows D2D nasalislarvatus3000 reported that when using Windows D2D hardware acceleration, image data from one domain could be inserted into a canvas and read by a different domain. (CVE-2011-2986)

Mozilla SeaMonkey suite was updated to version 2.3.

The update fixes bugs and security issues. Following security issues were fixed:
http://www.mozilla.org/security/announce/2011/mfsa2011-33.html Mozilla Foundation Security Advisory 2011-33 (MFSA 2011-33) Mozilla Foundation Security Advisory 2011-33

  - Miscellaneous memory safety hazards (rv:4.0) Mozilla     identified and fixed several memory safety bugs in the     browser engine used in SeaMonkey 2.2 and other     Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code.

    Aral Yaman reported a WebGL crash which affected     SeaMonkey 2.2. (CVE-2011-2989)

    Vivekanand Bolajwar reported a JavaScript crash which     affected SeaMonkey 2.2. (CVE-2011-2991)

    Bert Hubert and Theo Snelleman of Fox-IT reported a     crash in the Ogg reader which affected SeaMonkey 2.2.
    (CVE-2011-2992)

    Mozilla developers and community members Robert Kaiser,     Jesse Ruderman, moz_bug_r_a4, Mardeg, Gary Kwong,     Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob     Clary and Jonathan Watt reported memory safety issues     which affected SeaMonkey 2.2. (CVE-2011-2985)

  - Unsigned scripts can call script inside signed JAR

    Rafael Gieschke reported that unsigned JavaScript could     call into script inside a signed JAR thereby inheriting     the identity of the site that signed the JAR as well as     any permissions that a user had granted the signed JAR.
    (CVE-2011-2993)

  - String crash using WebGL shaders

    Michael Jordon of Context IS reported that an overly     long shader program could cause a buffer overrun and     crash in a string class used to store the shader source     code. (CVE-2011-2988)

  - Heap overflow in ANGLE library

    Michael Jordon of Context IS reported a potentially     exploitable heap overflow in the ANGLE library used by     Mozilla's WebGL implementation. (CVE-2011-2987)

  - Crash in SVGTextElement.getCharNumAtPosition()

    Security researcher regenrecht reported via     TippingPoint's Zero Day Initiative that a SVG text     manipulation routine contained a dangling pointer     vulnerability. (CVE-2011-0084)

  - Credential leakage using Content Security Policy reports

    Mike Cardwell reported that Content Security Policy     violation reports failed to strip out proxy     authorization credentials from the list of request     headers. Daniel Veditz reported that redirecting to a     website with Content Security Policy resulted in the     incorrect resolution of hosts in the constructed policy.
    (CVE-2011-2990)

  - Cross-origin data theft using canvas and Windows D2D

    nasalislarvatus3000 reported that when using Windows D2D     hardware acceleration, image data from one domain could     be inserted into a canvas and read by a different     domain. (CVE-2011-2986)

Changes in xulrunner :

  - update to 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

Changes in MozillaFirefox :

  - update to Firefox 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

  - recommend libcanberra0 for proper sound notifications

Changes in MozillaThunderbird :

  - update to Thunderbird 12.0 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update Enigmail to 1.4.1

  - added mozilla-revert_621446.patch

  - added mozilla-libnotify.patch (bmo#737646)

  - added mailnew-showalert.patch (bmo#739146)

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

  - disabled crashreporter temporarily for Factory (gcc 4.7     issue)

Changes in seamonkey :

  - update to SeaMonkey 2.9 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update to 2.9b4

  - added mozilla-sle11.patch and add exceptions to be able     to build for SLE11/11.1

  - exclude broken gl locale from build

  - fixed build on 11.2-x86_64 by adding     mozilla-revert_621446.patch

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

USN-1192-1 provided Firefox 6 as a security upgrade. Unfortunately, this caused a regression in libvoikko which caused Firefox to crash while spell checking words with hyphens. This update corrects the issue. We apologize for the inconvenience.

Aral Yaman discovered a vulnerability in the WebGL engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2989)

Vivekanand Bolajwar discovered a vulnerability in the JavaScript engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Bert Hubert and Theo Snelleman discovered a vulnerability in the Ogg reader. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Robert Kaiser, Jesse Ruderman, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary, and Jonathan Watt discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2985)

Rafael Gieschke discovered that unsigned JavaScript could call into a script inside a signed JAR. This could allow an attacker to execute arbitrary code with the identity and permissions of the signed JAR. (CVE-2011-2993)

Michael Jordon discovered that an overly long shader program could cause a buffer overrun. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2988)

Michael Jordon discovered a heap overflow in the ANGLE library used in Firefox's WebGL implementation. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2987)

It was discovered that an SVG text manipulation routine contained a dangling pointer vulnerability. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-0084)

Mike Cardwell discovered that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. This could allow a malicious website to capture proxy authorization credentials. Daniel Veditz discovered that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy.
This could allow a malicious website to circumvent the Content Security Policy of another website. (CVE-2011-2990).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 5 are potentially affected by the following security issues : 

  - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)

  - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)

  - A cross-origin data theft vulnerability exists when using CANVAS and Windows D2D hardware acceleration. (CVE-2011-2986)

  - A heap overflow vulnerability exists in WebGL's ANGLE library. (CVE-2011-2987)

  - A buffer overflow vulnerability exists in WebGL when using an overly long shader program. (CVE-2011-2988)

  - Two errors exist related to Content Security Policy that can lead to information disclosure. (CVE-2011-2990)

  - An unspecified error exists that can allow unsigned JavaScript to call into a signed JAR and inherit the signed JAR's permissions and identity. (CVE-2011-2993)

Versions of SeaMonkey earlier than 2.3.0 are potentially affected by multiple vulnerabilities : 

  - An error in SVG text manipulation code createes a dangling pointer vulnerability. (CVE-2011-0084)

  - Multiple unspecified memory safety issues exist. (CVE-2011-2985)

  - An errir in the D2D hardware acceleration code can allow image data from one domain to be read by another domain. (CVE-2011-2986)

  - An error in the ANGLE library used by the WebGL implementation can allow heap overflows, possibly leading to code execution. (CVE-2011-2987)

  - An error in the shader program handling code can allow a large shader program to overflow a buffer and crash. (CVE-2011-2988)

  - An unspecified error exists related to WebGL. (CVE-2011-2989)

  - Two errors exist related to Content Security Policy and can lead to information disclosure. (CVE-2011-2990)

  - An unspecified error exists that can allow JavaScript crashes. (CVE-2011-2991)

  - An unspecified error exists that can allow the Ogg reader to crash. (CVE-2011-2992)

  - An unspecified error exists that can allow unsigned JavaScript to call into a signed JAR and inherit the signed JAR's permissions and identity. (CVE-2011-2993)

Versions of Thunderbird 5.x are potentially affected by multiple vulnerabilities :

  - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)

  - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)

  - A buffer overflow vulnerability exists in WebGL when using an overly long shader program. (CVE-2011-2988)

  - A heap overflow vulnerability exists in WebGL's ANGLE library. (CVE-2011-2987)

  - A cross-origin data theft vulnerability exists when using canvas and Windows D2D hardware acceleration. (CVE-2011-2986)

Versions of Mozilla Thunderbird prior to 6.0 are affected by the following vulnerabilities :

 - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)
 - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)
 - A buffer overflow vulnerability exists in WebGL when using an overly long shader program. (CVE-2011-2988)
 - A heap overflow vulnerability exists in WebGL's ANGLE library. (CVE-2011-2987)
 - A cross-origin data theft vulnerability exists when using canvas and Windows D2D hardware acceleration. (CVE-2011-2986)

Versions of Firefox prior to 6.0 are affected by the following security issues :

 - A dangling pointer vulnerability exists in an SVG text manipulation routine. (CVE-2011-0084)
 - Several memory safety bugs exist in the browser engine that may permit remote code execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)
 - A cross-origin data theft vulnerability exists when using CANVAS and Windows D2D hardware acceleration. (CVE-2011-2986)
 - A heap overflow vulnerability exists in WebGL's ANGLE library. (CVE-2011-2987)
 - A buffer overflow vulnerability exists in WebGL when using an overly long shader program. (CVE-2011-2988)
 - Two errors exist related to Content Security Policy that can lead to information disclosure. (CVE-2011-2990)
 - An unspecified error exists that can allow unsigned JavaScript to call into a signed JAR and inherit the signed JAR's permissions and identity. (CVE-2011-2993)

The installed version of Firefox is earlier than 6.0 and thus, is potentially affected by the following security issues :

  - A dangling pointer vulnerability exists in an SVG text     manipulation routine. (CVE-2011-0084)

  - Several memory safety bugs exist in the browser engine     that may permit remote code execution. (CVE-2011-2985,     CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)

  - A cross-origin data theft vulnerability exists when     using canvas and Windows D2D hardware acceleration.
    (CVE-2011-2986)    

  - A heap overflow vulnerability exists in WebGL's ANGLE     library. (CVE-2011-2987)

  - A buffer overflow vulnerability exists in WebGL when     using an overly long shader program. (CVE-2011-2988)

  - Two errors exist related to Content Security Policy     that can lead to information disclosure. (CVE-2011-2990)

  - An unspecified error exists that can allow unsigned     JavaScript to call into a signed JAR and inherit the     signed JAR's permissions and identity. (CVE-2011-2993)

  - There is an error in the implementation of the     'window.location' JavaScript object when creating named     frames. This can be exploited to bypass the same-origin     policy and potentially conduct cross-site scripting     attacks.(CVE-2011-2999)

USN-1192-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko for use with Firefox 6.

Aral Yaman discovered a vulnerability in the WebGL engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2989)

Vivekanand Bolajwar discovered a vulnerability in the JavaScript engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Bert Hubert and Theo Snelleman discovered a vulnerability in the Ogg reader. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Robert Kaiser, Jesse Ruderman, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary, and Jonathan Watt discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2985)

Rafael Gieschke discovered that unsigned JavaScript could call into a script inside a signed JAR. This could allow an attacker to execute arbitrary code with the identity and permissions of the signed JAR. (CVE-2011-2993)

Michael Jordon discovered that an overly long shader program could cause a buffer overrun. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2988)

Michael Jordon discovered a heap overflow in the ANGLE library used in Firefox's WebGL implementation. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2987)

It was discovered that an SVG text manipulation routine contained a dangling pointer vulnerability. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-0084)

Mike Cardwell discovered that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. This could allow a malicious website to capture proxy authorization credentials. Daniel Veditz discovered that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy.
This could allow a malicious website to circumvent the Content Security Policy of another website. (CVE-2011-2990).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aral Yaman discovered a vulnerability in the WebGL engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2989)

Vivekanand Bolajwar discovered a vulnerability in the JavaScript engine. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Bert Hubert and Theo Snelleman discovered a vulnerability in the Ogg reader. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2991)

Robert Kaiser, Jesse Ruderman, Gary Kwong, Christoph Diehl, Martijn Wargers, Travis Emmitt, Bob Clary, and Jonathan Watt discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2985)

Rafael Gieschke discovered that unsigned JavaScript could call into a script inside a signed JAR. This could allow an attacker to execute arbitrary code with the identity and permissions of the signed JAR.
(CVE-2011-2993)

Michael Jordon discovered that an overly long shader program could cause a buffer overrun. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2988)

Michael Jordon discovered a heap overflow in the ANGLE library used in Firefox's WebGL implementation. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2987)

It was discovered that an SVG text manipulation routine contained a dangling pointer vulnerability. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-0084)

Mike Cardwell discovered that Content Security Policy violation reports failed to strip out proxy authorization credentials from the list of request headers. This could allow a malicious website to capture proxy authorization credentials. Daniel Veditz discovered that redirecting to a website with Content Security Policy resulted in the incorrect resolution of hosts in the constructed policy. This could allow a malicious website to circumvent the Content Security Policy of another website. (CVE-2011-2990).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Thunderbird is earlier than 6.0 and thus, is potentially affected by the following security issues :

  - Several memory safety bugs exist in the browser engine     that may permit remote code execution. (CVE-2011-2985,     CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)

  - A dangling pointer vulnerability exists in an SVG text     manipulation routine. (CVE-2011-0084)

  - A buffer overflow vulnerability exists in WebGL when     using an overly long shader program. (CVE-2011-2988)

  - A heap overflow vulnerability exists in WebGL's ANGLE     library. (CVE-2011-2987)

  - A cross-origin data theft vulnerability exists when     using canvas and Windows D2D hardware acceleration.
    (CVE-2011-2986)

  - There is an error in the implementation of the     'window.location' JavaScript object when creating named     frames. This can be exploited to bypass the same-origin     policy and potentially conduct cross-site scripting     attacks.(CVE-2011-2999)

The installed version of SeaMonkey is earlier than 2.3.0. Such versions are potentially affected by the following security issues :

  - An error in SVG text manipulation code creates a     dangling pointer vulnerability. (CVE-2011-0084)

  - Multiple, unspecified memory safety issues exist.
    (CVE-2011-2985)

  - An error in the D2D hardware acceleration code can allow     image data from one domain to be read by another domain.
    (CVE-2011-2986)

  - An error in the ANGLE library used by the WebGL     implementation can allow heap overflows, possibly     leading to code execution. (CVE-2011-2987)

  - An error in the shader program handling code can allow     a large shader program to overflow a buffer and crash.
    (CVE-2011-2988)

  - An unspecified error exists related to WebGL.     (CVE-2011-2989)

  - Two errors exist related to Content Security Policy     and can lead to information disclosure. (CVE-2011-2990)

  - An unspecified error exists that can allow JavaScript     crashes. (CVE-2011-2991)

  - An unspecified error exists that can allow the Ogg     reader to crash. (CVE-2011-2992)

  - An unspecified error exists that can allow unsigned     JavaScript to call into a signed JAR and inherit the     signed JAR's permissions and identity. (CVE-2011-2993)

  - There is an error in the implementation of the     'window.location' JavaScript object when creating named     frames. This can be exploited to bypass the same-origin     policy and potentially conduct cross-site scripting     attacks.(CVE-2011-2999)

The Mozilla Project reports :

MFSA 2011-29 Security issues addressed in Firefox 6

MFSA 2011-28 Security issues addressed in Firefox 3.6.20

ID	Name	Product	Family	Severity
76020	openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)	Nessus	SuSE Local Security Checks	critical
75945	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:0957-2)	Nessus	SuSE Local Security Checks	critical
75739	openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)	Nessus	SuSE Local Security Checks	critical
74612	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
56562	Ubuntu 11.04 : libvoikko regression (USN-1192-3)	Nessus	Ubuntu Local Security Checks	critical
801346	Mozilla Firefox 5.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801272	Mozilla SeaMonkey 2.x < 2.3.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801266	Mozilla Thunderbird 5 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6012	SeaMonkey 2.x < 2.3.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6010	Mozilla Thunderbird < 6.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6008	Mozilla Firefox < 6.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
55902	Firefox < 6.0 Multiple Vulnerabilities	Nessus	Windows	high
55899	Ubuntu 11.04 : mozvoikko update (USN-1192-2)	Nessus	Ubuntu Local Security Checks	critical
55898	Ubuntu 11.04 : firefox vulnerabilities (USN-1192-1)	Nessus	Ubuntu Local Security Checks	critical
55887	Mozilla Thunderbird < 6.0 Multiple Vulnerabilities	Nessus	Windows	critical
55885	SeaMonkey < 2.3.0 Multiple Vulnerabilities	Nessus	Windows	high
55878	FreeBSD : mozilla -- multiple vulnerabilities (834591a9-c82f-11e0-897d-6c626dd55a41)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-2989

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

critical

critical

critical

high

critical