Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

Mozilla XULRunner was updated to version 1.9.2.23, fixing various bugs and security issues.

MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled,, but are potentially a risk in browser or browser-like contexts in those products.

Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6.
(CVE-2011-2995)

Josh Aas reported a potential crash in the plugin API that affected Firefox 3.6 only. (CVE-2011-2996)

MFSA 2011-37: Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression.
We would also like to thank Mark for contributing the fix for this problem. (no CVE yet)

MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named 'location' could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10.
(CVE-2011-2999)

MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability.

The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition.
(CVE-2011-3000) MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content.

Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372)

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

Mozilla Firefox was updated to version 3.6.23, fixing various bugs and security issues.

MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled,, but are potentially a risk in browser or browser-like contexts in those products.

Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6.
(CVE-2011-2995)

Josh Aas reported a potential crash in the plugin API that affected Firefox 3.6 only. (CVE-2011-2996)

MFSA 2011-37: Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression.
We would also like to thank Mark for contributing the fix for this problem. (no CVE yet)

MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named 'location' could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10.
(CVE-2011-2999)

MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability.

The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition.
(CVE-2011-3000)

MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content.

Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372)

Mozilla Firefox and Thunderbird were updated to version 8.0 which fixes several security vulnerabilities :

  - MFSA 2011-52 - Code execution via NoWaiverWrapper     (CVE-2011-3655)

  - MFSA 2011-51 - Cross-origin image theft on Mac with     integrated Intel GPU (CVE-2011-3653)

  - MFSA 2011-50 - Cross-origin data theft using canvas and     Windows D2D (CVE-2011-3649)

  - MFSA 2011-49 - Memory corruption while profiling using     Firebug (CVE-2011-3650)

  - MFSA 2011-48 - Miscellaneous memory safety hazards     (rv:8.0) (CVE-2011-3651, CVE-2011-3652, CVE-2011-3654)

  - MFSA 2011-47 - Potential XSS against sites using     Shift-JIS (CVE-2011-3648)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

This update to version 3.13.1 of mozilla-nss fixes the following issues :

  - Explicitly distrust DigiCert Sdn. Bhd (bmo#698753)

  - Better SHA-224 support (bmo#647706)

  - Fix a regression (causing hangs in some situations)     introduced in 3.13 (bmo#693228)

  - SSL 2.0 is disabled by default

  - A defense against the SSL 3.0 and TLS 1.0 CBC chosen     plaintext attack demonstrated by Rizzo and Duong     (CVE-2011-3389) has been enabled by default. Set the     SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.

  - Support SHA-224

  - Add PORT_ErrorToString and PORT_ErrorToName to return     the error message and symbolic name of an NSS error code

  - Add NSS_GetVersion to return the NSS version string

  - Add experimental support of RSA-PSS to the softoken only

  - NSS_NoDB_Init does not try to open /pkcs11.txt and     /secmod.db anymore (bmo#641052)

Mozilla Firefox was updated to version 3.6.23, fixing various bugs and security issues.

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2011-36)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled,, but are potentially a risk in     browser or browser-like contexts in those products.

  - Benjamin Smedberg, Bob Clary, and Jesse Ruderman     reported memory safety problems that affected Firefox     3.6 and Firefox 6. (CVE-2011-2995)

  - Josh Aas reported a potential crash in the plugin API     that affected Firefox 3.6 only. (CVE-2011-2996)

  - Mark Kaplan reported a potentially exploitable crash due     to integer underflow when using a large JavaScript     RegExp expression. We would also like to thank Mark for     contributing the fix for this problem. (no CVE yet).
    (MFSA 2011-37)

  - Mozilla developer Boris Zbarsky reported that a frame     named 'location' could shadow the window.location object     unless a script in a page grabbed a reference to the     true object before the frame was created. Because some     plugins use the value of window.location to determine     the page origin this could fool the plugin into granting     the plugin content access to another site or the local     file system in violation of the Same Origin Policy. This     flaw allows circumvention of the fix added for MFSA     2010-10. (CVE-2011-2999). (MFSA 2011-38)

  - Ian Graham of Citrix Online reported that when multiple     Location headers were present in a redirect response     Mozilla behavior differed from other browsers: Mozilla     would use the second Location header while Chrome and     Internet Explorer would use the first. Two copies of     this header with different values could be a symptom of     a CRLF injection attack against a vulnerable server.
    Most commonly it is the Location header itself that is     vulnerable to the response splitting and therefore the     copy preferred by Mozilla is more likely to be the     malicious one. It is possible, however, that the first     copy was the injected one depending on the nature of the     server vulnerability. (MFSA 2011-39)

    The Mozilla browser engine has been changed to treat two     copies of this header with different values as an error     condition. The same has been done with the headers     Content-Length and Content-Disposition. (CVE-2011-3000)

  - Mariusz Mlynski reported that if you could convince a     user to hold down the Enter key--as part of a game or     test, perhaps--a malicious page could pop up a download     dialog where the held key would then activate the     default Open action. For some file types this would be     merely annoying (the equivalent of a pop-up) but other     file types have powerful scripting capabilities. And     this would provide an avenue for an attacker to exploit     a vulnerability in applications not normally exposed to     potentially hostile internet content. (MFSA 2011-40)

    Holding enter allows arbitrary code execution due to     Download Manager. (CVE-2011-2372)

Mozilla Firefox has been updated to version 1.9.2.24 (bnc#728520) to fix the following security issues :

  - (bmo#680880) loadSubScript unwraps XPCNativeWrapper     scope parameter. (MFSA 2011-46 / CVE-2011-3647)

  - (bmo#690225) Potential XSS against sites using     Shift-JIS. (MFSA 2011-47 / CVE-2011-3648)

  - (bmo#674776) Memory corruption while profiling using     Firebug. (MFSA 2011-49 / CVE-2011-3650)

Mozilla Firefox was updated to version 3.6.23, fixing various bugs and security issues.

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2011-36)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled,, but are potentially a risk in     browser or browser-like contexts in those products.

    Benjamin Smedberg, Bob Clary, and Jesse Ruderman     reported memory safety problems that affected Firefox     3.6 and Firefox 6. (CVE-2011-2995)

    Josh Aas reported a potential crash in the plugin API     that affected Firefox 3.6 only. (CVE-2011-2996)

  - Mark Kaplan reported a potentially exploitable crash due     to integer underflow when using a large JavaScript     RegExp expression. We would also like to thank Mark for     contributing the fix for this problem. (no CVE yet).
    (MFSA 2011-37)

  - Mozilla developer Boris Zbarsky reported that a frame     named 'location' could shadow the window.location object     unless a script in a page grabbed a reference to the     true object before the frame was created. Because some     plugins use the value of window.location to determine     the page origin this could fool the plugin into granting     the plugin content access to another site or the local     file system in violation of the Same Origin Policy. This     flaw allows circumvention of the fix added for MFSA     2010-10. (CVE-2011-2999). (MFSA 2011-38)

  - Ian Graham of Citrix Online reported that when multiple     Location headers were present in a redirect response     Mozilla behavior differed from other browsers: Mozilla     would use the second Location header while Chrome and     Internet Explorer would use the first. Two copies of     this header with different values could be a symptom of     a CRLF injection attack against a vulnerable server.
    Most commonly it is the Location header itself that is     vulnerable to the response splitting and therefore the     copy preferred by Mozilla is more likely to be the     malicious one. It is possible, however, that the first     copy was the injected one depending on the nature of the     server vulnerability. (MFSA 2011-39)

    The Mozilla browser engine has been changed to treat two     copies of this header with different values as an error     condition. The same has been done with the headers     Content-Length and Content-Disposition. (CVE-2011-3000)

  - Mariusz Mlynski reported that if you could convince a     user to hold down the Enter key--as part of a game or     test, perhaps--a malicious page could pop up a download     dialog where the held key would then activate the     default Open action. For some file types this would be     merely annoying (the equivalent of a pop-up) but other     file types have powerful scripting capabilities. And     this would provide an avenue for an attacker to exploit     a vulnerability in applications not normally exposed to     potentially hostile internet content. (MFSA 2011-40)

    Holding enter allows arbitrary code execution due to     Download Manager. (CVE-2011-2372)

The installed version of Firefox 3.6 is earlier than 3.6.23.  Such versions are potentially affected by the following security issues :

  - An integer underflow exists when handling a large     JavaScript 'RegExp' expression that can allow a     potentially exploitable crash. (CVE-2011-2998)

  - If an attacker could trick a user into holding down the     'Enter' key, via a malicious game, for example, a     malicious application or extension could be downloaded     and executed. (CVE-2011-2372)

  - Unspecified errors exist that can be exploited to     corrupt memory. No additional information is available     at this time. (CVE-2011-2995, CVE-2011-2996)

  - There is an error in the implementation of the     'window.location' JavaScript object when creating named     frames. This can be exploited to bypass the same-origin     policy and potentially conduct cross-site scripting     attacks. (CVE-2011-2999)

  - A weakness exists when handling the 'Location' header.
    This can lead to response splitting attacks when     visiting a vulnerable web server. The same fix has been     applied to the headers 'Content-Length' and     'Content-Disposition'. (CVE-2011-3000)

Security issues were identified and fixed in mozilla firefox and thunderbird :

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site (CVE-2011-2372).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2995).

Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2996).

Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle location as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170 (CVE-2011-2999).

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values (CVE-2011-3000).

Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error (CVE-2011-3001).

Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression (CVE-2011-3867).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Security issues were identified and fixed in mozilla firefox and thunderbird :

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site (CVE-2011-2372).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2995).

Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-2996).

Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression (CVE-2011-2998).

Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle location as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170 (CVE-2011-2999).

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values (CVE-2011-3000).

Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error (CVE-2011-3001).

Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression (CVE-2011-3867).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 3.6 earlier than 3.6.23 are potentially affected by the following security issues : 
  - An integer underflow exists when handling a large JavaScript 'RegExp' expression that can allow a potentially exploitable crash. (Issue 684815)
  - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372)
  - Unspecified error exist that can be exploited to corrupt memory.  No additional information is available at this time. (CVE-2011-2995, CVE-2011-2996)
  - There is an error in the implementation of the 'window.location' JavaScript object when creating named frames.  This can be exploited to bypass the same-origin policy and potentially conduct cross-site scripting attacks. (CVE-2011-2999)
  - A weakness exists when handling the 'Location' header.  This can lead to response splitting attacks when visiting a vulnerable web server.  The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.  

Versions of Firefox 3.6 earlier than 3.6.23 are potentially affected by the following security issues : 
  - An integer underflow exists when handling a large JavaScript 'RegExp' expression that can allow a potentially exploitable crash. (Issue 684815)
  - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372)
  - Unspecified error exist that can be exploited to corrupt memory.  No additional information is available at this time. (CVE-2011-2995, CVE-2011-2996)
  - There is an error in the implementation of the 'window.location' JavaScript object when creating named frames.  This can be exploited to bypass the same-origin policy and potentially conduct cross-site scripting attacks. (CVE-2011-2999)
  - A weakness exists when handling the 'Location' header.  This can lead to response splitting attacks when visiting a vulnerable web server.  The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)

The installed version of Firefox 3.6.x is earlier than 3.6.23 and is affected by the following vulnerabilities:

  - An integer underflow exists when handling a large     JavaScript 'RegExp' expression that can allow a     potentially exploitable crash. (CVE-2011-2998)

  - If an attacker could trick a user into holding down the     'Enter' key, via a malicious game, for example, a     malicious application or extension could be downloaded     and executed. (CVE-2011-2372)

  - Unspecified errors exist that can be exploited to     corrupt memory. No additional information is available     at this time. (CVE-2011-2995, CVE-2011-2996)

  - There is an error in the implementation of the     'window.location' JavaScript object when creating named     frames. This can be exploited to bypass the same-origin     policy and potentially conduct cross-site scripting     attacks. (CVE-2011-2999)

  - A weakness exists when handling the 'Location' header.     This can lead to response splitting attacks when     visiting a vulnerable web server. The same fix has been     applied to the headers 'Content-Length' and     'Content-Disposition'. (CVE-2011-3000)

Benjamin Smedberg, Bob Clary, Jesse Ruderman, and Josh Aas discovered multiple memory vulnerabilities in the Gecko rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2011-2995, CVE-2011-2996)

Boris Zbarsky discovered that a frame named 'location' could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. This is in violation of the Same Origin Policy. A malicious E-Mail could possibly use this to access the local file system. (CVE-2011-2999)

Mark Kaplan discovered an integer underflow in the SpiderMonkey JavaScript engine. An attacker could potentially use this to crash Thunderbird.

Ian Graham discovered that when multiple Location headers were present, Thunderbird would use the second one resulting in a possible CRLF injection attack. CRLF injection issues can result in a wide variety of attacks, such as XSS (Cross-Site Scripting) vulnerabilities, browser cache poisoning, and cookie theft.
(CVE-2011-3000)

Mariusz Mlynski discovered that if the user could be convinced to hold down the enter key, a malicious website or E-Mail could potential pop up a download dialog and the default open action would be selected.
This would result in potentially malicious content being run with privileges of the user invoking Thunderbird. (CVE-2011-2372).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benjamin Smedberg, Bob Clary, Jesse Ruderman, and Josh Aas discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-2995, CVE-2011-2996)

Boris Zbarsky discovered that a frame named 'location' could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. This is in violation of the Same Origin Policy. A malicious website could possibly use this to access another website or the local file system.
(CVE-2011-2999)

Mark Kaplan discovered an integer underflow in the SpiderMonkey JavaScript engine. An attacker could potentially use this to crash Firefox.

Ian Graham discovered that when multiple Location headers were present, Firefox would use the second one resulting in a possible CRLF injection attack. CRLF injection issues can result in a wide variety of attacks, such as XSS (Cross-Site Scripting) vulnerabilities, browser cache poisoning, and cookie theft. (CVE-2011-3000)

Mariusz Mlynski discovered that if the user could be convinced to hold down the enter key, a malicious website could potential pop up a download dialog and the default open action would be selected. This would result in potentially malicious content being run with privileges of the user invoking Firefox. (CVE-2011-2372).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Project reports :

MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23)

MFSA 2011-37 Integer underflow when using JavaScript RegExp

MFSA 2011-38 XSS via plugins and shadowed window.location object

MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection

MFSA 2011-40 Code installation through holding down Enter

MFSA 2011-41 Potentially exploitable WebGL crashes

MFSA 2011-42 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter

MFSA 2011-44 Use after free reading OGG headers

MFSA 2011-45 Inferring Keystrokes from motion data

ID	Name	Product	Family	Severity
76024	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
75960	openSUSE Security Update : mozilla-js192 (openSUSE-SU-2011:1076-1)	Nessus	SuSE Local Security Checks	critical
75743	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
75656	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:1079-1)	Nessus	SuSE Local Security Checks	critical
74542	openSUSE Security Update : firefox / thunderbird (openSUSE-2011-9)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
57226	SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)	Nessus	SuSE Local Security Checks	critical
57152	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7784)	Nessus	SuSE Local Security Checks	critical
57084	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5429)	Nessus	SuSE Local Security Checks	critical
57083	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5224)	Nessus	SuSE Local Security Checks	critical
56609	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7783)	Nessus	SuSE Local Security Checks	critical
56376	Firefox 3.6 < 3.6.23 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
56374	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2011:140)	Nessus	Mandriva Local Security Checks	critical
56373	Mandriva Linux Security Advisory : firefox (MDVSA-2011:139)	Nessus	Mandriva Local Security Checks	critical
801241	Mozilla Firefox 3.6 < 3.6.23 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6027	Mozilla Firefox 3.6 < 3.6.23 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
56334	Firefox 3.6.x < 3.6.23 Multiple Vulnerabilities	Nessus	Windows	high
56331	Ubuntu 10.04 LTS / 10.10 / 11.04 : thunderbird vulnerabilities (USN-1213-1)	Nessus	Ubuntu Local Security Checks	critical
56330	Ubuntu 10.04 LTS / 10.10 : firefox, xulrunner-1.9.2 vulnerabilities (USN-1210-1)	Nessus	Ubuntu Local Security Checks	critical
56323	FreeBSD : Mozilla -- multiple vulnerabilities (1fade8a3-e9e8-11e0-9580-4061862b8c22)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-2996

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

critical

critical

critical