Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. NOTE: this issue exists because of a CVE-2011-2986 regression.

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

Mozilla Firefox and Thunderbird were updated to version 8.0 which fixes several security vulnerabilities :

  - MFSA 2011-52 - Code execution via NoWaiverWrapper     (CVE-2011-3655)

  - MFSA 2011-51 - Cross-origin image theft on Mac with     integrated Intel GPU (CVE-2011-3653)

  - MFSA 2011-50 - Cross-origin data theft using canvas and     Windows D2D (CVE-2011-3649)

  - MFSA 2011-49 - Memory corruption while profiling using     Firebug (CVE-2011-3650)

  - MFSA 2011-48 - Miscellaneous memory safety hazards     (rv:8.0) (CVE-2011-3651, CVE-2011-3652, CVE-2011-3654)

  - MFSA 2011-47 - Potential XSS against sites using     Shift-JIS (CVE-2011-3648)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 7.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Mozilla Thunderbird prior to 8.0 are affected by the following security issues :

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox prior to 8.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

This update to version 3.13.1 of mozilla-nss fixes the following issues :

  - Explicitly distrust DigiCert Sdn. Bhd (bmo#698753)

  - Better SHA-224 support (bmo#647706)

  - Fix a regression (causing hangs in some situations)     introduced in 3.13 (bmo#693228)

  - SSL 2.0 is disabled by default

  - A defense against the SSL 3.0 and TLS 1.0 CBC chosen     plaintext attack demonstrated by Rizzo and Duong     (CVE-2011-3389) has been enabled by default. Set the     SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.

  - Support SHA-224

  - Add PORT_ErrorToString and PORT_ErrorToName to return     the error message and symbolic name of an NSS error code

  - Add NSS_GetVersion to return the NSS version string

  - Add experimental support of RSA-PSS to the softoken only

  - NSS_NoDB_Init does not try to open /pkcs11.txt and     /secmod.db anymore (bmo#641052)

Mozilla Firefox has been updated to version 1.9.2.24 (bnc#728520) to fix the following security issues :

  - (bmo#680880) loadSubScript unwraps XPCNativeWrapper     scope parameter. (MFSA 2011-46 / CVE-2011-3647)

  - (bmo#690225) Potential XSS against sites using     Shift-JIS. (MFSA 2011-47 / CVE-2011-3648)

  - (bmo#674776) Memory corruption while profiling using     Firebug. (MFSA 2011-49 / CVE-2011-3650)

The Mozilla Project reports :

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)

MFSA 2011-47 Potential XSS against sites using Shift-JIS

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

MFSA 2011-49 Memory corruption while profiling using Firebug

MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D

MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU

MFSA 2011-52 Code execution via NoWaiverWrapper

The installed version of Thunderbird is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

ID	Name	Product	Family	Severity
76024	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
75743	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
74542	openSUSE Security Update : firefox / thunderbird (openSUSE-2011-9)	Nessus	SuSE Local Security Checks	critical
801321	Mozilla Firefox 7.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801281	Mozilla Thunderbird 7.0 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6789	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6788	Mozilla Firefox < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
57226	SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)	Nessus	SuSE Local Security Checks	critical
57084	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5429)	Nessus	SuSE Local Security Checks	critical
56762	FreeBSD : mozilla -- multiple vulnerabilities (6c8ad3e8-0a30-11e1-9580-4061862b8c22)	Nessus	FreeBSD Local Security Checks	critical
56753	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus	Windows	high
56751	Firefox < 8.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3649

high

Tenable Plugins

critical

critical

critical

high

high

high

high

critical

critical

critical

critical

high

high