Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site.

The remote Solaris system is missing necessary patches to address security updates :

  - Cross-site scripting (XSS) vulnerability in Mozilla     Firefox before 3.6.24 and 4.x through 7.0 and     Thunderbird before 3.1.6 and 5.0 through 7.0 allows     remote attackers to inject arbitrary web script or HTML     via crafted text with Shift JIS encoding.
    (CVE-2011-3648)

  - Mozilla Firefox before 3.6.24 and 4.x through 7.0 and     Thunderbird before 3.1.6 and 5.0 through 7.0 do not     properly handle JavaScript files that contain many     functions, which allows user-assisted remote attackers     to cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via a crafted file that is accessed by debugging     APIs, as demonstrated by Firebug. (CVE-2011-3650)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2011-3651)

  - The browser engine in Mozilla Firefox before 8.0 and     Thunderbird before 8.0 does not properly allocate     memory, which allows remote attackers to cause a denial     of service (memory corruption and application crash) or     possibly execute arbitrary code via unspecified vectors.
    (CVE-2011-3652)

  - The browser engine in Mozilla Firefox before 8.0 and     Thunderbird before 8.0 does not properly handle links     from SVG mpath elements to non-SVG elements, which     allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unspecified vectors.
    (CVE-2011-3654)

  - Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0     through 7.0 perform access control without checking for     use of the NoWaiverWrapper wrapper, which allows remote     attackers to gain privileges via a crafted web site.
    (CVE-2011-3655)

The remote Solaris system is missing necessary patches to address security updates :

  - Mozilla Firefox before 3.6.23 and 4.x through 6,     Thunderbird before 7.0, and SeaMonkey before 2.4 do not     prevent the starting of a download in response to the     holding of the Enter key, which allows user-assisted     remote attackers to bypass intended access restrictions     via a crafted web site. (CVE-2011-2372)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 3.6.23 and 4.x through     6, Thunderbird before 7.0, and SeaMonkey before 2.4     allow remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
    (CVE-2011-2995)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 6, Thunderbird before 7.0, and     SeaMonkey before 2.4 allow remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly execute arbitrary code via unknown     vectors. (CVE-2011-2997)

  - Mozilla Firefox before 3.6.23 and 4.x through 6,     Thunderbird before 7.0, and SeaMonkey before 2.4 do not     properly handle HTTP responses that contain multiple     Location, Content-Length, or Content-Disposition     headers, which makes it easier for remote attackers to     conduct HTTP response splitting attacks via crafted     header values. (CVE-2011-3000)

  - Mozilla Firefox 4.x through 6, Thunderbird before 7.0,     and SeaMonkey before 2.4 do not prevent manual add-on     installation in response to the holding of the Enter     key, which allows user-assisted remote attackers to     bypass intended access restrictions via a crafted web     site that triggers an unspecified internal error.
    (CVE-2011-3001)

  - Almost Native Graphics Layer Engine (ANGLE), as used in     Mozilla Firefox before 7.0 and SeaMonkey before 2.4,     does not validate the return value of a GrowAtomTable     function call, which allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via vectors that trigger a     memory-allocation error and a resulting buffer overflow.
    (CVE-2011-3002)

  - Mozilla Firefox before 7.0 and SeaMonkey before 2.4     allow remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via an unspecified WebGL test case that triggers a     memory-allocation error and a resulting out-of-bounds     write operation. (CVE-2011-3003)

  - The JSSubScriptLoader in Mozilla Firefox 4.x through 6     and SeaMonkey before 2.4 does not properly handle     XPCNativeWrappers during calls to the loadSubScript     method in an add-on, which makes it easier for remote     attackers to gain privileges via a crafted web site that     leverages certain unwrapping behavior. (CVE-2011-3004)

  - Use-after-free vulnerability in Mozilla Firefox 4.x     through 6, Thunderbird before 7.0, and SeaMonkey before     2.4 allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via crafted OGG headers in a .ogg file. (CVE-2011-3005)

  - YARR, as used in Mozilla Firefox before 7.0, Thunderbird     before 7.0, and SeaMonkey before 2.4, allows remote     attackers to cause a denial of service (application     crash) or possibly execute arbitrary code via crafted     JavaScript. (CVE-2011-3232)

  - Cross-site scripting (XSS) vulnerability in Mozilla     Firefox before 3.6.24 and 4.x through 7.0 and     Thunderbird before 3.1.6 and 5.0 through 7.0 allows     remote attackers to inject arbitrary web script or HTML     via crafted text with Shift JIS encoding.
    (CVE-2011-3648)

  - Mozilla Firefox before 3.6.24 and 4.x through 7.0 and     Thunderbird before 3.1.6 and 5.0 through 7.0 do not     properly handle JavaScript files that contain many     functions, which allows user-assisted remote attackers     to cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via a crafted file that is accessed by debugging     APIs, as demonstrated by Firebug. (CVE-2011-3650)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2011-3651)

  - The browser engine in Mozilla Firefox before 8.0 and     Thunderbird before 8.0 does not properly allocate     memory, which allows remote attackers to cause a denial     of service (memory corruption and application crash) or     possibly execute arbitrary code via unspecified vectors.
    (CVE-2011-3652)

  - The browser engine in Mozilla Firefox before 8.0 and     Thunderbird before 8.0 does not properly handle links     from SVG mpath elements to non-SVG elements, which     allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unspecified vectors.
    (CVE-2011-3654)

  - Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0     through 7.0 perform access control without checking for     use of the NoWaiverWrapper wrapper, which allows remote     attackers to gain privileges via a crafted web site.
    (CVE-2011-3655)

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

MozillaFirefox was updated to version 8 (bnc#728520) to fix the following security issues :

dbg114-MozillaFirefox-5399 MozillaFirefox-5399 new_updateinfo MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS dbg114-MozillaFirefox-5399 MozillaFirefox-5399 new_updateinfo MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards dbg114-MozillaFirefox-5399 MozillaFirefox-5399 new_updateinfo MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug dbg114-MozillaFirefox-5399 MozillaFirefox-5399 new_updateinfo MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

  - rebased patches

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

Changes in xulrunner :

  - update to 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

Changes in MozillaFirefox :

  - update to Firefox 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

  - recommend libcanberra0 for proper sound notifications

Changes in MozillaThunderbird :

  - update to Thunderbird 12.0 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update Enigmail to 1.4.1

  - added mozilla-revert_621446.patch

  - added mozilla-libnotify.patch (bmo#737646)

  - added mailnew-showalert.patch (bmo#739146)

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

  - disabled crashreporter temporarily for Factory (gcc 4.7     issue)

Changes in seamonkey :

  - update to SeaMonkey 2.9 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update to 2.9b4

  - added mozilla-sle11.patch and add exceptions to be able     to build for SLE11/11.1

  - exclude broken gl locale from build

  - fixed build on 11.2-x86_64 by adding     mozilla-revert_621446.patch

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

Mozilla Firefox and Thunderbird were updated to version 8.0 which fixes several security vulnerabilities :

  - MFSA 2011-52 - Code execution via NoWaiverWrapper     (CVE-2011-3655)

  - MFSA 2011-51 - Cross-origin image theft on Mac with     integrated Intel GPU (CVE-2011-3653)

  - MFSA 2011-50 - Cross-origin data theft using canvas and     Windows D2D (CVE-2011-3649)

  - MFSA 2011-49 - Memory corruption while profiling using     Firebug (CVE-2011-3650)

  - MFSA 2011-48 - Miscellaneous memory safety hazards     (rv:8.0) (CVE-2011-3651, CVE-2011-3652, CVE-2011-3654)

  - MFSA 2011-47 - Potential XSS against sites using     Shift-JIS (CVE-2011-3648)

SeaMonkey was updated to version 2.5 to fix several security issues :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 7.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Mozilla Thunderbird prior to 8.0 are affected by the following security issues :

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox prior to 8.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

This update to version 3.13.1 of mozilla-nss fixes the following issues :

  - Explicitly distrust DigiCert Sdn. Bhd (bmo#698753)

  - Better SHA-224 support (bmo#647706)

  - Fix a regression (causing hangs in some situations)     introduced in 3.13 (bmo#693228)

  - SSL 2.0 is disabled by default

  - A defense against the SSL 3.0 and TLS 1.0 CBC chosen     plaintext attack demonstrated by Rizzo and Duong     (CVE-2011-3389) has been enabled by default. Set the     SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.

  - Support SHA-224

  - Add PORT_ErrorToString and PORT_ErrorToName to return     the error message and symbolic name of an NSS error code

  - Add NSS_GetVersion to return the NSS version string

  - Add experimental support of RSA-PSS to the softoken only

  - NSS_NoDB_Init does not try to open /pkcs11.txt and     /secmod.db anymore (bmo#641052)

Mozilla Firefox has been updated to version 1.9.2.24 (bnc#728520) to fix the following security issues :

  - (bmo#680880) loadSubScript unwraps XPCNativeWrapper     scope parameter. (MFSA 2011-46 / CVE-2011-3647)

  - (bmo#690225) Potential XSS against sites using     Shift-JIS. (MFSA 2011-47 / CVE-2011-3648)

  - (bmo#674776) Memory corruption while profiling using     Firebug. (MFSA 2011-49 / CVE-2011-3650)

Yosuke Hasegawa discovered that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. It may be possible to trigger this crash without the use of debugging APIs, which might allow malicious websites to exploit this vulnerability. An attacker could possibly use this flaw this to steal data or inject malicious scripts into web content. (CVE-2011-3648)

Marc Schoenefeld discovered that using Firebug to profile a JavaScript file with many functions would cause Firefox to crash. An attacker might be able to exploit this without using the debugging APIs, which could potentially remotely crash Thunderbird, resulting in a denial of service. (CVE-2011-3650)

Jason Orendorff, Boris Zbarsky, Gregg Tavares, Mats Palmgren, Christian Holler, Jesse Ruderman, Simona Marcu, Bob Clary, and William McCloskey discovered multiple memory safety bugs in the browser engine used in Thunderbird and other Mozilla-based products. An attacker might be able to use these flaws to execute arbitrary code with the privileges of the user invoking Thunderbird or possibly crash Thunderbird resulting in a denial of service. (CVE-2011-3651)

It was discovered that Thunderbird could be caused to crash under certain conditions, due to an unchecked allocation failure, resulting in a denial of service. It might also be possible to execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2011-3652)

Aki Helin discovered that Thunderbird does not properly handle links from SVG mpath elements to non-SVG elements. An attacker could use this vulnerability to crash Thunderbird, resulting in a denial of service, or possibly execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2011-3654)

It was discovered that an internal privilege check failed to respect the NoWaiverWrappers introduced with Thunderbird 5. An attacker could possibly use this to gain elevated privileges within Thunderbird for web content. (CVE-2011-3655).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1277-1 fixed vulnerabilities in Firefox. This update provides updated Mozvoikko and ubufox packages for use with Firefox 8.

Yosuke Hasegawa discovered that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. It may be possible to trigger this crash without the use of debugging APIs, which might allow malicious websites to exploit this vulnerability. An attacker could possibly use this flaw this to steal data or inject malicious scripts into web content. (CVE-2011-3648)

Marc Schoenefeld discovered that using Firebug to profile a JavaScript file with many functions would cause Firefox to crash. An attacker might be able to exploit this without using the debugging APIs, which could potentially remotely crash the browser, resulting in a denial of service.
(CVE-2011-3650)

Jason Orendorff, Boris Zbarsky, Gregg Tavares, Mats Palmgren, Christian Holler, Jesse Ruderman, Simona Marcu, Bob Clary, and William McCloskey discovered multiple memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. An attacker might be able to use these flaws to execute arbitrary code with the privileges of the user invoking Firefox or possibly crash the browser resulting in a denial of service. (CVE-2011-3651)

It was discovered that Firefox could be caused to crash under certain conditions, due to an unchecked allocation failure, resulting in a denial of service. It might also be possible to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-3652)

Aki Helin discovered that Firefox does not properly handle links from SVG mpath elements to non-SVG elements. An attacker could use this vulnerability to crash Firefox, resulting in a denial of service, or possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-3654)

It was discovered that an internal privilege check failed to respect the NoWaiverWrappers introduced with Firefox 4. An attacker could possibly use this to gain elevated privileges within the browser for web content. (CVE-2011-3655).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Yosuke Hasegawa discovered that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. It may be possible to trigger this crash without the use of debugging APIs, which might allow malicious websites to exploit this vulnerability. An attacker could possibly use this flaw this to steal data or inject malicious scripts into web content. (CVE-2011-3648)

Marc Schoenefeld discovered that using Firebug to profile a JavaScript file with many functions would cause Firefox to crash. An attacker might be able to exploit this without using the debugging APIs, which could potentially remotely crash the browser, resulting in a denial of service. (CVE-2011-3650)

Jason Orendorff, Boris Zbarsky, Gregg Tavares, Mats Palmgren, Christian Holler, Jesse Ruderman, Simona Marcu, Bob Clary, and William McCloskey discovered multiple memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. An attacker might be able to use these flaws to execute arbitrary code with the privileges of the user invoking Firefox or possibly crash the browser resulting in a denial of service. (CVE-2011-3651)

It was discovered that Firefox could be caused to crash under certain conditions, due to an unchecked allocation failure, resulting in a denial of service. It might also be possible to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-3652)

Aki Helin discovered that Firefox does not properly handle links from SVG mpath elements to non-SVG elements. An attacker could use this vulnerability to crash Firefox, resulting in a denial of service, or possibly execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2011-3654)

It was discovered that an internal privilege check failed to respect the NoWaiverWrappers introduced with Firefox 4. An attacker could possibly use this to gain elevated privileges within the browser for web content. (CVE-2011-3655).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security issues were identified and fixed in mozilla NSS, firefox and thunderbird :

22 weak 512-bit certificates issued by the DigiCert Sdn. Bhd certificate authority has been revoked from the root CA storage. This was fixed with rootcerts-20111103.00 and nss-3.13. DigiCert Sdn. Bhd is a Malaysian subordinate CA under Entrust and Verizon (GTE CyberTrust). It bears no affiliation whatsoever with the US-based corporation DigiCert, Inc., which is a member of Mozilla's root program.

Untrusted search path vulnerability in Mozilla Network Security Services (NSS) might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory (CVE-2011-3640).

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding (CVE-2011-3648).

Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted file that is accessed by debugging APIs, as demonstrated by Firebug (CVE-2011-3650).

The following vulnerabilities affetst Mandriva Linux 2011 only :

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-3651).

The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2011-3652).

The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2011-3654).

Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site (CVE-2011-3655).

The following vulnerabilities affects Mandriva Enterpriser Server 5.2 and Mandriva Linux 2010.2 only :

The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004 (CVE-2011-3647).

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

The Mozilla Project reports :

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)

MFSA 2011-47 Potential XSS against sites using Shift-JIS

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

MFSA 2011-49 Memory corruption while profiling using Firebug

MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D

MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU

MFSA 2011-52 Code execution via NoWaiverWrapper

The installed version of Thunderbird 7.x is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding, which can allow cross-site     scripting attacks. (CVE-2011-3648)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element, which can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding, which can allow cross-site     scripting attacks. (CVE-2011-3648)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element, which can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The installed version of Thunderbird is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

ID	Name	Product	Family	Severity
80783	Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird2)	Nessus	Solaris Local Security Checks	critical
80608	Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_in_mozilla_firefox1)	Nessus	Solaris Local Security Checks	critical
76024	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
75949	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:1243-1)	Nessus	SuSE Local Security Checks	critical
75743	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	critical
74612	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)	Nessus	SuSE Local Security Checks	critical
74542	openSUSE Security Update : firefox / thunderbird (openSUSE-2011-9)	Nessus	SuSE Local Security Checks	critical
74522	openSUSE Security Update : seamonkey (openSUSE-2011-34)	Nessus	SuSE Local Security Checks	critical
801321	Mozilla Firefox 7.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801281	Mozilla Thunderbird 7.0 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6789	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6788	Mozilla Firefox < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
57226	SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)	Nessus	SuSE Local Security Checks	critical
57084	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5429)	Nessus	SuSE Local Security Checks	critical
56969	Ubuntu 11.10 : thunderbird vulnerabilities (USN-1282-1)	Nessus	Ubuntu Local Security Checks	critical
56945	Ubuntu 11.04 / 11.10 : mozvoikko, ubufox update (USN-1277-2)	Nessus	Ubuntu Local Security Checks	critical
56944	Ubuntu 11.04 / 11.10 : firefox vulnerabilities (USN-1277-1)	Nessus	Ubuntu Local Security Checks	critical
56765	Mandriva Linux Security Advisory : mozilla (MDVSA-2011:169)	Nessus	Mandriva Local Security Checks	critical
56762	FreeBSD : mozilla -- multiple vulnerabilities (6c8ad3e8-0a30-11e1-9580-4061862b8c22)	Nessus	FreeBSD Local Security Checks	critical
56758	Thunderbird 7.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
56756	Firefox < 8.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
56753	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus	Windows	high
56751	Firefox < 8.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3655

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high