The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.

seamonkey version 2.6 fixes several security issues :

dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes

Mozilla Firefox Version 9 fixes several security issues :

dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-55/CVE-2011-3658:
nsSVGValue out-of-bounds access dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes

seamonkey version 2.6 fixes several security issues :

  - MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety     hazards

  - MFSA 2011-54/CVE-2011-3661: Potentially exploitable     crash in the YARR regular expression library

  - MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds     access

  - MFSA 2011-56/CVE-2011-3663: Key detection without     JavaScript via SVG animation

  - MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to     extreme sizes

Changes in xulrunner :

  - update to 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

Changes in MozillaFirefox :

  - update to Firefox 12.0 (bnc#758408)

  - rebased patches

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - added mozilla-libnotify.patch to allow fallback from     libnotify to xul based events if no notification-daemon     is running

  - gcc 4.7 fixes

  - mozilla-gcc47.patch

  - disabled crashreporter temporarily for Factory

  - recommend libcanberra0 for proper sound notifications

Changes in MozillaThunderbird :

  - update to Thunderbird 12.0 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update Enigmail to 1.4.1

  - added mozilla-revert_621446.patch

  - added mozilla-libnotify.patch (bmo#737646)

  - added mailnew-showalert.patch (bmo#739146)

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

  - disabled crashreporter temporarily for Factory (gcc 4.7     issue)

Changes in seamonkey :

  - update to SeaMonkey 2.9 (bnc#758408)

  - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous     memory safety hazards

  - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free     in IDBKeyRange

  - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees     causes heap corruption in gfxImageSurface

  - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS     via multibyte content processing errors

  - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory     corruption during font rendering using cairo-dwrite

  - MFSA 2012-26/CVE-2012-0473 (bmo#743475)     WebGL.drawElements may read illegal video memory due to     FindMaxUshortElement error

  - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page     load short-circuit can lead to XSS

  - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6     in Origin headers may bypass webserver access     restrictions

  - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS     through ISO-2022-KR/ISO-2022-CN decoding issues

  - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL     content using textImage2D

  - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error     in OpenType Sanitizer

  - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP     Redirections and remote content can be read by     JavaScript errors

  - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site     identity spoofing when loading RSS and Atom feeds

  - update to 2.9b4

  - added mozilla-sle11.patch and add exceptions to be able     to build for SLE11/11.1

  - exclude broken gl locale from build

  - fixed build on 11.2-x86_64 by adding     mozilla-revert_621446.patch

  - added mozilla-gcc47.patch and mailnews-literals.patch to     fix compilation issues with recent gcc 4.7

Changes in MozillaThunderbird :

  - update to Thunderbird 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in mozilla-xulrunner192 :

  - security update to 1.9.2.28 (bnc#750044)

  - MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue     out-of-bounds access

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in MozillaFirefox :

  - update to Firefox 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in seamonkey :

  - update to SeaMonkey 2.8 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in chmsee :

  - Update to version 1.99.08

Changes in mozilla-nss :

  - update to 3.13.3 RTM

  - distrust Trustwave's MITM certificates (bmo#724929)

  - fix generic blacklisting mechanism (bmo#727204)

Changes in mozilla-nspr :

  - update to version 4.9 RTM

Mozilla Firefox and Thunderbird version 9 and seamonkey version 2.6 updates fix several security issues :

  - MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety     hazards

  - MFSA 2011-54/CVE-2011-3661: Potentially exploitable     crash in the YARR regular expression library

  - MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds     access

  - MFSA 2011-56/CVE-2011-3663: Key detection without     JavaScript via SVG animation

  - MFSA 2011-58/CVE-2011-3665: Crash scaling video elements     to extreme sizes

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Security issues were identified and fixed in mozilla firefox and thunderbird :

The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements (CVE-2011-3658).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors (CVE-2011-3660).

YARR, as used in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript (CVE-2011-3661).

Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page by using SVG animation accessKey events within that web page (CVE-2011-3663).

Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling (CVE-2011-3665).

USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird.

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. (CVE-2011-3658)

Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content.
(CVE-2012-0456)

Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data. (CVE-2012-0455)

Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458)

Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0461, CVE-2012-0464).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. (CVE-2011-3658)

Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. (CVE-2012-0456)

Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data.
(CVE-2012-0455)

Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458)

Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0461, CVE-2012-0464).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Thunderbird or execute arbitrary code as the user that invoked Thunderbird.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Thunderbird. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from Thunderbird in a context where the user believed scripting was disabled. (CVE-2011-3663)

It was discovered that it was possible to crash Thunderbird when scaling an OGG <video> element to extreme sizes. (CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1306-1 fixed vulnerabilities in Firefox. This update provides updated Mozvoikko and ubufox packages for use with Firefox 9.

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Firefox or execute arbitrary code as the user that invoked Firefox.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Firefox. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from the browser in a context where the user believed scripting was disabled.
(CVE-2011-3663)

It was discovered that it was possible to crash Firefox when scaling an OGG <video> element to extreme sizes.
(CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Firefox or execute arbitrary code as the user that invoked Firefox.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Firefox. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from the browser in a context where the user believed scripting was disabled.
(CVE-2011-3663)

It was discovered that it was possible to crash Firefox when scaling an OGG <video> element to extreme sizes. (CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 8.0 are potentially affected by the following security issues : 

  - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)

  - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

Versions of Firefox prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - An error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when OGG 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

The installed version of Thunderbird 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'        'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The Mozilla Project reports :

MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-55 nsSVGValue out-of-bounds access

MFSA 2011-56 Key detection without JavaScript via SVG animation

MFSA 2011-58 Crash scaling video to extreme sizes

The installed version of SeaMonkey is earlier than 2.6.0.  Such versions are potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Thunderbird is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The remote host has a email client installed that is vulnerable to multiple attack vectors.
 

Versions of Thunderbird 8.0 are potentially affected by the following security issues : 

  - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)

  - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

Versions of Mozilla Thunderbird prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame. It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

ID	Name	Product	Family	Severity
76025	openSUSE Security Update : seamonkey (openSUSE-SU-2012:0007-1)	Nessus	SuSE Local Security Checks	critical
75950	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:0039-2)	Nessus	SuSE Local Security Checks	critical
75744	openSUSE Security Update : seamonkey (openSUSE-SU-2012:0007-1)	Nessus	SuSE Local Security Checks	critical
74612	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)	Nessus	SuSE Local Security Checks	critical
74574	openSUSE Security Update : MozillaFirefox / MozillaThunderbird (openSUSE-SU-2012:0417-1)	Nessus	SuSE Local Security Checks	high
74515	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-2011-101)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
61940	Mandriva Linux Security Advisory : mozilla (MDVSA-2011:192)	Nessus	Mandriva Local Security Checks	critical
58481	Ubuntu 10.04 LTS / 10.10 / 11.04 : thunderbird vulnerabilities (USN-1401-2)	Nessus	Ubuntu Local Security Checks	high
58397	Ubuntu 10.04 LTS / 10.10 : xulrunner-1.9.2 vulnerabilities (USN-1401-1)	Nessus	Ubuntu Local Security Checks	high
57686	Ubuntu 11.10 : thunderbird vulnerabilities (USN-1343-1)	Nessus	Ubuntu Local Security Checks	critical
57458	Ubuntu 11.04 / 11.10 : mozvoikko, ubufox update (USN-1306-2)	Nessus	Ubuntu Local Security Checks	critical
57457	Ubuntu 11.04 / 11.10 : firefox vulnerabilities (USN-1306-1)	Nessus	Ubuntu Local Security Checks	critical
801379	Mozilla Firefox 8.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6109	Mozilla Firefox < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
57361	Thunderbird 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57359	Firefox 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57355	FreeBSD : mozilla -- multiple vulnerabilities (e3ff776b-2ba6-11e1-93c6-0011856a6e37)	Nessus	FreeBSD Local Security Checks	critical
57353	SeaMonkey < 2.6.0 Multiple Vulnerabilities	Nessus	Windows	high
57352	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities	Nessus	Windows	high
57351	Firefox < 9.0 Multiple Vulnerabilities	Nessus	Windows	high
801222	Mozilla Thunderbird 8 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6110	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	SMTP Clients	high

Detections

Analytics

CVE-2011-3658

high

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

high

high

critical

critical

critical

high

high

high

high

critical

high

high

high

high

high