Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling.

seamonkey version 2.6 fixes several security issues :

dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation dbg114-seamonkey-5574 new_updateinfo seamonkey-5574 MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes

Mozilla Firefox Version 9 fixes several security issues :

dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-55/CVE-2011-3658:
nsSVGValue out-of-bounds access dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation dbg114-MozillaFirefox-5577 MozillaFirefox-5577 new_updateinfo MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes

seamonkey version 2.6 fixes several security issues :

  - MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety     hazards

  - MFSA 2011-54/CVE-2011-3661: Potentially exploitable     crash in the YARR regular expression library

  - MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds     access

  - MFSA 2011-56/CVE-2011-3663: Key detection without     JavaScript via SVG animation

  - MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to     extreme sizes

Mozilla Firefox and Thunderbird version 9 and seamonkey version 2.6 updates fix several security issues :

  - MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety     hazards

  - MFSA 2011-54/CVE-2011-3661: Potentially exploitable     crash in the YARR regular expression library

  - MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds     access

  - MFSA 2011-56/CVE-2011-3663: Key detection without     JavaScript via SVG animation

  - MFSA 2011-58/CVE-2011-3665: Crash scaling video elements     to extreme sizes

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Security issues were identified and fixed in mozilla firefox and thunderbird :

The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements (CVE-2011-3658).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors (CVE-2011-3660).

YARR, as used in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript (CVE-2011-3661).

Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page by using SVG animation accessKey events within that web page (CVE-2011-3663).

Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling (CVE-2011-3665).

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Thunderbird or execute arbitrary code as the user that invoked Thunderbird.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Thunderbird. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from Thunderbird in a context where the user believed scripting was disabled. (CVE-2011-3663)

It was discovered that it was possible to crash Thunderbird when scaling an OGG <video> element to extreme sizes. (CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1306-1 fixed vulnerabilities in Firefox. This update provides updated Mozvoikko and ubufox packages for use with Firefox 9.

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Firefox or execute arbitrary code as the user that invoked Firefox.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Firefox. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from the browser in a context where the user believed scripting was disabled.
(CVE-2011-3663)

It was discovered that it was possible to crash Firefox when scaling an OGG <video> element to extreme sizes.
(CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson discovered several memory safety issues which could possibly be exploited to crash Firefox or execute arbitrary code as the user that invoked Firefox.
(CVE-2011-3660)

Aki Helin discovered a crash in the YARR regular expression library that could be triggered by JavaScript in web content. (CVE-2011-3661)

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. An attacker could potentially exploit this vulnerability to crash Firefox. (CVE-2011-3658)

Mario Heiderich discovered it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. A malicious web page could potentially exploit this to trick a user into interacting with a prompt thinking it came from the browser in a context where the user believed scripting was disabled.
(CVE-2011-3663)

It was discovered that it was possible to crash Firefox when scaling an OGG <video> element to extreme sizes. (CVE-2011-3665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 8.0 are potentially affected by the following security issues : 

  - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)

  - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

Versions of Firefox prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - An error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when OGG 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

The installed version of Thunderbird 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'        'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The Mozilla Project reports :

MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-55 nsSVGValue out-of-bounds access

MFSA 2011-56 Key detection without JavaScript via SVG animation

MFSA 2011-58 Crash scaling video to extreme sizes

The installed version of SeaMonkey is earlier than 2.6.0.  Such versions are potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Thunderbird is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The remote host has a email client installed that is vulnerable to multiple attack vectors.
 

Versions of Thunderbird 8.0 are potentially affected by the following security issues : 

  - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)

  - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

Versions of Mozilla Thunderbird prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame. It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

ID	Name	Product	Family	Severity
76025	openSUSE Security Update : seamonkey (openSUSE-SU-2012:0007-1)	Nessus	SuSE Local Security Checks	critical
75950	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:0039-2)	Nessus	SuSE Local Security Checks	critical
75744	openSUSE Security Update : seamonkey (openSUSE-SU-2012:0007-1)	Nessus	SuSE Local Security Checks	critical
74515	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-2011-101)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
61940	Mandriva Linux Security Advisory : mozilla (MDVSA-2011:192)	Nessus	Mandriva Local Security Checks	critical
57686	Ubuntu 11.10 : thunderbird vulnerabilities (USN-1343-1)	Nessus	Ubuntu Local Security Checks	critical
57458	Ubuntu 11.04 / 11.10 : mozvoikko, ubufox update (USN-1306-2)	Nessus	Ubuntu Local Security Checks	critical
57457	Ubuntu 11.04 / 11.10 : firefox vulnerabilities (USN-1306-1)	Nessus	Ubuntu Local Security Checks	critical
801379	Mozilla Firefox 8.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6109	Mozilla Firefox < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
57361	Thunderbird 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57359	Firefox 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57355	FreeBSD : mozilla -- multiple vulnerabilities (e3ff776b-2ba6-11e1-93c6-0011856a6e37)	Nessus	FreeBSD Local Security Checks	critical
57353	SeaMonkey < 2.6.0 Multiple Vulnerabilities	Nessus	Windows	high
57352	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities	Nessus	Windows	high
57351	Firefox < 9.0 Multiple Vulnerabilities	Nessus	Windows	high
801222	Mozilla Thunderbird 8 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
6110	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	SMTP Clients	high

Detections

Analytics

CVE-2011-3665

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

high

high

high

high

high