Detections
Analytics
SeaMonkey < 1.1.19 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 5479
Synopsis
The remote host is running a web browser that is vulnerable to multiple attack vectors.Description
The remote host is running a version of SeaMonkey earlier than 1.1.19. Such versions are potentially affected by multiple vulnerabilities :- The columns of a XUL tree element could be manipulated in a particular way which would leave a pointer owned by the column pointing to freed memory. (MFSA 2009-49)
- A heap-based overflow exists in Mozilla's string to floating point number conversion routines. (MFSA 2009-59)
- It is possible to obfuscate the name of files to be downloaded by using a right-to-left override character (RTL). (MFSA 2009-62)
- Mozilla's NTLM implementation is vulnerable to reflection attacks in which NTLM credentials from one application could be forwarded to another arbitrary application. (MFSA 2009-68)
- Scriptable plugin content, such as Flash objects, can be loaded and executed by embedding the content in an iframe inside the message. (MFSA 2010-06)
- Multiple memory corruption vulnerabilities which could potentially lead to the execution of arbitrary code. (MFSA 2010-07)
Solution
Upgrade to SeaMonkey 1.1.19 or later.See Also
http://www.mozilla.org/security/announce/2009/mfsa2009-68.html
http://www.mozilla.org/security/announce/2010/mfsa2010-06.html
http://www.mozilla.org/security/announce/2010/mfsa2010-07.html
http://www.mozilla.org/security/announce/2009/mfsa2009-49.html
http://www.mozilla.org/security/announce/2009/mfsa2009-62.html
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html
http://www.mozilla.org/security/known-vulnerabilities/seamonkey11.html#seamonkey1.1.19
Plugin Details
Severity: Medium
ID: 5479
Family: Web Clients
Published: 3/19/2010
Updated: 3/6/2019
Nessus ID: 45111
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:seamonkey
Patch Publication Date: 3/16/2010
Vulnerability Publication Date: 3/18/2010
Reference Information
CVE: CVE-2009-0689, CVE-2009-2072, CVE-2009-2463, CVE-2009-3075, CVE-2009-3077, CVE-2009-3385, CVE-2009-3983, CVE-2010-0161, CVE-2010-0163