已安裝的 SeaMonkey 版本比 2.4.0 舊。這些版本可能會受到以下安全性問題影響：

  - 如果攻擊者可誘騙 (例如透過惡意遊戲) 使用者按住「Enter」按鍵，這時可導致使用者下載並執行惡意應用程式或延伸模組。(CVE-2011-2372、CVE-2011-3001)

  - 存在不明錯誤，可遭到惡意利用而損毀記憶體。目前尚無其他可用資訊。(CVE-2011-2995、CVE-2011-2997)

  - 處理「Location」標頭時存在一個弱點。
    在訪問易受攻擊的 Web 伺服器時這可能導致回應分割攻擊。相同修復已經套用至標頭「Content-Length」和「Content-Disposition」。(CVE-2011-3000)

  - WebGL 的 ANGLE 程式庫中存在一個錯誤。其並未正確檢查「GrowAtomTable()」函式的傳回值。此弱點可能遭到利用，透過傳送一系列的要求造成緩衝區溢位。另外，WebGL 中存在一個不明錯誤，攻擊者可能利用此錯誤損毀記憶體。(CVE-2011-3002、CVE-2011-3003)

  - JSSubScriptLoader 中存在一個錯誤，其不正確地將「XPCNativeWrappers」解除封裝。攻擊者可透過誘騙使用者安裝惡意外掛程式的方式，利用此問題來執行任意程式碼。
    (CVE-2011-3004)

  - 剖析 OGG 標頭時存在一個釋放後使用錯誤。
    (CVE-2011-3005)

  - YARR 規則運算式程式庫中存在一個不明錯誤，攻擊者可利用此錯誤損毀記憶體。(CVE-2011-3232)

遠端主機受到 GLSA-201301-01 中所述的弱點影響 (Mozilla 產品：多個弱點)

在 Mozilla Firefox、Thunderbird、SeaMonkey、NSS、GNU IceCat 與 XULRunner 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

遠端攻擊者可引誘使用者檢視特製的網頁或電子郵件，進而可能導致執行任意程式碼或拒絕服務情況。此外，遠端攻擊者或許能夠執行攔截式攻擊、取得敏感資訊、繞過限制及保護機制、強制檔案下載、發動 XML 插入攻擊、發動 XSS 攻擊、繞過同源原則、偽造 URL 以發動網路釣魚攻擊、觸發垂直捲動、偽造位置列、偽造 SSL 指示器、修改瀏覽器的字型、發動點擊劫持攻擊，或造成其他不明的影響。
 本機攻擊者可取得提升的權限、取得敏感資訊，或取代任意下載檔案。
 因應措施：

目前尚無已知的因應措施。

Versions of Firefox prior to 7.0 are affected by the following security issues : 

 - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372)
 - Unspecified errors exist that can be exploited to corrupt memory.  No additional information is available at this time. (CVE-2011-2995, CVE-2011-2997)
 - A weakness exists when handling the 'Location' header.  This can lead to response splitting attacks when visiting a vulnerable web server.  The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)
 - An error exists within WebGL's ANGLE library.  It does not properly check for return values from the 'GrowAtomTable()' function.  This vulnerability can be exploited to cause a buffer overflow by sending a series of requests.  Additionally, an unspecified error exists within WebGL that can be exploited to corrupt memory. (CVE-2011-3002, CVE-2011-3003)
 - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'.  By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3004)
 - A use-after-free error exists when parsing OGG headers. (CVE-2011-3005)
 - There is an unspecified error within the YARR regular expression library that can be exploited to corrupt memory. (CVE-2011-3232)

Versions of SeaMonkey earlier than 2.4.0 are potentially affected by multiple vulnerabilities : 

  - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372, CVE-2011-3001)

  - Unspecified errors exist that can be exploited to corrupt memory.  No additional information is available at this time. (CVE-2011-2995, CVE-2011-2997)

  - A weakness exists when handling the 'Location' header.  This can be lead to response splitting attacks when visiting a vulnerable web server.  The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)

  - An error exists with WebGL's ANGLE library.  It does not properly check for return values from the 'GrowAtomTable()' function.  This vulnerability can be exploited to cause a buffer overflow by sending a series of requests.  Additionally, an unspecified error exists within WebGL that can be exploited to corrupt memory. (CVE-2011-3002, CVE-2011-3003)

  - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'.  By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3004)

  - A use-after-free error exists when parsing OGG headers. (CVE-2011-3005)

  - There is an unspecified error within the YARR regular expression library that can be exploited to corrupt memory. (CVE-2011-3232)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 6.0 are potentially affected by the following security issues : 

  - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372)

  - Unspecified errors exist that can be exploited to corrupt memory.  No additional information is available at this time. (CVE-2011-2995, CVE-2011-2997)

  - A weakness exists when handling the 'Location' header.  This can lead to response splitting attacks when visiting a vulnerable web server.  The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)

  - An error exists within WebGL's ANGLE library.  It does not properly check for return values from the 'GrowAtomTable()' function.  This vulnerability can be exploited to cause a buffer overflow by sending a series of requests.  Additionally, an unspecified error exists within WebGL that can be exploited to corrupt memory. (CVE-2011-3002, CVE-2011-3003)

  - There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'.  By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3004)

  - A use-after-free error exists when parsing OGG headers. (CVE-2011-3005)

  - There is an unspecified error within the YARR regular expression library that can be exploited to corrupt memory. (CVE-2011-3232)

ID	Name	Product	Family	Published	Updated	Severity
56337	SeaMonkey < 2.4.0 多個弱點	Nessus	Windows	9/29/2011	7/27/2018	high
63402	GLSA-201301-01：Mozilla 產品：多個弱點 (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	12/5/2022	critical
6028	Mozilla Firefox < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/29/2011	3/6/2019	high
6030	SeaMonkey 2.x < 2.4.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/29/2011	3/6/2019	high
801285	Mozilla Firefox 6.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	9/29/2011		high
801225	Mozilla SeaMonkey 2.x < 2.4.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	9/29/2011		high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high