已在 Iceweasel（Debian 版本的 Mozilla Firefox Web 浏览器）中发现多种安全问题：多种内存安全错误、缺少输入审查漏洞、释放后使用漏洞、缓冲区溢出和其他编程错误，这些安全问题可能导致任意代码执行、权限升级、信息泄漏或跨站脚本。

我们正在改变稳定更新中的 Iceweasel、Icedove 和 Iceape 的安全更新的方法：我们现在不向后移植安全补丁，而是提供基于 Extended Support Release 分支的版本。因此，此更新引入基于 Firefox 17 的程序包，在未来某时，一旦 ESR 17 结束生命周期，我们将切换到下一个 ESR 分支。

Debian 存档中当前打包的某些 Xul 扩展不兼容新浏览器引擎。可从 http://addons.mozilla.org 检索最新的可兼容版本，作为短期解决方案。仍在挑选用于让打包的扩展与这些 Mozilla 版本兼容的解决方案。

我们再也没有资源来将安全补丁向后移植到旧稳定安全中的 Iceweasel 版本。如果您胜任此任务，并且也愿意提供帮助，请联系 team@security.debian.org。否则，我们将宣布下一轮更新中停止为 Squeeze 中的 Ieweasel、Icedove 和 Iceape 提供安全支持。

MozillaFirefox 已更新到 Firefox 21.0 (bnc#819204)

- MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 多项内存安全危害

- MFSA 2013-42/CVE-2013-1670 (bmo#853709) 内容级别构造函数的特权访问

- MFSA 2013-43/CVE-2013-1671 (bmo#842255) 文件输入控件具有对完整路径的访问权限

- MFSA 2013-46/CVE-2013-1674 (bmo#860971) video 和 onresize 事件的释放后使用

- MFSA 2013-47/CVE-2013-1675 (bmo#866825) DOMSVGZoomEvent 中的未初始化函数

- MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 使用地址审查器时发现内存损坏

MozillaFirefox-branding-openSUSE 中的变更：

- 修改了 Firefox 21 和更高版本的文件位置

- 添加了 DuckDuckGo 作为搜索选项 (bnc#801121)

MozillaThunderbird 已更新到安全更新 Thunderbird 17.0.6 (bnc#819204)：

- MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 多项内存安全危害

- MFSA 2013-42/CVE-2013-1670 (bmo#853709) 内容级别构造函数的特权访问

- MFSA 2013-46/CVE-2013-1674 (bmo#860971) video 和 onresize 事件的释放后使用

- MFSA 2013-47/CVE-2013-1675 (bmo#866825) DOMSVGZoomEvent 中的未初始化函数

- MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 使用地址审查器时发现内存损坏

远程主机受到 GLSA-201309-23 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可进行 XSS 攻击、欺骗 URL、绕过地址空间布局随机化、进行点击劫持攻击、获取潜在敏感信息、绕过访问限制、修改本地文件系统或进行其他不明攻击。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Thunderbird 17.x prior to 17.0.6 are affected by the following vulnerabilites : 

 - Various memory safety issues exist. (CVE-2013-0801)
 - It is possible to call a content level constructor that allows for the constructor to have chrome privileged access. (CVE-2013-1670)
 - A local privilege escalation issues exists in the Mozilla Maintenance Service. (CVE-2013-1672)
 - A use-after-free vulnerability exists when resizing video while playing. (CVE-2013-1674)
 - Some 'DOMSVGZoomEvent' functions are used without being properly initialized which could lead to information disclosure. (CVE-2013-1675)
 - Multiple memory corruption issues exist. (CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Firefox prior to 21.0 are potentially affected by the following security issues :

 - An outdated MozillaMaintenance Service registry entry can trigger a trusted path privilege escalation (CVE-2013-1673)
 - An unspecified arbitrary code execution vulnerability within update service (CVE-2012-1942)
 - An arbitrary code execution vulnerability in Mozilla Maintenance Service with junctions (CVE-2013-1672)
 - Multiple memory corruption vulnerabilities exist that can lead to code execution (CVE-2013-0801, CVE-2013-1669)
 - The Chrome Object Wrapper (COW) does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (CVE-2013-1670)
 - File input control can disclose full path information, leading to information leakage that can be used for further attacks (CVE-2013-1671)
 - Some DOMSVGZoomEvent functions are used without being properly initialized, which can lead to information leakage in certain cases. (CVE-2013-1675)
 - A series of use-after-free, out of bounds read, and invalid write problems can be exploited for remote code execution (CVE-2013-1674, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Thunderbird 17.x prior to 17.0.6 are potentially affected by the following vulnerabilities : 

  - Various memory safety issues exist. (CVE-2013-0801)

  - It is possible to call a content level constructor that allows for the constructor to have chrome privileged access. (CVE-2013-1670)

  - A local privilege escalation issues exists in the Mozilla Maintenance Service. (CVE-2013-1672)

  - A use-after-free vulnerability exists when resizing video while playing. (CVE-2013-1674)

  - Some 'DOMSVGZoomEvent' functions are used without being properly initialized which could lead to information disclosure. (CVE-2013-1675)

  - Multiple memory corruption issues exist. (CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Versions of Firefox 20.x and older are potentially affected by the following security issues :

  - An outdated MozillaMaintenance Service registry entry can trigger a trusted path privilege escalation (CVE-2013-1673)

  - An unspecified arbitrary code execution vulnerability within update service (CVE-2012-1942)

  - An arbitrary code execution vulnerability in Mozilla Maintenance Service with junctions (CVE-2013-1672)

  - Multiple memory corruption vulnerabilities exist that can lead to code execution (CVE-2013-0801, CVE-2013-1669)

  - The Chrome Object Wrapper (COW) does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (CVE-2013-1670)

  - File input control can disclose full path information, leading to information leakage that can be used for further attacks (CVE-2013-1671)

  - Some DOMSVGZoomEvent functions are used without being properly initialized, which can lead to information leakage in certain cases. (CVE-2013-1675)

  - A series of use-after-free, out of bounds read, and invalid write problems can be exploited for remote code execution (CVE-2013-1674, CVE-2013-1676, CVE-2013-1677, CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

ID	Name	Product	Family	Published	Updated	Severity
66766	Debian DSA-2699-1：iceweasel - 多个漏洞	Nessus	Debian Local Security Checks	6/3/2013	6/18/2024	critical
75009	openSUSE 安全更新：MozillaFirefox (openSUSE-SU-2013:0946-1)	Nessus	SuSE Local Security Checks	6/13/2014	3/8/2022	critical
75013	openSUSE 安全更新：MozillaThunderbird (openSUSE-SU-2013:0894-1)	Nessus	SuSE Local Security Checks	6/13/2014	3/8/2022	critical
70183	GLSA-201309-23：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	9/28/2013	3/29/2022	info
6822	Mozilla Thunderbird 17.x < 17.0.6 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	5/15/2013	3/6/2019	high
6828	Mozilla Firefox < 21.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/16/2013	3/6/2019	high
801314	Mozilla Thunderbird 17.x < 17.0.6 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	5/15/2013		high
801267	Mozilla Firefox 20.x <= 20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	5/16/2013		medium

Detections

Analytics

Plugins Search

critical

critical

critical

info

high

high

high

medium