Red Hat Security Advisory

RHSA-2006:0328

firefox security update

Released 2006-04-14 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AS version 4 firefox-1.0.8-1.4.1, firefox-1.0.8-1.4.1.i386, firefox-1.0.8-1.4.1.ia64 +1
Red Hat Enterprise Linux Desktop version 4 firefox-1.0.8-1.4.1, firefox-1.0.8-1.4.1.i386
Red Hat Enterprise Linux ES version 4 firefox-1.0.8-1.4.1, firefox-1.0.8-1.4.1.i386, firefox-1.0.8-1.4.1.ia64
Red Hat Enterprise Linux WS version 4 firefox-1.0.8-1.4.1, firefox-1.0.8-1.4.1.i386, firefox-1.0.8-1.4.1.ia64

Fixes 19 records

TI-2006-01676 CVE-2006-1730 · GHSA-w48v-q8fw-236r

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before…

MEDIUM 53

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.1034 Published 2006-04-14 Fixed CWE-189

TI-2006-00727 CVE-2006-0749 · GHSA-pwcc-x4h8-g74h

nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

MEDIUM 53

nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.10487 Published 2006-04-14 Fixed CWE-399

TI-2006-01681 CVE-2006-1735 · GHSA-r677-35c3-7hmg

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 52

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XB…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09187 Published 2006-04-14 Fixed CWE-264

TI-2006-01674 CVE-2006-1728 · GHSA-27mx-p3cq-xm25

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x…

MEDIUM 52

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknow…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09488 Published 2006-04-14 Fixed

TI-2006-01736 CVE-2006-1790 · GHSA-h8w2-9pxp-qpcc

A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of…

MEDIUM 51

A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05152 Published 2006-04-14 Fixed CWE-399

TI-2006-01685 CVE-2006-1739 · GHSA-wp5w-vcq2-q2gv

The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

MEDIUM 51

The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) a…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08443 Published 2006-04-14 Fixed CWE-119

TI-2006-00726 CVE-2006-0748 · GHSA-hhhq-8f65-6q7x

Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 51

Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical orderi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07968 Published 2006-04-14 Fixed CWE-399

TI-2006-01683 CVE-2006-1737 · GHSA-rxwh-g7jh-p598

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

MEDIUM 48

Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly e…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04914 Published 2006-04-14 Fixed CWE-189

TI-2006-01673 CVE-2006-1727 · GHSA-rmjx-gf38-h2g4

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x…

MEDIUM 43

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.06371 Published 2006-04-14 Fixed

TI-2006-01670 CVE-2006-1724 · GHSA-8v22-vg6j-pf23

Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8…

MEDIUM 43

Unspecified vulnerability in Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly e…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0689 Published 2006-04-14 Fixed

TI-2006-01680 CVE-2006-1734 · GHSA-pc38-w37f-288f

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

MEDIUM 40

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.06986 Published 2006-04-14 Fixed

TI-2006-01679 CVE-2006-1733 · GHSA-qc6m-vfp3-h4f4

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

LOW 38

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allo…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05196 Published 2006-04-14 Fixed CWE-264

TI-2006-01688 CVE-2006-1742 · GHSA-7mq9-p447-2gr2

The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before…

LOW 30

The JavaScript engine in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly handle temporary variables that are not garbage coll…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03969 Published 2006-04-14 Fixed

TI-2006-01684 CVE-2006-1738 · GHSA-wgp2-rffm-276c

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

LOW 30

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by ch…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0448 Published 2006-04-14 Fixed

TI-2006-01687 CVE-2006-1741 · GHSA-8r79-mxmm-hhc6

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and…

LOW 27

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03892 Published 2006-04-14 Fixed CWE-79

TI-2006-01678 CVE-2006-1732 · GHSA-q8q4-prmv-qrjp

Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x…

LOW 25

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02963 Published 2006-04-14 Fixed

TI-2006-01677 CVE-2006-1731 · GHSA-5g37-6qw5-9qqj

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite…

LOW 24

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call o…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01822 Published 2006-04-14 Fixed CWE-79

TI-2006-01675 CVE-2006-1729 · GHSA-2gxf-f3cr-5m3p

Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13…

LOW 24

Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, the…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02234 Published 2006-04-14 Fixed CWE-20

TI-2006-01686 CVE-2006-1740 · GHSA-3gq2-8vxj-g5w7

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and…

LOW 18

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to spoof secure site indicators such as the locked icon by opening the trusted site in…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.02536 Published 2006-04-14 Fixed