Red Hat Security Advisory

RHSA-2008:0977

seamonkey security update

Released 2008-11-13 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 3 seamonkey-1.0.9-0.25.el3, seamonkey-1.0.9-0.25.el3.i386, seamonkey-chat-1.0.9-0.25.el3 +17
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 seamonkey-1.0.9-0.21.el2, seamonkey-1.0.9-0.21.el2.i386, seamonkey-1.0.9-0.21.el2.ia64 +18
Red Hat Enterprise Linux AS version 3 seamonkey-1.0.9-0.25.el3, seamonkey-1.0.9-0.25.el3.i386, seamonkey-1.0.9-0.25.el3.ia64 +37
Red Hat Enterprise Linux AS version 4 seamonkey-1.0.9-28.el4, seamonkey-1.0.9-28.el4.i386, seamonkey-1.0.9-28.el4.ia64 +21
Red Hat Enterprise Linux Desktop version 4 seamonkey-1.0.9-28.el4, seamonkey-1.0.9-28.el4.i386, seamonkey-chat-1.0.9-28.el4 +9
Red Hat Enterprise Linux ES version 2.1 seamonkey-1.0.9-0.21.el2, seamonkey-1.0.9-0.21.el2.i386, seamonkey-chat-1.0.9-0.21.el2.i386 +8
Red Hat Enterprise Linux ES version 3 seamonkey-1.0.9-0.25.el3, seamonkey-1.0.9-0.25.el3.i386, seamonkey-1.0.9-0.25.el3.ia64 +27
Red Hat Enterprise Linux ES version 4 seamonkey-1.0.9-28.el4, seamonkey-1.0.9-28.el4.i386, seamonkey-1.0.9-28.el4.ia64 +15
Red Hat Enterprise Linux WS version 2.1 seamonkey-1.0.9-0.21.el2, seamonkey-1.0.9-0.21.el2.i386, seamonkey-chat-1.0.9-0.21.el2.i386 +8
Red Hat Enterprise Linux WS version 3 seamonkey-1.0.9-0.25.el3, seamonkey-1.0.9-0.25.el3.i386, seamonkey-1.0.9-0.25.el3.ia64 +27
Red Hat Enterprise Linux WS version 4 seamonkey-1.0.9-28.el4, seamonkey-1.0.9-28.el4.i386, seamonkey-1.0.9-28.el4.ia64 +15
Red Hat Linux Advanced Workstation 2.1 seamonkey-1.0.9-0.21.el2, seamonkey-1.0.9-0.21.el2.ia64, seamonkey-chat-1.0.9-0.21.el2.ia64 +8

Fixes 13 records

TI-2008-04768 CVE-2008-5014 · GHSA-8m88-6wvj-46c6

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird…

MEDIUM 52

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly exec…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05865 Published 2008-11-13 Fixed CWE-20

TI-2008-00016 CVE-2008-0017 · GHSA-4386-5g32-qp3p

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4…

MEDIUM 50

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07677 Published 2008-11-13 Fixed CWE-119

TI-2008-04805 CVE-2008-5052 · GHSA-4fmr-pw88-x9j3

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before…

MEDIUM 49

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (cr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03448 Published 2008-11-13 Fixed CWE-399

TI-2008-04772 CVE-2008-5018 · GHSA-ww2m-xjhr-w96h

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18…

MEDIUM 49

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via ve…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-399

TI-2008-04771 CVE-2008-5017 · GHSA-h983-53hw-mp7w

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x…

MEDIUM 49

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers t…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-189

TI-2008-04767 CVE-2008-5013 · GHSA-7pc8-c743-pmjf

Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check…

MEDIUM 48

Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafte…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04769 Published 2008-11-13 Fixed CWE-399

TI-2008-04774 CVE-2008-5021 · GHSA-7qf3-8pfp-6qg9

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x…

MEDIUM 46

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03633 Published 2008-11-13 Fixed CWE-362

TI-2008-04777 CVE-2008-5024 · GHSA-r9x5-wf23-5hh7

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before…

LOW 39

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attacke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03641 Published 2008-11-13 Fixed CWE-91

TI-2008-04776 CVE-2008-5023 · GHSA-w4jm-xq46-3m5g

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13…

LOW 39

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03261 Published 2008-11-13 Fixed CWE-20

TI-2008-04775 CVE-2008-5022 · GHSA-49p4-3jx5-xgmj

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox…

LOW 38

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-orig…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03029 Published 2008-11-13 Fixed CWE-287

TI-2008-04770 CVE-2008-5016 · GHSA-9gm5-4h53-36xh

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18…

LOW 27

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an as…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02271 Published 2008-11-13 Fixed CWE-399

TI-2008-04766 CVE-2008-5012 · GHSA-hfvm-r385-4pvq

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x…

LOW 27

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attac…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02026 Published 2008-11-13 Fixed CWE-200

TI-2008-04773 CVE-2008-5019 · GHSA-w542-59hv-5363

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18…

LOW 26

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaSc…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0307 Published 2008-11-13 Fixed CWE-79