Red Hat Security AdvisoryRHSA-2009:0437
seamonkey security update
Released 2009-04-21 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 seamonkey-1.0.9-0.37.el3, seamonkey-1.0.9-0.37.el3.i386, seamonkey-chat-1.0.9-0.37.el3 +17
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 seamonkey-1.0.9-0.33.el2, seamonkey-1.0.9-0.33.el2.i386, seamonkey-1.0.9-0.33.el2.ia64 +18
- Red Hat Enterprise Linux AS version 3 seamonkey-1.0.9-0.37.el3, seamonkey-1.0.9-0.37.el3.i386, seamonkey-1.0.9-0.37.el3.ia64 +37
- Red Hat Enterprise Linux AS version 4 seamonkey-1.0.9-41.el4, seamonkey-1.0.9-41.el4.i386, seamonkey-1.0.9-41.el4.ia64 +21
- Red Hat Enterprise Linux Desktop version 4 seamonkey-1.0.9-41.el4, seamonkey-1.0.9-41.el4.i386, seamonkey-chat-1.0.9-41.el4 +9
- Red Hat Enterprise Linux ES version 2.1 seamonkey-1.0.9-0.33.el2, seamonkey-1.0.9-0.33.el2.i386, seamonkey-chat-1.0.9-0.33.el2.i386 +8
- Red Hat Enterprise Linux ES version 3 seamonkey-1.0.9-0.37.el3, seamonkey-1.0.9-0.37.el3.i386, seamonkey-1.0.9-0.37.el3.ia64 +27
- Red Hat Enterprise Linux ES version 4 seamonkey-1.0.9-41.el4, seamonkey-1.0.9-41.el4.i386, seamonkey-1.0.9-41.el4.ia64 +15
- Red Hat Enterprise Linux WS version 2.1 seamonkey-1.0.9-0.33.el2, seamonkey-1.0.9-0.33.el2.i386, seamonkey-chat-1.0.9-0.33.el2.i386 +8
- Red Hat Enterprise Linux WS version 3 seamonkey-1.0.9-0.37.el3, seamonkey-1.0.9-0.37.el3.i386, seamonkey-1.0.9-0.37.el3.ia64 +27
- Red Hat Enterprise Linux WS version 4 seamonkey-1.0.9-41.el4, seamonkey-1.0.9-41.el4.i386, seamonkey-1.0.9-41.el4.ia64 +15
- Red Hat Linux Advanced Workstation 2.1 seamonkey-1.0.9-0.33.el2, seamonkey-1.0.9-0.33.el2.ia64, seamonkey-chat-1.0.9-0.33.el2.ia64 +8
Fixes 8 records
Priority LOW 34
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02183 · Published 2009-04-22 · Fixed CWE-20
Priority LOW 29
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1)…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.05565 · Published 2009-04-22 · Fixed CWE-16
Priority LOW 29
The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01497 · Published 2009-02-20 · Fixed
Priority LOW 27
The JavaScript engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corrupt…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01947 · Published 2009-04-22 · Fixed CWE-399
Priority LOW 26
The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01761 · Published 2009-04-22 · Fixed CWE-16
Priority LOW 25
Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02313 · Published 2009-04-22 · Fixed CWE-200
Priority LOW 23
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involv…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01351 · Published 2009-04-22 · Fixed CWE-16
Priority LOW 23
The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS)…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01329 · Published 2009-04-22 · Fixed CWE-16
THREATIST.IORead the docs