| Description: | Summary:
The remote host is missing an update to the system
as announced in the referenced advisory.
Vulnerability Insight:
The following packages are affected:
firefox
linux-firefox
linux-seamonkey
linux-thunderbird
seamonkey
thunderbird
libxul
CVE-2012-4201
The evalInSandbox implementation in Mozilla Firefox before 17.0,
Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird
ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect
context during the handling of JavaScript code that sets the
location.href property, which allows remote attackers to conduct
cross-site scripting (XSS) attacks or read arbitrary files by
leveraging a sandboxed add-on.
CVE-2012-4202
Heap-based buffer overflow in the image::RasterImage::DrawFrameTo
function in Mozilla Firefox before 17.0, Firefox ESR 10.x before
10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11,
and SeaMonkey before 2.14 allows remote attackers to execute arbitrary
code via a crafted GIF image.
CVE-2012-4203
The New Tab page in Mozilla Firefox before 17.0 uses a privileged
context for execution of JavaScript code by bookmarklets, which allows
user-assisted remote attackers to run arbitrary programs by leveraging
a javascript: URL in a bookmark.
CVE-2012-4204
The str_unescape function in the JavaScript engine in Mozilla Firefox
before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows
remote attackers to execute arbitrary code or cause a denial of
service (memory corruption and application crash) via unspecified
vectors.
Text truncated. Please see the references for more information.
Solution:
Update your system with the appropriate patches or
software upgrades.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
