LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: October 24th, 2014
Linux Security Week: October 20th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Gentoo: 201309-23 Mozilla Products: Multiple vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Gentoo Multiple vulnerabilities have been found in Mozilla Firefox, Thunderbird, and SeaMonkey, some of which may allow a remote user to execute arbitrary code.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201309-23
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High
    Title: Mozilla Products: Multiple vulnerabilities
     Date: September 27, 2013
     Bugs: #450940, #458390, #460818, #464226, #469868, #474758,
           #479968, #485258
       ID: 201309-23

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Mozilla Firefox,
Thunderbird, and SeaMonkey, some of which may allow a remote user to
execute arbitrary code.

Background
==========

Mozilla Firefox is an open-source web browser and Mozilla Thunderbird
an open-source email client, both from the Mozilla Project. The
SeaMonkey project is a community effort to deliver production-quality
releases of code derived from the application formerly known as the
'Mozilla Application Suite'.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  mail-client/thunderbird      < 17.0.9                  >= 17.0.9
  2  www-client/firefox           < 17.0.9                  >= 17.0.9
  3  www-client/seamonkey          < 2.21                     >= 2.21
  4  mail-client/thunderbird-bin
                                  < 17.0.9                  >= 17.0.9
  5  www-client/firefox-bin       < 17.0.9                  >= 17.0.9
  6  www-client/seamonkey-bin
                                   < 2.21                     >= 2.21
    -------------------------------------------------------------------
     6 affected packages

Description
===========

Multiple vulnerabilities have been discovered in Mozilla Firefox,
Thunderbird, and SeaMonkey. Please review the CVE identifiers
referenced below for details.

Impact
======

A remote attacker could entice a user to view a specially crafted web
page or email, possibly resulting in execution of arbitrary code or a
Denial of Service condition. Further, a remote attacker could conduct
XSS attacks, spoof URLs, bypass address space layout randomization,
conduct clickjacking attacks, obtain potentially sensitive information,
bypass access restrictions, modify the local filesystem, or conduct
other unspecified attacks.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mozilla Firefox users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/firefox-17.0.9"

All users of the Mozilla Firefox binary package should upgrade to the
latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-17.0.9"

All Mozilla Thunderbird users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-17.0.9"

All users of the Mozilla Thunderbird binary package should upgrade to
the latest version:

  # emerge --sync
  # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-17.0.9"

All SeaMonkey users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/seamonkey-2.21"

All users of the Mozilla SeaMonkey binary package should upgrade to the
latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/seamonkey-bin-2.21"

References
==========

[   1 ] CVE-2013-0744
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0744
[   2 ] CVE-2013-0745
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0745
[   3 ] CVE-2013-0746
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0746
[   4 ] CVE-2013-0747
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0747
[   5 ] CVE-2013-0748
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0748
[   6 ] CVE-2013-0749
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0749
[   7 ] CVE-2013-0750
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0750
[   8 ] CVE-2013-0751
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0751
[   9 ] CVE-2013-0752
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0752
[  10 ] CVE-2013-0753
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0753
[  11 ] CVE-2013-0754
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0754
[  12 ] CVE-2013-0755
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0755
[  13 ] CVE-2013-0756
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0756
[  14 ] CVE-2013-0757
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0757
[  15 ] CVE-2013-0758
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0758
[  16 ] CVE-2013-0759
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0759
[  17 ] CVE-2013-0760
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0760
[  18 ] CVE-2013-0761
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0761
[  19 ] CVE-2013-0762
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0762
[  20 ] CVE-2013-0763
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0763
[  21 ] CVE-2013-0764
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0764
[  22 ] CVE-2013-0765
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0765
[  23 ] CVE-2013-0766
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0766
[  24 ] CVE-2013-0767
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0767
[  25 ] CVE-2013-0768
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0768
[  26 ] CVE-2013-0769
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0769
[  27 ] CVE-2013-0770
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0770
[  28 ] CVE-2013-0771
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0771
[  29 ] CVE-2013-0772
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0772
[  30 ] CVE-2013-0773
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0773
[  31 ] CVE-2013-0774
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0774
[  32 ] CVE-2013-0775
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0775
[  33 ] CVE-2013-0776
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0776
[  34 ] CVE-2013-0777
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0777
[  35 ] CVE-2013-0778
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0778
[  36 ] CVE-2013-0779
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0779
[  37 ] CVE-2013-0780
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0780
[  38 ] CVE-2013-0781
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0781
[  39 ] CVE-2013-0782
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0782
[  40 ] CVE-2013-0783
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0783
[  41 ] CVE-2013-0784
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0784
[  42 ] CVE-2013-0787
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0787
[  43 ] CVE-2013-0788
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0788
[  44 ] CVE-2013-0789
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0789
[  45 ] CVE-2013-0791
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0791
[  46 ] CVE-2013-0792
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0792
[  47 ] CVE-2013-0793
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0793
[  48 ] CVE-2013-0794
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0794
[  49 ] CVE-2013-0795
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0795
[  50 ] CVE-2013-0796
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0796
[  51 ] CVE-2013-0797
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0797
[  52 ] CVE-2013-0799
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0799
[  53 ] CVE-2013-0800
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0800
[  54 ] CVE-2013-0801
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0801
[  55 ] CVE-2013-1670
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1670
[  56 ] CVE-2013-1671
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1671
[  57 ] CVE-2013-1674
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1674
[  58 ] CVE-2013-1675
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1675
[  59 ] CVE-2013-1676
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1676
[  60 ] CVE-2013-1677
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1677
[  61 ] CVE-2013-1678
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1678
[  62 ] CVE-2013-1679
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1679
[  63 ] CVE-2013-1680
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1680
[  64 ] CVE-2013-1681
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1681
[  65 ] CVE-2013-1682
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1682
[  66 ] CVE-2013-1684
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1684
[  67 ] CVE-2013-1687
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1687
[  68 ] CVE-2013-1690
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1690
[  69 ] CVE-2013-1692
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1692
[  70 ] CVE-2013-1693
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1693
[  71 ] CVE-2013-1694
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1694
[  72 ] CVE-2013-1697
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1697
[  73 ] CVE-2013-1701
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1701
[  74 ] CVE-2013-1702
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1702
[  75 ] CVE-2013-1704
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1704
[  76 ] CVE-2013-1705
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1705
[  77 ] CVE-2013-1707
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1707
[  78 ] CVE-2013-1708
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1708
[  79 ] CVE-2013-1709
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1709
[  80 ] CVE-2013-1710
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1710
[  81 ] CVE-2013-1711
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1711
[  82 ] CVE-2013-1712
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1712
[  83 ] CVE-2013-1713
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1713
[  84 ] CVE-2013-1714
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1714
[  85 ] CVE-2013-1717
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1717
[  86 ] CVE-2013-1718
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1718
[  87 ] CVE-2013-1719
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1719
[  88 ] CVE-2013-1720
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1720
[  89 ] CVE-2013-1722
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1722
[  90 ] CVE-2013-1723
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1723
[  91 ] CVE-2013-1724
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1724
[  92 ] CVE-2013-1725
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1725
[  93 ] CVE-2013-1726
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1726
[  94 ] CVE-2013-1728
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1728
[  95 ] CVE-2013-1730
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1730
[  96 ] CVE-2013-1732
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1732
[  97 ] CVE-2013-1735
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1735
[  98 ] CVE-2013-1736
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1736
[  99 ] CVE-2013-1737
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1737
[ 100 ] CVE-2013-1738
        http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1738

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 http://security.gentoo.org/glsa/glsa-201309-23.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

Copyright 2013 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Disaster as CryptoWall encrypts US firm's entire server installation
Now Everyone Wants to Sell You a Magical Anonymity Router. Choose Wisely
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.