Branch p7 update bulletin.

Package nss updated to version 3.15.2-alt1 for branch p7 in task 107222.

Published: 2013-10-22

BDU:2015-02928

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить доступность защищаемой информации

Severity: MEDIUM (5.0)

References:

Published: 2013-10-23
Modified: 2024-11-21

CVE-2013-1739

Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure.

Severity: MEDIUM (5.0)

References:

Package xulrunner updated to version 24.0-alt0.M70P.1 for branch p7 in task 107222.

No data currently available.

GStreamer support absent

Package firefox updated to version 24.1.0-alt0.M70P.1 for branch p7 in task 107222.

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1718

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1719

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1720

The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1721

Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21, allows remote attackers to execute arbitrary code via a crafted web site.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1722

Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1723

The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service (application crash) by leveraging incorrect event usage after widget-memory reallocation.

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1724

Use-after-free vulnerability in the mozilla::dom::HTMLFormElement::IsDefaultSubmitElement function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a destroyed SELECT element.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1725

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not ensure that initialization occurs for JavaScript objects with compartments, which allows remote attackers to execute arbitrary code by leveraging incorrect scope handling.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1726

Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature verification but before MAR use.

Severity: MEDIUM (6.2)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1728

The IonMonkey JavaScript engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21, when Valgrind mode is used, does not properly initialize memory, which makes it easier for remote attackers to obtain sensitive information via unspecified vectors.

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1730

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch, or assertion failure and application exit) via a crafted web site.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1732

Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via crafted use of lists and floats within a multi-column layout.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1735

Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1736

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to improperly establishing parent-child relationships of range-request nodes.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1737

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.

Severity: MEDIUM (5.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1738

Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.

Severity: CRITICAL (9.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5590

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5591

Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5592

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5593

The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct clickjacking attacks via vectors that trigger navigation off of a page containing this element.

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5595

The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote attackers to conduct buffer overflow attacks via a crafted web page.

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5596

The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements, as demonstrated by the Never-Ending Reddit on reddit.com.

Severity: MEDIUM (6.8)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5597

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a state-change event during an update of the offline cache.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5598

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.

Severity: HIGH (8.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5599

Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5600

Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors involving a blob: URL.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5601

Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through the garbage collection (GC) API.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5602

The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to direct proxies.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5603

Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving HTML document templates.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5604

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents.

Severity: CRITICAL (9.3)

References:

No data currently available.

GStreamer support absent

Package thunderbird updated to version 24.1.0-alt0.M70P.1 for branch p7 in task 107222.

Published: 2014-02-17

BDU:2014-00303

Уязвимость пакета программ Mozilla SeaMonkey, позволяющая злоумышленнику внедрить произвольный веб-сценарий или HTML-код

Severity: MEDIUM (4.3)

References:

CVE-2014-2018

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1718

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1719

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1720

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1722

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1723

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1724

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1725

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1726

Severity: MEDIUM (6.2)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1728

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1730

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1732

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1735

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1736

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1737

Severity: MEDIUM (5.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1738

Severity: CRITICAL (9.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5590

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5591

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5593

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5595

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5596

Severity: MEDIUM (6.8)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5597

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5599

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5600

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5601

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5602

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5603

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5604

Severity: CRITICAL (9.3)

References:

Published: 2014-02-18
Modified: 2024-11-21

CVE-2013-6674

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Severity: MEDIUM (4.3)

References:

Published: 2014-02-18
Modified: 2024-11-21

CVE-2014-2018

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.

Severity: MEDIUM (4.3)

References:

No data currently available.

Version: 2.1.0

ALT-BU-2013-1343-1

Closed vulnerabilities

Closed vulnerabilities

Closed bugs

Closed vulnerabilities

Closed bugs

Closed vulnerabilities