Branch sisyphus update bulletin.

Package alure updated to version 1.2-alt1 for branch sisyphus in task 107165.

Версия 1.2

Package nss updated to version 3.15.2-alt1 for branch sisyphus in task 106799.

Published: 2013-10-22

BDU:2015-02928

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить доступность защищаемой информации

Severity: MEDIUM (5.0)

References:

Published: 2013-10-23
Modified: 2024-11-21

CVE-2013-1739

Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure.

Severity: MEDIUM (5.0)

References:

Package xulrunner updated to version 24.0-alt1 for branch sisyphus in task 106799.

No data currently available.

GStreamer support absent

Package firefox updated to version 24.0-alt1 for branch sisyphus in task 106799.

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1718

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1719

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1720

The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1721

Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21, allows remote attackers to execute arbitrary code via a crafted web site.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1722

Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1723

The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service (application crash) by leveraging incorrect event usage after widget-memory reallocation.

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1724

Use-after-free vulnerability in the mozilla::dom::HTMLFormElement::IsDefaultSubmitElement function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a destroyed SELECT element.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1725

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not ensure that initialization occurs for JavaScript objects with compartments, which allows remote attackers to execute arbitrary code by leveraging incorrect scope handling.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1726

Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature verification but before MAR use.

Severity: MEDIUM (6.2)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1728

The IonMonkey JavaScript engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21, when Valgrind mode is used, does not properly initialize memory, which makes it easier for remote attackers to obtain sensitive information via unspecified vectors.

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1730

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch, or assertion failure and application exit) via a crafted web site.

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1732

Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via crafted use of lists and floats within a multi-column layout.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1735

Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1736

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to improperly establishing parent-child relationships of range-request nodes.

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1737

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.

Severity: MEDIUM (5.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1738

Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.

Severity: CRITICAL (9.3)

References:

No data currently available.

GStreamer support absent

Package thunderbird updated to version 24.0.1-alt1 for branch sisyphus in task 106799.

Published: 2014-02-17

BDU:2014-00303

Уязвимость пакета программ Mozilla SeaMonkey, позволяющая злоумышленнику внедрить произвольный веб-сценарий или HTML-код

Severity: MEDIUM (4.3)

References:

CVE-2014-2018

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1718

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1719

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1720

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1722

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1723

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1724

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1725

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1726

Severity: MEDIUM (6.2)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1728

Severity: MEDIUM (4.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1730

Severity: MEDIUM (6.8)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1732

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1735

Severity: CRITICAL (9.3)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1736

Severity: CRITICAL (10.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1737

Severity: MEDIUM (5.0)

References:

Published: 2013-09-18
Modified: 2024-11-21

CVE-2013-1738

Severity: CRITICAL (9.3)

References:

Published: 2014-02-18
Modified: 2024-11-21

CVE-2013-6674

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Severity: MEDIUM (4.3)

References:

Published: 2014-02-18
Modified: 2024-11-21

CVE-2014-2018

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.

Severity: MEDIUM (4.3)

References:

No data currently available.

Version: 2.1.0

ALT-BU-2013-1473-1

Closed bugs

Closed vulnerabilities

Closed vulnerabilities

Closed bugs

Closed vulnerabilities

Closed bugs

Closed vulnerabilities