Mozilla SeaMonkey Multiple Vulnerabilities

SA45667

CVE-2011-0084, CVE-2011-2985, CVE-2011-2986, CVE-2011-2987, CVE-2011-2988, CVE-2011-2989, CVE-2011-2990, CVE-2011-2991, CVE-2011-2992, CVE-2011-2993

17 Aug 2011

19 Aug 2011

Highly Critical

Vendor Patch

Mozilla SeaMonkey 2.x

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Security Bypass

This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.

The actual impact varies significantly depending on the design and purpose of the affected application.

Multiple vulnerabilities have been reported in Mozilla SeaMonkey, which can be exploited by malicious people to bypass certain security restrictions, disclose certain sensitive information, and compromise a vulnerable system.

For more information:
SA45581

The vulnerabilities are reported in versions prior to 2.3.

Update to version 2.3.

3, 4) James Forshaw, Context Information Security Ltd
5) regenrecht via ZDI

The vendor credits:
1) Aral Yaman, Vivekanand Bolajwar, and Bert Hubert and Theo Snelleman, Fox-IT
2) Rafael Gieschke
6) Mike Cardwell and Daniel Veditz
7) nasalislarvatus3000

Mozilla (MFSA 2011-33):
http://www.mozilla.org/security/announce/2011/mfsa2011-33.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-270/

Context Information Security Ltd:
http://archives.neohapsis.com/archives/fulldisclosure/2011-08/0200.html