Mozilla SeaMonkey Multiple Vulnerabilities

SA47334

CVE-2011-3658, CVE-2011-3660, CVE-2011-3661, CVE-2011-3663, CVE-2011-3664, CVE-2011-3665

21 Dec 2011

Highly Critical

Vendor Patch

Mozilla SeaMonkey 2.x

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Unknown

Covers various weaknesses, security issues, and vulnerabilities not covered by the other impact types, or where the impact isn't known due to insufficient information from vendors and researchers.

Multiple vulnerabilities have been reported in Mozilla SeaMonkey, where one has an unknown impact and others can be exploited by malicious people to disclose sensitive information and compromise a user's system.

For more information:
SA47302

Update to version 2.6.

The vendor credits:
1) Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler, David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia Knous, and Rober Longson
2) Aki Helin
3) regenrecht via ZDI
4) Mario Heiderich
5) Richard Bateman
6) sczimmer

Mozilla:
http://www.mozilla.org/security/announce/2011/mfsa2011-53.html
http://www.mozilla.org/security/announce/2011/mfsa2011-54.html
http://www.mozilla.org/security/announce/2011/mfsa2011-55.html
http://www.mozilla.org/security/announce/2011/mfsa2011-56.html
http://www.mozilla.org/security/announce/2011/mfsa2011-57.html
http://www.mozilla.org/security/announce/2011/mfsa2011-58.html