Mozilla Firefox and SeaMonkey Multiple Vulnerabilities
Multiple vulnerabilities have been identified in Mozilla Firefox and SeaMonkey, which could be exploited by attackers to bypass security restrictions, disclose sensitive information, cause a denial of service or take complete control of an affected system.
2. An error related to focus shifting in file input controls, which could be exploited to force a user to upload arbitrary files.
4. An input validation error when saving passwords in the password store, which could be exploited by malicious web sites to inject newlines into Firefox's password store and corrupt saved passwords for other sites.
6. An error in the way images are handled by the browser when a user leaves a page which utilizes designMode frames, which could be exploited by attackers to steal a user's navigation history, forward navigation information, crash a vulnerable browser or execute arbitrary code.
7. An error when displaying timer-enabled security dialogs, which could be exploited by attackers to trick a user into confirming a security dialog by bringing the dialog back into focus right before a user clicked in a predictable time and place.
8. An error when saving files with "Content-Disposition: attachment" and improper "Content-Type: plain/text", which could cause the browser to no longer open local files with "txt" extensions for viewing, but would rather prompt the user to save the file.
9. An error when handling the "href" property of stylesheet DOM nodes, which could potentially be exploited to reveal sensitive URL parameters.
10. An error when displaying page contents enclosed in a "div" tag with absolute positioning, which could be exploited to cause the browser to not display a web forgery warning dialog.
- Denial of Service
- Remote Code Execution
- Security Restriction Bypass
- Information Disclosure
System / Technologies affected
- Mozilla Firefox 2.0.x
- Mozilla SeaMonkey 1.1.x
Before installation of the software, please visit the software manufacturer web-site for more details.
Update to version 18.104.22.168.
Update to an upcoming version 1.1.8.