Please Install the Updated Packages.

SeaMonkey is an open source web browser, e-mail and newsgroup client, IRC chat client, and HTML editor. A flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2012-0442) The same-origin policy in SeaMonkey treated <a rel= &qt nofollow &qt href= &qt http://example.com &qt >http://example.com</a> and <a rel= &qt nofollow &qt href= &qt http://[example.com &qt >http://[example.com</a>] as interchangeable. A malicious script could possibly use this flaw to gain access to sensitive information (such as a client's IP and user e-mail address, or httpOnly cookies) that may be included in HTTP proxy error replies, generated in response to invalid URLs using square brackets. (CVE-2011-3670) All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

seamonkey on CentOS 4

• http://lists.centos.org/pipermail/centos-announce/2012-February/018409.html

---

Updated on 2015-03-25