Impact
remote denial of service
Solution
Please Install the Updated Packages.
Insight
A number of security issues have been fixed in the Mozilla browser suite, which could be used by remote attackers to gain privileges, access to confidential information or cause denial of service attacks.
Since the Mozilla Suite 1.7 branch is no longer maintained this update most of our older products to use the Mozilla Seamonkey Suite version 1.0.7.
Security issues we fixed (compared from last seamonkey update round only) are listed below. More Details regarding the problems can be found on this page:
http://www.mozilla.org/projects/security/known-vulnerabilities.html
The updated packages includes fixes for the following security problems:
MFSA 2006-68: Crashes with evidence of memory corruption were fixed in the layout engine.
MFSA 2006-68: Crashes with evidence of memory corruption were fixed in the javascript engine.
MFSA 2006-68: Crashes regarding floating point usage were fixed. Linux is not affected.
MFSA 2006-70: A privilege escalation using a watch point was fixed.
MFSA 2006-71: A LiveConnect crash finalizing JS objects was fixed.
MFSA 2006-72: A XSS problem caused by setting img.src to javascript: URI was fixed.
MFSA 2006-73: A Mozilla SVG Processing Remote Code Execution was fixed.
MFSA 2006-74: Some Mail header processing heap overflows were fixed.
MFSA 2006-75: The RSS Feed-preview referrer leak
was fixed.
MFSA 2006-76: A XSS problem using outer window's Function object was fixed.
Problems with these packages we could not fix yet:
- On SUSE Linux Desktop 1.0 the upgrade was not possible yet due to library inter-dependencies problems between Mozilla and GTK+.
We recommend deinstalling mozilla on this product.
- The SUSE Linux Enterprise Server 8 update has shown regressions in flash and java plugin handling which we are investigating.
- On SUSE Linux 10.0 epiphany stops working for still unknown reasons.
We are investigating this and recommend using mozilla or MozillaFirefox directly instead.
Affected
mozilla on Novell Linux Desktop 9, Novell Linux POS 9, Open Enterprise Server, SUSE LINUX 10.1, SUSE SLES 9
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6500, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504, CVE-2006-6505, CVE-2006-6506, CVE-2006-6507 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities