[ GLSA 200608-02 ] Mozilla SeaMonkey: Multiple vulnerabilities

[Stefan Cornelius <dercorny () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200608-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Mozilla SeaMonkey: Multiple vulnerabilities
      Date: August 03, 2006
      Bugs: #141842
        ID: 200608-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The Mozilla Foundation has reported numerous security vulnerabilities
related to Mozilla SeaMonkey.

Background
==========

The Mozilla SeaMonkey project is a community effort to deliver
production-quality releases of code derived from the application
formerly known as "Mozilla Application Suite".

Affected packages
=================

    -------------------------------------------------------------------
     Package               /  Vulnerable  /                 Unaffected
    -------------------------------------------------------------------
  1  www-client/seamonkey       < 1.0.3                       >= 1.0.3

Description
===========

The following vulnerabilities have been reported:

* Benjamin Smedberg discovered that chrome URL's could be made to
  reference remote files.

* Developers in the Mozilla community looked for and fixed several
  crash bugs to improve the stability of Mozilla clients, which could
  lead to the execution of arbitrary code by a remote attacker.

* "shutdown" reports that cross-site scripting (XSS) attacks could be
  performed using the construct XPCNativeWrapper(window).Function(...),
  which created a function that appeared to belong to the window in
  question even after it had been navigated to the target site.

* "shutdown" reports that scripts granting the UniversalBrowserRead
  privilege can leverage that into the equivalent of the far more
  powerful UniversalXPConnect since they are allowed to "read" into a
  privileged context.

* "moz_bug_r_a4" reports that A malicious Proxy AutoConfig (PAC)
  server could serve a PAC script that can execute code with elevated
  privileges by setting the required FindProxyForURL function to the
  eval method on a privileged object that leaked into the PAC sandbox.

* "moz_bug_r_a4" discovered that Named JavaScript functions have a
  parent object created using the standard Object() constructor
  (ECMA-specified behavior) and that this constructor can be redefined
  by script (also ECMA-specified behavior).

* Igor Bukanov and shutdown found additional places where an untimely
  garbage collection could delete a temporary object that was in active
  use.

* Georgi Guninski found potential integer overflow issues with long
  strings in the toSource() methods of the Object, Array and String
  objects as well as string function arguments.

* H. D. Moore reported a testcase that was able to trigger a race
  condition where JavaScript garbage collection deleted a temporary
  variable still being used in the creation of a new Function object.

* A malicious page can hijack native DOM methods on a document object
  in another domain, which will run the attacker's script when called
  by the victim page.

* Secunia Research has discovered a vulnerability which is caused due
  to an memory corruption error within the handling of simultaneously
  happening XPCOM events. This leads to use of a deleted timer object.

* An anonymous researcher for TippingPoint and the Zero Day
  Initiative showed that when used in a web page Java would reference
  properties of the window.navigator object as it started up.

* Thilo Girmann discovered that in certain circumstances a JavaScript
  reference to a frame or window was not properly cleared when the
  referenced content went away.

Impact
======

A user can be enticed to open specially crafted URLs, visit webpages
containing malicious JavaScript or execute a specially crafted script.
These events could lead to the execution of arbitrary code, or the
installation of malware on the user's computer.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Thunderbird users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/seamonkey-1.0.3"

References
==========

  [ 1 ] CVE-2006-3113
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113
  [ 2 ] CVE-2006-3677
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677
  [ 3 ] CVE-2006-3801
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801
  [ 4 ] CVE-2006-3802
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802
  [ 5 ] CVE-2006-3803
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
  [ 6 ] CVE-2006-3804
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804
  [ 7 ] CVE-2006-3805
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805
  [ 8 ] CVE-2006-3806
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806
  [ 9 ] CVE-2006-3807
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807
  [ 10 ] CVE-2006-3808
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808
  [ 11 ] CVE-2006-3809
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809
  [ 12 ] CVE-2006-3810
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810
  [ 13 ] CVE-2006-3811
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811
  [ 14 ] CVE-2006-3812
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200608-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/