Summary
The remote host is missing an update to iceape
announced via advisory DSA 2489-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202489-1
Insight
Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of Seamonkey.
CVE-2012-1937
Mozilla developers discovered several memory corruption bugs, which may lead to the execution of arbitrary code.
CVE-2012-1940
Abhishek Arya discovered a use-after-free problem when working with column layout with absolute positioning in a container that changes size, which may lead to the execution of arbitrary code.
CVE-2012-1947
Abhishek Arya discovered a heap buffer overflow in utf16 to latin1 character set conersion, allowing to execute arbitray code.
For the stable distribution (squeeze), this problem has been fixed in version 2.0.11-13.
For the testing distribution (wheezy) and unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your iceape packages.
Severity
Classification
-
CVE CVE-2012-1937, CVE-2012-1940, CVE-2012-1947 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities