Summary
The host is installed with Mozilla Firefox/Seamonkey/Thunderbird and is prone to multiple vulnerabilities.
Impact
Successful exploitation will let attackers to to cause a denial of service or execute arbitrary code.
Impact Level: Application
Solution
Upgrade to Firefox version 3.5.9, 3.6.2
http://www.mozilla.com/en-US/firefox/all.html
Upgrade to Seamonkey version 2.0.4
http://www.seamonkey-project.org/releases/
Upgrade to Thunderbird version 3.0.4
http://www.mozillamessaging.com/en-US/thunderbird/
Insight
The flaws are due to:
- A memory corruption error when user loads specially crafted HTML or specially crafted HTML-based e-mail, which allows to execute arbitrary code via unknown vectors.
- An error in 'XMLDocument::load()' method. It is not checking 'nsIContentPolicy' during loading of content by XML documents, which allows to bypass intended access restrictions via crafted content.
Affected
Seamonkey version prior to 2.0.4,
Thunderbird version proior to 3.0.4 and
Firefox version before 3.5.9 and 3.6.x before 3.6.2
References
Severity
Classification
-
CVE CVE-2010-0173, CVE-2010-0182 -
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities