The host is installed with Mozilla firefox/thunderbird/seamonkey and is prone to arbitrary code execution vulnerability.

Successful exploitation will let attackers to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Impact Level: System/Application

Upgrade to Mozilla Firefox version 3.6.20 or 6.0 or later, For updates refer to http://www.mozilla.com/en-US/firefox/all.html Upgrade to SeaMonkey version to 2.3 or later http://www.mozilla.org/projects/seamonkey/ Upgrade to Thunderbird version to 3.1.12 or later http://www.mozilla.org/en-US/thunderbird/

The flaw is due to error in 'SVGTextElement.getCharNumAtPosition' function, which fails to properly handle SVG text.

SeaMonkey version 2.0 through 2.2 Thunderbird version 3.0 through 3.1.11 Mozilla Firefox version before 3.6.20 and 4.x through 5.0.1

• http://www.mozilla.org/security/announce/2011/mfsa2011-30.html
• https://bugzilla.redhat.com/show_bug.cgi?id=730519

---

Updated on 2015-03-25