mozilla -- multiple vulnerabilities

Description:

The Mozilla Foundation reports:

MFSA 2008-37
UTF-8 URL stack buffer overflow

MFSA 2008-38
nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-39
Privilege escalation using feed preview page and XSS flaw

MFSA 2008-40
Forced mouse drag

MFSA 2008-41
Privilege escalation via XPCnativeWrapper pollution

MFSA 2008-42
Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)

MFSA 2008-43
BOM characters stripped from JavaScript before execution

MFSA 2008-44
resource: traversal vulnerabilities

MFSA 2008-45
XBM image uninitialized memory reading

References:

• CVE name CVE-2008-0016
• CVE name CVE-2008-3835
• CVE name CVE-2008-3836
• CVE name CVE-2008-3837
• CVE name CVE-2008-4058
• CVE name CVE-2008-4059
• CVE name CVE-2008-4060
• CVE name CVE-2008-4061
• CVE name CVE-2008-4062
• CVE name CVE-2008-4063
• CVE name CVE-2008-4064
• CVE name CVE-2008-4065
• CVE name CVE-2008-4067
• CVE name CVE-2008-4068
• CVE name CVE-2008-4069
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-37.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-38.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-39.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-40.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-41.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-42.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-43.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-44.html>
• URL: <http://www.mozilla.org/security/announce/2008/mfsa2008-45.html>

Affects:

• firefox <2.0.0.17,1
• firefox >3.*,1 <3.0.2,1
• linux-firefox <2.0.0.17
• linux-firefox-devel <2.0.0.17
• seamonkey <1.1.12
• linux-seamonkey <1.1.12
• thunderbird <2.0.0.17
• linux-thunderbird <2.0.0.17
• flock <2.0
• linux-flock <2.0
• linux-seamonkey-devel >0

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Team. Refer to "FreeBSD Security Information" for more information.