TITLE:
SeaMonkey VCard Double-Free and
"addSelectionListener" Vulnerabilities
SECUNIA ADVISORY ID:
SA20394
RELEASE DATE:
2006-06-02
VERIFY ADVISORY:
http://secunia.c
om/advisories/20394/
CRITICAL:
Highly critical
WHERE:
From remote
IMPACT:
System access
SOFTWARE:
Mozilla SeaMonkey 1.x
DESCRIPTION:
Two vulnerabilities have been reported in SeaMonkey, which
potentially
can be exploited by malicious people to compromise a user's
system.
1) A double-free error within the processing of large VCards
with
invalid base64 characters may be exploited to execute
arbitrary code.
2) An error in the processing of the addSelectionListener
when handling
notifications in certain situations can be exploited to
execute
arbitrary JavaScript code with escalated privileges.
SOLUTION:
Update to version 1.0.2.
http://www
.mozilla.org/projects/seamonkey/
REPORTED BY CREDITS:
1) Masatoshi Kimura
2) moz_bug_r_a4
ORIGINAL ADVISORY:
1) http://www.mozilla.org/security/announce/2006/mfsa
2006-40.html
2) http://www.mozilla.org/security/announce/2006/mfsa
2006-43.html
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/r
ules.htm
Contact list owner <owner-pcworks imagicomm.com>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
|