Security bugs are reported here via bugzilla

[Arwed von Merkatz <v.merkatz AT gmx.net>]

Synopsis
========
A number of vulnerabilities were found in firefox, thunderbird and
seamonkey that were fixed with the 1.5.0.4 (firefox, thunderbird) and
1.0.2 (seamonkey) releases.  

Background
==========
Firefox is the official web browser release of the Mozilla project.
Thunderbird is the mail client of the Mozilla project.
The SeaMonkey project is an effort to deliver production-quality
releases of code derived from the application formerly known as "Mozilla
Application Suite" and is the codename for the Mozilla browser.

Description
===========
MFSA 2006-43 (firefox, seamonkey)
Web content could access the nsISelectionPrivate interface of the
Selection object and use it to add a SelectionListener. The listener
would be called when the user did a "Find" on the page or a "select
all", and as intended this shouldn't cause any problems. But as with
escaping the PAC sandbox in MFSA 2006-31 and content-defined DOM setters
in MFSA 2006-37 moz_bug_r_a4 figured a way to leverage the fact that the
notifications were created in a privileged context into arbitrary code
execution.

MFSA 2006-38 (firefox, thunderbird, seamonkey)
Mikolaj Habryn discovered an array index bug in crypto.signText() that
results in overflowing an allocated array of pointers by two when
optional Certificate Authority name arguments are passed in.

MFSA 2006-37 (firefox, thunderbird, seamonkey)
Paul Nickerson discovered that content-defined setters on an object
prototype were getting called by privileged UI code, and moz_bug_r_a4
was able to develop an exploit PoC that demonstrated that the higher
privilege level could be passed along to the content-defined attack
code.

MFSA 2006-35 (firefox, thunderbird, seamonkey)
In certain circumstances persisted XUL attributes are associated with
the wrong URL. If an attacker can get a persisted string associated with
an URL that will later eval or execute that attribute in a privileged
context then the attacker's code will run with the full permissions of
the browser.

MFSA 2006-32 (firefox, thunderbird, seamonkey)
Mozilla team members discovered several crashes during testing of the
browser engine showing evidence of memory corruption that we presume is
exploitable.

Note: Thunderbird shares the browser engine with Firefox and could be
vulnerable if JavaScript were to be enabled in mail. This is not the
default setting and we strongly discourage users from running JavaScript
in mail. (applies to MFSA 2006-38, 2006-37, 2006-35

MFSA 2006-40 (thunderbird, seamonkey)
Masatoshi Kimura reported a hang caused by a double-free in Thunderbird
when processing a large VCard with invalid base64 characters in it.
Since an attacker can supply an arbitrary amount of well-formed VCard
data before introducing the error we presume this could be exploited to
run code of the attacker's choosing.

Affected packages
=================
firefox, seamonkey and thunderbird in test and stable-rc 0.4 are
affected. They've been updated to the fixed versions.

Resolution
==========
All firefox, thunderbird and seamonkey users should upgrade to the
latest version:
# scribe update
# cast -c [firefox|thunderbird|seamonkey]
or
# scribe update
# sorcery queue-security
# cast --queue

References
==========
[1] mozilla.org vulnerability list
http://www.mozilla.org/projects/security/known-vulnerabilities.html
[2] Sourcemage Bug #12583
http://bugs.sourcemage.org/show_bug.cgi?id=12583

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org

Attachment: pgpZ7GpD11XvL.pgp
Description: PGP signature