Vendor Status Note JVNCIAC-S-162

Mozilla 製品群に複数の脆弱性

Mozilla Firefox をはじめとする Mozilla 製品群には、複数の脆弱性があります。

影響を受けるシステム
　- Firefox
　- SeaMonkey
　- Thunderbird

遠隔の第三者がサービス運用妨害 (DoS) 攻撃を行ったり、ユーザの権限で任意のコードを実行したりする可能性があります。

ベンダ	リンク	更新日
	Mozilla Japan Foundation セキュリティアドバイザリ: 2008 年 2 月 7 日
Mozilla Japan	Firefox 2.0.0.12 の新機能と改良点
Red Hat	Red Hat Security Advisory RHSA-2008:0103 Critical: firefox security update
	Red Hat Security Advisory RHSA-2008:0104 Critical: seamonkey security update
	Red Hat Security Advisory RHSA-2008:0105 Moderate: thunderbird security update

1. US-CERT Vulnerability Note VU#879056
   Mozilla browsers fail to properly handle images
2. US-CERT Vulnerability Note VU#309608
   Mozilla products may allow directory traversal
3. ISS X-Force Database: mozilla-chromeuri-directory-traversal(39840)
   Multiple Mozilla products chrome
4. ISS X-Force Database: firefox-webforgery-security-bypass(40353)
   Mozilla Firefox Web forgery warning dialog security bypass
5. ISS X-Force Database: mozilla-stylesheet-information-disclosure(40355)
   Multiple Mozilla products stylesheet 302 redirect information disclosure
6. ISS X-Force Database: mozilla-txtfile-dos(40356)
   Mozilla Firefox and SeaMonkey .txt file denial of service
7. ISS X-Force Database: mozilla-password-file-corruption(40359)
   Mozilla Firefox password store file corruption
8. ISS X-Force Database: mozilla-chrome-privilege-escalation(40360)
   Multiple Mozilla products javascript chrome privilege escalation
9. ISS X-Force Database: mozilla-xmldocumentload-security-bypass(40361)
   Multiple Mozilla products XMLDocument.load() security bypass
10. ISS X-Force Database: firefox-browser-code-execution(40362)
    Mozilla Firefox, Thunderbird, and SeaMonkey browser engine code execution
11. ISS X-Force Database: firefox-javascript-code-execution(40363)
    Mozilla Firefox, Thunderbird, and SeaMonkey JavaScript engine codeexecution
12. ISS X-Force Database: mozilla-timerdialog-security-bypass(40365)
    Mozilla Firefox and Thunderbird timer-enabled dialog security bypass
13. ISS X-Force Database: mozilla-focus-information-disclosure(40367)
    Mozilla Firefox and SeaMonkey file input focus information disclosure
14. ISS X-Force Database: mozilla-designmode-information-disclosure(40371)
    Mozilla Firefox, Thunderbird, and SeaMonkey designMode frames information disclosure
15. ISS X-Force Database: firefox-character-encoding-xss(40488)
    Mozilla Firefox character encoding cross-site scripting