TITLE:
SeaMonkey VCard Double-Free and "addSelectionListener" Vulnerabilities
SECUNIA ADVISORY ID:
SA20394
RELEASE DATE:
2006-06-02
VERIFY ADVISORY:
http://secunia.com/advisories/20394/
CRITICAL:
Highly critical
WHERE:
From remote
IMPACT:
System access
SOFTWARE:
Mozilla SeaMonkey 1.x
DESCRIPTION:
Two vulnerabilities have been reported in SeaMonkey, which potentially
can be exploited by malicious people to compromise a user's system.
1) A double-free error within the processing of large VCards with
invalid base64 characters may be exploited to execute arbitrary code.
2) An error in the processing of the addSelectionListener when handling
notifications in certain situations can be exploited to execute
arbitrary JavaScript code with escalated privileges.
SOLUTION:
Update to version 1.0.2.
http://www.mozilla.org/projects/seamonkey/
REPORTED BY CREDITS:
1) Masatoshi Kimura
2) moz_bug_r_a4
ORIGINAL ADVISORY:
1) http://www.mozilla.org/security/announce/2006/mfsa2006-40.html
2) http://www.mozilla.org/security/announce/2006/mfsa2006-43.html
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/rules.htm
Contact list owner <[EMAIL PROTECTED]>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
