The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of SeaMonkey

vulnerability note 24664

Mail client: sender spoofing via Mailsploit

Synthesis of the vulnerability

An attacker can send an email with a special From header, which is truncated by some mail clients, in order to deceive the victim.
Impacted products: iOS by Apple, iPhone, Mac OS X, Notes, Office, Outlook, SeaMonkey, Thunderbird, Synology DSM.
Severity: 3/4.
Consequences: disguisement.
Provenance: document.
Creation date: 06/12/2017.
Identifiers: CERTFR-2017-ALE-019, Mailsploit, MFSA-2017-30, Synology-SA-17:82, VIGILANCE-VUL-24664.

Description of the vulnerability

Messaging clients interpret the From header to display the sender name.

However, using a Base64 or Quoted Printable encoding, and '\0' or '\n' characters, an attacker can force the displayed email address to be truncated.

An attacker can therefore send an email with a special From header, which is truncated by some mail clients, in order to deceive the victim.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2017-7805

Mozilla NSS: use after free via Verifying Client Authentication

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via Verifying Client Authentication of Mozilla NSS, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Fedora, Firefox, NSS, SeaMonkey, openSUSE Leap, Oracle Communications, Oracle Fusion Middleware, Oracle GlassFish Server, Oracle Identity Management, Solaris, Tuxedo, Oracle Virtual Directory, WebLogic, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 29/09/2017.
Identifiers: bulletinoct2017, cpuapr2018, cpuoct2018, CVE-2017-7805, DLA-1118-1, DLA-1138-1, DSA-3987-1, DSA-3998-1, FEDORA-2017-2e7badfe67, FEDORA-2017-6e2071419d, MFSA-2017-21, MFSA-2017-22, openSUSE-SU-2017:2615-1, openSUSE-SU-2017:2707-1, openSUSE-SU-2017:2710-1, RHSA-2017:2831-01, RHSA-2017:2832-01, SSA:2017-271-01, SUSE-SU-2017:2688-1, SUSE-SU-2017:2872-1, SUSE-SU-2017:2872-2, USN-3431-1, USN-3435-1, USN-3435-2, USN-3436-1, VIGILANCE-VUL-23976.

Description of the vulnerability

An attacker can force the usage of a freed memory area via Verifying Client Authentication of Mozilla NSS, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2017-7793 CVE-2017-7810 CVE-2017-7811

Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 17.
Creation date: 29/09/2017.
Identifiers: bulletinoct2017, CERTFR-2017-AVI-327, CERTFR-2017-AVI-340, CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7816, CVE-2017-7817, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7821, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824, CVE-2017-7825, DLA-1118-1, DLA-1153-1, DSA-3987-1, DSA-4014-1, FEDORA-2017-2e7badfe67, FEDORA-2017-6967efb3f0, FEDORA-2017-6e2071419d, FEDORA-2017-730e299c49, FEDORA-2017-845c543ea4, MFSA-2017-21, MFSA-2017-22, MFSA-2017-23, openSUSE-SU-2017:2615-1, openSUSE-SU-2017:2707-1, openSUSE-SU-2017:2710-1, RHSA-2017:2831-01, RHSA-2017:2885-01, SSA:2017-271-01, SUSE-SU-2017:2688-1, SUSE-SU-2017:2872-1, SUSE-SU-2017:2872-2, USN-3435-1, USN-3435-2, USN-3436-1, USN-3688-1, VIGILANCE-VUL-23970.

Description of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2017-7753 CVE-2017-7779 CVE-2017-7780

Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 29.
Creation date: 09/08/2017.
Identifiers: bulletinjul2017, CERTFR-2017-AVI-256, CERTFR-2017-AVI-271, CVE-2017-7753, CVE-2017-7779, CVE-2017-7780, CVE-2017-7781, CVE-2017-7782, CVE-2017-7783, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7788, CVE-2017-7789, CVE-2017-7790, CVE-2017-7791, CVE-2017-7792, CVE-2017-7794, CVE-2017-7796, CVE-2017-7797, CVE-2017-7798, CVE-2017-7799, CVE-2017-7800, CVE-2017-7801, CVE-2017-7802, CVE-2017-7803, CVE-2017-7804, CVE-2017-7806, CVE-2017-7807, CVE-2017-7808, CVE-2017-7809, DLA-1053-1, DLA-1087-1, DLA-1087-2, DSA-3928-1, DSA-3928-2, DSA-3968-1, FEDORA-2017-0dfa70ae35, FEDORA-2017-3df020e756, FEDORA-2017-bdd0b565ef, MFSA-2017-18, MFSA-2017-19, MFSA-2017-20, openSUSE-SU-2017:2151-1, openSUSE-SU-2017:2209-1, RHSA-2017:2456-01, RHSA-2017:2534-01, SSA:2017-221-02, SUSE-SU-2017:2302-1, SUSE-SU-2017:2589-1, USN-3391-1, USN-3391-2, USN-3391-3, USN-3416-1, VIGILANCE-VUL-23484.

Description of the vulnerability

An attacker can use several vulnerabilities of Firefox and Thunderbird.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2017-5470 CVE-2017-5471 CVE-2017-5472

Mozilla Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox and Thunderbird.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: privileged access/rights, client access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 31.
Creation date: 14/06/2017.
Identifiers: bulletinjul2017, CERTFR-2017-AVI-174, CERTFR-2017-AVI-182, CVE-2017-5470, CVE-2017-5471, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7755, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7759, CVE-2017-7760, CVE-2017-7761, CVE-2017-7762, CVE-2017-7763, CVE-2017-7764, CVE-2017-7765, CVE-2017-7766, CVE-2017-7767, CVE-2017-7768, CVE-2017-7770, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775-REJECT, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778, DLA-1007-1, DLA-1013-1, DLA-1086-1, DLA-991-1, DSA-3881-1, DSA-3894-1, DSA-3918-1, DSA-3921-1, FEDORA-2017-1dfdb04d62, FEDORA-2017-1f016389a7, FEDORA-2017-391ac5097a, FEDORA-2017-74999f2a23, FEDORA-2017-87aa9db27f, MFSA-2017-15, MFSA-2017-16, MFSA-2017-17, openSUSE-SU-2017:1579-1, openSUSE-SU-2017:1620-1, RHSA-2017:1440-01, RHSA-2017:1561-01, RHSA-2017:1793-01, RHSA-2018:2112-01, RHSA-2018:2113-01, SSA:2017-165-02, SUSE-SU-2017:1669-1, SUSE-SU-2017:2235-1, USN-3315-1, USN-3321-1, USN-3398-1, VIGILANCE-VUL-22969.

Description of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox and Thunderbird.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2017-5429 CVE-2017-5430 CVE-2017-5432

Firefox: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Firefox.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, openSUSE Leap, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 36.
Creation date: 20/04/2017.
Revisions dates: 04/05/2017, 29/05/2017.
Identifiers: 1160, CERTFR-2017-AVI-126, CERTFR-2017-AVI-134, CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5437-REJECT, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5450, CVE-2017-5451, CVE-2017-5452, CVE-2017-5453, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5458, CVE-2017-5459, CVE-2017-5460, CVE-2017-5463, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5468, CVE-2017-5469, DLA-906-1, DSA-3831-1, FEDORA-2017-31c64a0bbf, FEDORA-2017-82265ed89e, FEDORA-2017-87e23bcc34, MFSA-2017-10, MFSA-2017-11, MFSA-2017-12, MFSA-2017-13, openSUSE-SU-2017:1099-1, openSUSE-SU-2017:1196-1, openSUSE-SU-2017:1268-1, RHSA-2017:1104-01, RHSA-2017:1106-01, RHSA-2017:1201-01, SSA:2017-112-01, SSA:2017-114-01, SUSE-SU-2017:1175-1, SUSE-SU-2017:1248-1, SUSE-SU-2017:1669-1, SUSE-SU-2017:2235-1, USN-3260-1, USN-3260-2, USN-3278-1, VIGILANCE-VUL-22504, ZDI-17-320.

Description of the vulnerability

An attacker can use several vulnerabilities of Firefox.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2017-5090

Chrome, Firefox: site spoofing via homographs

Synthesis of the vulnerability

An attacker can use a url with Unicode characters looking like ASCII characters, in order to deceive the victim.
Impacted products: Chrome, Firefox, SeaMonkey, Opera.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 18/04/2017.
Identifiers: 1332714, CVE-2017-5090, VIGILANCE-VUL-22467.

Description of the vulnerability

Several Unicode characters (such as U+0430) look like the ASCII 'a' character. Some attackers use domain names containing these variants, in order to invite the victim to click on a link.

This type of attack, based on homographs, was already described in several bulletins (VIGILANCE-VUL-4729 and VIGILANCE-VUL-8497). Fixes are applied in most software.

However, when the name is only composed of Unicode characters, the Chrome and Firefox protections are bypassed. For example, https://xn--e1awd7f.com/ is displayed as https://www.epic.com/. Moreover, as a valid certificate for this domain can be obtained via Let's Encrypt, an attacker can easily spoof a TLS site.

An attacker can therefore use a url with Unicode characters looking like ASCII characters, in order to deceive the victim.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2017-5398 CVE-2017-5399 CVE-2017-5400

Mozilla Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

Several vulnerabilities were announced in Mozilla Firefox and Thunderbird.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, NetBSD, openSUSE Leap, Solaris, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, data reading, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 27.
Creation date: 08/03/2017.
Revision date: 21/03/2017.
Identifiers: 1130, bulletinapr2017, bulletinjul2017, CERTFR-2017-AVI-068, CERTFR-2017-AVI-069, CVE-2017-5398, CVE-2017-5399, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405, CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5409, CVE-2017-5410, CVE-2017-5411, CVE-2017-5412, CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417, CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422, CVE-2017-5425, CVE-2017-5426, CVE-2017-5427, DLA-852-1, DLA-896-1, DSA-3805-1, DSA-3832-1, FEDORA-2017-bb459964ce, FEDORA-2017-e63f2f0d11, FEDORA-2017-f3484d64d2, FEDORA-2017-fce0c6fd46, MFSA-2017-05, MFSA-2017-06, MFSA-2017-07, MFSA-2017-09, openSUSE-SU-2017:0687-1, openSUSE-SU-2017:0688-1, openSUSE-SU-2017:0690-1, openSUSE-SU-2017:1196-1, openSUSE-SU-2017:1268-1, RHSA-2017:0459-01, RHSA-2017:0461-01, RHSA-2017:0498-01, SSA:2017-066-01, SSA:2017-066-02, SUSE-SU-2017:0714-1, SUSE-SU-2017:0732-1, USN-3216-1, USN-3216-2, USN-3233-1, VIGILANCE-VUL-22039.

Description of the vulnerability

Several vulnerabilities were announced in Mozilla Firefox and Thunderbird.

An attacker can bypass security features via asm.js, in order to obtain sensitive information. [severity:3/4; CVE-2017-5400]

An attacker can generate a memory corruption via ErrorResult, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2017-5401]

An attacker can force the usage of a freed memory area via FontFace, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2017-5402]

An attacker can force the usage of a freed memory area via addRange, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2017-5403]

An attacker can force the usage of a freed memory area via Selection Ranges, in order to trigger a denial of service, and possibly to run code. [severity:4/4; 1130, CVE-2017-5404]

An attacker can generate a memory corruption via Skia, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2017-5406]

An attacker can bypass security features via SVG Filters, in order to obtain sensitive information. [severity:3/4; CVE-2017-5407]

An attacker can generate a memory corruption via JavaScript Garbage Collection Incremental Sweeping, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2017-5410]

An attacker can force the usage of a freed memory area via libGLES, in order to trigger a denial of service, and possibly to run code. [severity:3/4; CVE-2017-5409, CVE-2017-5411]

An attacker can bypass the origin check via Video Captions, in order to access to victim's data. [severity:2/4; CVE-2017-5408]

An attacker can force a read at an invalid address via SVG Filters, in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2017-5412]

An attacker can force a read at an invalid address via Bidirectional Layout, in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2017-5413]

An attacker can bypass security features via Bidirectional Layout, in order to obtain sensitive information. [severity:2/4; CVE-2017-5414]

An attacker can alter displayed information via Blob URL, in order to deceive the victim. [severity:2/4; CVE-2017-5415, CVE-2017-5416]

An attacker can force a NULL pointer to be dereferenced via HttpChannel, in order to trigger a denial of service. [severity:2/4; CVE-2017-5416]

An attacker can alter displayed information via URL drag-and-drop, in order to deceive the victim. [severity:2/4; CVE-2017-5417]

An attacker can bypass file access restrictions via Gecko Media Plugin, in order to obtain sensitive information. [severity:2/4; CVE-2017-5425]

An attacker can bypass security features via Gecko Media Plugin seccomp-bpf, in order to escalate his privileges. [severity:2/4; CVE-2017-5426]

An attacker can bypass security features via chrome.manifest, in order to escalate his privileges. [severity:2/4; CVE-2017-5427]

An attacker can force a read at an invalid address via HTTP Digest Authorization, in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2017-5418]

An attacker can trigger a fatal error via Authentication Prompts, in order to trigger a denial of service. [severity:2/4; CVE-2017-5419]

An attacker can alter displayed information via Javascript URLs, in order to deceive the victim. [severity:1/4; CVE-2017-5420]

An attacker can trigger a fatal error via FTP Response Codes, in order to trigger a denial of service. [severity:1/4; CVE-2017-5405]

An attacker can alter displayed information via Print preview, in order to deceive the victim. [severity:2/4; CVE-2017-5421]

An attacker can trigger a fatal error via view-source, in order to trigger a denial of service. [severity:1/4; CVE-2017-5422]

An attacker can generate a memory corruption, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2017-5399]

An attacker can generate a memory corruption, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2017-5398]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2017-5397

Mozilla Firefox pour Android: privilege escalation via cache corruption

Synthesis of the vulnerability

An attacker can change machine code files downloaded by Mozilla Firefox for Android, in order to get privileges of the Firefox application account.
Impacted products: Android Applications ~ not comprehensive, Firefox, SeaMonkey.
Severity: 3/4.
Consequences: privileged access/rights.
Provenance: document.
Creation date: 10/02/2017.
Identifiers: CERTFR-2017-AVI-046, CVE-2017-5397, MFSA-2017-04, VIGILANCE-VUL-21798.

Description of the vulnerability

The Mozilla Firefox pour Android product is a Web browser.

With the default configuration, Firefox use the system cache to temporary store libraries. However, the system cache is writable by all device process.

An attacker can therefore change machine code files downloaded by Mozilla Firefox for Android, in order to get privileges of the Firefox application account.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2017-5373 CVE-2017-5374 CVE-2017-5375

Mozilla Firefox, Thunderbird: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox.
Impacted products: Debian, Fedora, Firefox, SeaMonkey, Thunderbird, NetBSD, openSUSE Leap, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 4/4.
Consequences: user access/rights, client access/rights, data creation/edition, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 24.
Creation date: 24/01/2017.
Revision date: 25/01/2017.
Identifiers: CERTFR-2017-AVI-029, CERTFR-2017-AVI-033, CVE-2017-5373, CVE-2017-5374, CVE-2017-5375, CVE-2017-5376, CVE-2017-5377, CVE-2017-5378, CVE-2017-5379, CVE-2017-5380, CVE-2017-5381, CVE-2017-5382, CVE-2017-5383, CVE-2017-5384, CVE-2017-5385, CVE-2017-5386, CVE-2017-5387, CVE-2017-5388, CVE-2017-5389, CVE-2017-5390, CVE-2017-5391, CVE-2017-5392, CVE-2017-5393, CVE-2017-5394, CVE-2017-5395, CVE-2017-5396, DLA-800-1, DLA-896-1, DSA-3771-1, DSA-3832-1, FEDORA-2017-48e59edf94, FEDORA-2017-5df7a4018c, FEDORA-2017-c419dfe8c7, FEDORA-2017-cd5d8cac23, FEDORA-2017-e4e6928969, MFSA-2017-01, MFSA-2017-02, MFSA-2017-03, openSUSE-SU-2017:0354-1, openSUSE-SU-2017:0357-1, openSUSE-SU-2017:0358-1, RHSA-2017:0190-01, RHSA-2017:0238-01, SSA:2017-023-01, SSA:2017-026-01, SSA:2017-202-01, SUSE-SU-2017:0426-1, SUSE-SU-2017:0427-1, USN-3165-1, USN-3175-1, USN-3175-2, VIGILANCE-VUL-21666.

Description of the vulnerability

An attacker can use several vulnerabilities of Mozilla Firefox.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about SeaMonkey: