Rapid7 Vulnerability & Exploit Database

RHSA-2009:1431: seamonkey security update

Back to Search

RHSA-2009:1431: seamonkey security update

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
09/10/2009
Created
07/25/2018
Added
09/12/2009
Modified
07/04/2017

Description

SeaMonkey is an open source Web browser, email and newsgroup client, IRCchat client, and HTML editor.Several flaws were found in the processing of malformed web content. A webpage containing malicious content could cause SeaMonkey to crash or,potentially, execute arbitrary code with the privileges of the user runningSeaMonkey. (CVE-2009-3072, CVE-2009-3075)A use-after-free flaw was found in SeaMonkey. An attacker could use thisflaw to crash SeaMonkey or, potentially, execute arbitrary code with theprivileges of the user running SeaMonkey. (CVE-2009-3077)Descriptions in the dialogs when adding and removing PKCS #11 modules werenot informative. An attacker able to trick a user into installing amalicious PKCS #11 module could use this flaw to install their ownCertificate Authority certificates on a user's machine, making it possibleto trick the user into believing they are viewing a trusted site or,potentially, execute arbitrary code with the privileges of the user runningSeaMonkey. (CVE-2009-3076)A flaw was found in the way SeaMonkey displays the address bar whenwindow.open() is called in a certain way. An attacker could use this flawto conceal a malicious URL, possibly tricking a user into believing theyare viewing a trusted site. (CVE-2009-2654)All SeaMonkey users should upgrade to these updated packages, which correctthese issues. After installing the update, SeaMonkey must be restarted forthe changes to take effect.

Solution(s)

  • redhat-upgrade-seamonkey
  • redhat-upgrade-seamonkey-chat
  • redhat-upgrade-seamonkey-devel
  • redhat-upgrade-seamonkey-dom-inspector
  • redhat-upgrade-seamonkey-js-debugger
  • redhat-upgrade-seamonkey-mail

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;