Rapid7 Vulnerability & Exploit Database

RHSA-2009:1431: seamonkey security update

Back to Search

RHSA-2009:1431: seamonkey security update



SeaMonkey is an open source Web browser, email and newsgroup client, IRCchat client, and HTML editor.Several flaws were found in the processing of malformed web content. A webpage containing malicious content could cause SeaMonkey to crash or,potentially, execute arbitrary code with the privileges of the user runningSeaMonkey. (CVE-2009-3072, CVE-2009-3075)A use-after-free flaw was found in SeaMonkey. An attacker could use thisflaw to crash SeaMonkey or, potentially, execute arbitrary code with theprivileges of the user running SeaMonkey. (CVE-2009-3077)Descriptions in the dialogs when adding and removing PKCS #11 modules werenot informative. An attacker able to trick a user into installing amalicious PKCS #11 module could use this flaw to install their ownCertificate Authority certificates on a user's machine, making it possibleto trick the user into believing they are viewing a trusted site or,potentially, execute arbitrary code with the privileges of the user runningSeaMonkey. (CVE-2009-3076)A flaw was found in the way SeaMonkey displays the address bar whenwindow.open() is called in a certain way. An attacker could use this flawto conceal a malicious URL, possibly tricking a user into believing theyare viewing a trusted site. (CVE-2009-2654)All SeaMonkey users should upgrade to these updated packages, which correctthese issues. After installing the update, SeaMonkey must be restarted forthe changes to take effect.


  • redhat-upgrade-seamonkey
  • redhat-upgrade-seamonkey-chat
  • redhat-upgrade-seamonkey-devel
  • redhat-upgrade-seamonkey-dom-inspector
  • redhat-upgrade-seamonkey-js-debugger
  • redhat-upgrade-seamonkey-mail

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center