----------------------------------------------------------------------


Use WSUS to deploy 3rd party patches

Public BETA
http://secunia.com/vulnerability_scanning/corporate/wsus_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Mozilla SeaMonkey Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39001

VERIFY ADVISORY:
http://secunia.com/advisories/39001/

DESCRIPTION:
Some vulnerabilities have been reported in Mozilla SeaMonkey, which
can be exploited by malicious people to disclose sensitive
information or potentially compromise a user's system.

1) An error exists when processing "<iframe>" elements embedded in
e-mail messages.  This can be exploited to disclose message contents
or local files by tricking a user into replying to or forwarding a
malicious message.

2) An error when joined to an Active Directory server on Vista or
Windows 7 can be exploited to cause a crash or potentially execute
arbitrary code if SSPI authentication is used.

3) An error when indexing certain messages with attachments can be
exploited to cause a crash or potentially execute arbitrary code.

4) An unspecified error in the JavaScript engine can be exploited to
cause a crash or potentially execute arbitrary code.

5) An error in the BinHex decoder when used on non-Mac platforms can
be exploited to cause a crash or potentially execute arbitrary code.

Vulnerabilities #4 and #5 are related to vulnerability #1 in:
SA36671

6) An integer overflow error in a base64 decoding function can be
exploited to cause a crash or potentially execute arbitrary code.

This is related to vulnerability #2 in:
SA35914

7) A use-after-free error in the implementation of the XUL tree
element can be exploited to potentially execute arbitrary code.

This is related to vulnerability #3 in:
SA36671

8) An error in the implementation of the NTLM authentication protocol
can be exploited to reflect the user's NTLM credentials to an
arbitrary application.

This is related to vulnerability #5 in:
SA37699

9) An array indexing error when processing floating point numbers can
be exploited to potentially execute arbitrary code.

This is related to vulnerability #1 in:
SA36711

The vulnerabilities are reported in versions prior to 1.1.19.

SOLUTION:
Update to version 1.1.19.

SeaMonkey 1.x has reached End Of Life. The vendor recommends an
upgrade to the latest 2.x version.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Georgi Guninski
2) Paul Fisher
3) Ludovic Hirlimann
4) Carsten Book
5) Josh Soref
6) monarch2000
7) an anonymous person, reported via ZDI
8) Takehiro Takahashi of IBM X-Force

ORIGINAL ADVISORY:
http://www.mozilla.org/security/announce/2009/mfsa2009-49.html
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html
http://www.mozilla.org/security/announce/2009/mfsa2009-68.html
http://www.mozilla.org/security/announce/2010/mfsa2010-06.html
http://www.mozilla.org/security/announce/2010/mfsa2010-07.html

http://www.seamonkey-project.org/releases/seamonkey1.1.19/README#new

OTHER REFERENCES:
SA35914:
http://secunia.com/advisories/35914/

SA36671:
http://secunia.com/advisories/36671/

SA36711:
http://secunia.com/advisories/36711/

SA37699:
http://secunia.com/advisories/37699/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------