Bug 19749 - множественные уязвимости, MSFA 2009-16..22
Summary: множественные уязвимости, MSFA 2009-16..22
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: seamonkey (show other bugs)
Version: unstable
Hardware: all Linux
: P3 blocker
Assignee: Andrey Cherepanov
QA Contact: qa-sisyphus
URL: http://secunia.com/advisories/34835
Keywords:
Depends on:
Blocks:
 
Reported: 2009-04-24 01:44 MSD by Vladimir Lettiev
Modified: 2009-06-28 22:24 MSD (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Lettiev 2009-04-24 01:44:21 MSD 
Обнаружены множественные уязвимости в ветке 1.1.x
MFSA 2009-22  Firefox allows Refresh header to redirect to javascript: URIs
MFSA 2009-21 POST data sent to wrong site when saving web page with embedded frame
MFSA 2009-19 Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
MFSA 2009-18 XSS hazard using third-party stylesheets and XBL bindings
MFSA 2009-17 Same-origin violations when Adobe Flash loaded via view-source: scheme
MFSA 2009-16 jar: scheme ignores the content-disposition: header on the inner URI

Официального исправления пока ещё не выпущено.
Comment 1 Damir Shayhutdinov 2009-06-27 07:31:51 MSD 
В 1.1.17 были исправлены следующие уязвимости:

MFSA 2009-33  Crash viewing multipart/alternative message with text/enhanced part
MFSA 2009-32 JavaScript chrome privilege escalation
MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null
MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests
MFSA 2009-26 Arbitrary domain cookie access by local file: resources
MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)
MFSA 2009-21 POST data sent to wrong site when saving web page with embedded frame
MFSA 2009-17 Same-origin violations when Adobe Flash loaded via view-source: scheme

Видимо, для seamonkey не все актуально.
Comment 2 Vladimir Lettiev 2009-06-28 22:24:02 MSD 
Они актуальны для seamonkey, просто они не были исправлены.