Security Advisories for firefox 3.0

Impact key:

Critical: Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

High: Vulnerability can be used to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions.
Moderate: Vulnerabilities that would otherwise be High or Critical except they only work in uncommon non-default configurations or require the user to perform complicated and/or unlikely steps.
Low: Minor security vulnerabilities such as Denial of Service attacks, minor data leaks, or spoofs.
 (Undetectable spoofs of SSL indicia would have "High" impact because those are generally used to steal sensitive data intended for other sites.)

Fixed in Firefox 3.0.15

MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)

MFSA 2009-63 Upgrade media libraries to fix memory safety bugs

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-61 Cross-origin data theft through document.getSelection()

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()

MFSA 2009-56 Heap buffer overflow in GIF color map parser

MFSA 2009-55 Crash in proxy auto-configuration regexp parsing

MFSA 2009-53 Local downloaded file tampering

MFSA 2009-52 Form history vulnerable to stealing



Fixed in Firefox 3.0.14

MFSA 2009-51 Chrome privilege escalation with FeedWriter

MFSA 2009-50 Location bar spoofing via tall line-height Unicode characters

MFSA 2009-49 TreeColumns dangling pointer vulnerability

MFSA 2009-48 Insufficient warning for PKCS11 module installation and removal

MFSA 2009-47 Crashes with evidence of memory corruption (rv:1.9.1.3/1.9.0.14)



Fixed in Firefox 3.0.13

MFSA 2009-44 Location bar and SSL indicator spoofing via window.open() on invalid URL

MFSA 2009-43 Heap overflow in certificate regexp parsing

MFSA 2009-42 Compromise of SSL-protected communication



Fixed in Firefox 3.0.12

MFSA 2009-40 Multiple cross origin wrapper bypasses

MFSA 2009-39 setTimeout loses XPCNativeWrappers

MFSA 2009-38 Data corruption with SOCKS5 reply containing DNS name longer than 15 characters

MFSA 2009-37 Crash and remote code execution using watch and __defineSetter__ on SVG element

MFSA 2009-36 Heap/integer overflows in font glyph rendering libraries

MFSA 2009-35 Crash and remote code execution during Flash player unloading

MFSA 2009-34 Crashes with evidence of memory corruption (rv:1.9.1/1.9.0.12)



Fixed in Firefox 3.0.11

MFSA 2009-32 JavaScript chrome privilege escalation

MFSA 2009-31 XUL scripts bypass content-policy checks

MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar

MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null

MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object

MFSA 2009-26 Arbitrary domain cookie access by local file: resources

MFSA 2009-25 URL spoofing with invalid unicode characters

MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)



Fixed in Firefox 3.0.10

MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests

MFSA 2009-23 Crash in nsTextFrame::ClearTextRun()



Fixed in Firefox 3.0.9

MFSA 2009-22 Firefox allows Refresh header to redirect to javascript: URIs

MFSA 2009-21 POST data sent to wrong site when saving web page with embedded frame

MFSA 2009-20 Malicious search plugins can inject code into arbitrary sites

MFSA 2009-19 Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString

MFSA 2009-18 XSS hazard using third-party stylesheets and XBL bindings

MFSA 2009-17 Same-origin violations when Adobe Flash loaded via view-source: scheme

MFSA 2009-16 jar: scheme ignores the content-disposition: header on the inner URI

MFSA 2009-15 URL spoofing with box drawing character

MFSA 2009-14 Crashes with evidence of memory corruption (rv:1.9.0.9)



Fixed in Firefox 3.0.8

MFSA 2009-13 Arbitrary code execution through XUL element

MFSA 2009-12 XSL Transformation vulnerability



Fixed in Firefox 3.0.7

MFSA 2009-11 URL spoofing with invisible control characters

MFSA 2009-10 Upgrade PNG library to fix memory safety hazards

MFSA 2009-09 XML data theft via RDFXMLDataSource and cross-domain redirect

MFSA 2009-08 Mozilla Firefox XUL Linked Clones Double Free Vulnerability

MFSA 2009-07 Crashes with evidence of memory corruption (rv:1.9.0.7)



Fixed in Firefox 3.0.6

MFSA 2009-06 Directives to not cache pages ignored

MFSA 2009-05 XMLHttpRequest allows reading HTTPOnly cookies

MFSA 2009-04 Chrome privilege escalation via local .desktop files

MFSA 2009-03 Local file stealing with SessionStore

MFSA 2009-02 XSS using a chrome XBL method and window.eval

MFSA 2009-01 Crashes with evidence of memory corruption (rv:1.9.0.6)



Fixed in Firefox 3.0.5

MFSA 2008-69 XSS vulnerabilities in SessionStore

MFSA 2008-68 XSS and JavaScript privilege escalation

MFSA 2008-67 Escaped null characters ignored by CSS parser

MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters

MFSA 2008-65 Cross-domain data theft via script redirect error message

MFSA 2008-64 XMLHttpRequest 302 response disclosure

MFSA 2008-63 User tracking via XUL persist attribute

MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)



Fixed in Firefox 3.0.4

MFSA 2008-58 Parsing error in E4X default namespace

MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals

MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation

MFSA 2008-55 Crash and remote code execution in nsFrameManager

MFSA 2008-54 Buffer overflow in http-index-format parser

MFSA 2008-53 XSS and JavaScript privilege escalation via session restore

MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18)

MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome

MFSA 2008-47 Information stealing via local shortcut files

Fixed in Firefox 3.0.2

MFSA 2008-50 Crash and remote code execution via __proto__ tampering

MFSA 2008-44 resource: traversal vulnerabilities

MFSA 2008-43 BOM characters stripped from JavaScript before execution

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.