-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                              ASB-2013.0024.2
          Multiple vulnerabilities have been fixed in the latest
           versions of Mozilla Firefox, Thunderbird, & SeaMonkey
                             21 February 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Mozilla Firefox
                      Mozilla Thunderbird
                      Mozilla SeaMonkey
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
                      Android
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Provide Misleading Information  -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2013-0784 CVE-2013-0783 CVE-2013-0782
                      CVE-2013-0781 CVE-2013-0780 CVE-2013-0779
                      CVE-2013-0778 CVE-2013-0777 CVE-2013-0776
                      CVE-2013-0775 CVE-2013-0774 CVE-2013-0773
                      CVE-2013-0772 CVE-2013-0765 
Member content until: Friday, March 22 2013

Revision History:     February 21 2013: Modified Product Tag
                      February 20 2013: Initial Release

OVERVIEW

        Multiple vulnerabilities have been fixed in the latest versions of 
        Mozilla Firefox, Thunderbird and SeaMonkey.


IMPACT

        The vendor has provided the following details about the 
        vulnerabilities:
        
        CVE-2013-0783 and CVE-2013-0784:
        "Mozilla developers identified and fixed several memory safety bugs 
        in the browser engine used in Firefox and other Mozilla-based 
        products. Some of these bugs showed evidence of memory corruption 
        under certain circumstances, and we presume that with enough effort
        at least some of these could be exploited to run arbitrary code. 
        Note: In general these flaws cannot be exploited through email in 
        the Thunderbird and SeaMonkey products because scripting is 
        disabled, but are potentially a risk in browser or browser-like 
        contexts in those products." [1]
        
        CVE-2013-0772:
        "Using the Address Sanitizer tool, security researcher Atte Kettunen
        from OUSPG found an out-of-bounds read while rendering GIF format 
        images. This could cause a non-exploitable crash and could also 
        attempt to render normally inaccesible data as part of the image." 
        [2]
        
        CVE-2013-0765:
        "Mozilla developer Boris Zbarsky reported that in some circumstances
        a wrapped WebIDL object can be wrapped multiple times, overwriting 
        the existing wrapped state. This could lead to an exploitable 
        condition in rare cases." [3]
        
        CVE-2013-0773:
        "Mozilla developer Bobby Holley discovered that it was possible to 
        bypass some protections in Chrome Object Wrappers (COW) and System 
        Only Wrappers (SOW), making their prototypes mutable by web content. 
        This could be used leak information from chrome objects and 
        possibly allow for arbitrary code execution. Note: In general these
        flaws cannot be exploited through email in the Thunderbird and 
        SeaMonkey products because scripting is disabled, but are 
        potentially a risk in browser or browser-like contexts in those 
        products." [4]
        
        CVE-2013-0774:
        "Mozilla security researcher Frederik Braun discovered that since 
        Firefox 15 the file system location of the active browser profile 
        was available to JavaScript workers. While not dangerous by itself,
        this could potentially be combined with other vulnerabilities to 
        target the profile in an attack. Note: In general these flaws cannot
        be exploited through email in the Thunderbird and SeaMonkey products
        because scripting is disabled, but are potentially a risk in browser
        or browser-like contexts in those products." [5]
        
        CVE-2013-0775:
        "Security researcher Nils reported a use-after-free in 
        nsImageLoadingContent when content script is executed. This could 
        allow for arbitrary code execution. Note: In general these flaws 
        cannot be exploited through email in the Thunderbird and SeaMonkey 
        products because scripting is disabled, but are potentially a risk 
        in browser or browser-like contexts in those products." [6]
        
        CVE-2013-0776:
        "Google security researcher Michal Zalewski reported an issue where 
        the browser displayed the content of a proxy's 407 response if a 
        user canceled the proxy's authentication prompt. In this 
        circumstance, the addressbar will continue to show the requested 
        site's address, including HTTPS addresses that appear to be secure.
        This spoofing of addresses can be used for phishing attacks by 
        fooling users into entering credentials, for example. Note: In 
        general these flaws cannot be exploited through email in the 
        Thunderbird and SeaMonkey products because scripting is disabled, 
        but are potentially a risk in browser or browser-like contexts in 
        those products." [7]
        
        CVE-2013-0777, CVE-2013-0778, CVE-2013-0779, CVE-2013-0781, 
        CVE-2013-0782 and CVE-2013-0780:
        "Security researcher Abhishek Arya (Inferno) of the Google Chrome 
        Security Team used the Address Sanitizer tool to discover a series 
        of use-after-free, out of bounds read, and buffer overflow problems
        rated as low to critical security issues in shipped software. Some 
        of these issues are potentially exploitable, allowing for remote 
        code execution. We would also like to thank Abhishek for reporting 
        four additional use-after-free and out of bounds write flaws 
        introduced during Firefox development that were fixed before general
        release. Note: In general these flaws cannot be exploited through 
        email in the Thunderbird and SeaMonkey products because scripting is
        disabled, but are potentially a risk in browser or browser-like 
        contexts in those products." [8]


MITIGATION

        Users should update to the latest versions of Firefox, Thunderbird and 
        SeaMonkey.


REFERENCES

        [1] Mozilla Foundation Security Advisory 2013-21
            http://www.mozilla.org/security/announce/2013/mfsa2013-21.html

        [2] Mozilla Foundation Security Advisory 2013-22
            http://www.mozilla.org/security/announce/2013/mfsa2013-22.html

        [3] Mozilla Foundation Security Advisory 2013-23
            http://www.mozilla.org/security/announce/2013/mfsa2013-23.html

        [4] Mozilla Foundation Security Advisory 2013-24
            http://www.mozilla.org/security/announce/2013/mfsa2013-24.html

        [5] Mozilla Foundation Security Advisory 2013-25
            http://www.mozilla.org/security/announce/2013/mfsa2013-25.html

        [6] Mozilla Foundation Security Advisory 2013-26
            http://www.mozilla.org/security/announce/2013/mfsa2013-26.html

        [7] Mozilla Foundation Security Advisory 2013-27
            http://www.mozilla.org/security/announce/2013/mfsa2013-27.html

        [8] Mozilla Foundation Security Advisory 2013-28
            http://www.mozilla.org/security/announce/2013/mfsa2013-28.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUSXIB+4yVqjM2NGpAQLuiw/+NrSb3ouOTvHBzktutmy1mJhZtf7hnv4W
pdoDxk3nUBNjQW+M6re3QYD6rUfarklHImHSzySXfzWt7g1kZO5ZjQ0wH5dTl2lu
ToVftNXlxSNzutCKgmXuv7CKAoCxJFze2cb19Ey0B/9VPNUXa2ueK7esGXk0gkvS
raI+yCI0uNN+dI1cAiL8m5V8bZyyCK9qBs4Mxh5D98MF1VXJgjzvIx9e36TVnGIV
sFDvtFn80zx4QdxEtBs/NNFVjTT6QURtEclEYAbszYuV1vdv8+CYyInXdivRS4U1
omHSlGn8JY8kg/2uSr4L87dNVFYoJxiNRMTDs8Gh7Mmoz6kHIEDZISRbqAHqiW+m
hhFIjHK7KyA+upaX1kD4SHJlkZovGYcWMnmBnF3Da0D2HYSmMSeQi5aOBzIUpGvL
mwiH1qvUIU4Dtd4hI8j/lgQJ/3uqclDvLB+mvL66fZ0AT6I9XjkcbkHYyB0H59Da
8e9tp5zQAeh6aRmBOlIErl7dnMH4RfjrgfGSFC2ks6nDfjd2GdCYbNLncUcqDVUE
TE1DLWybyyhH5Ieu8icPwZw3pC5kNEV+Xmi0u098Y5Ka9GtAb2UbITWL0a7jtF08
0TiAZKsx63Ia6stlfuJdXmPNiYccnCm0KOuI2HJb4oRThtDKPyFY6XH5eyMSo0mI
LHyX2u2Gkzw=
=Ms9w
-----END PGP SIGNATURE-----