Georgi Guninski

**Name of the Vulnerable Software and Affected Versions** netqmail version 1.06 **Description** The issue is related to the qmail-verify module in the netqmail email client, which lacks protection for service data. This can allow an attacker to gain access to confidential data. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first. **Recommendations** For netqmail version 1.06, consider restricting the privileges of the qmail-verify module to prevent it from running as root, or apply configuration changes to limit its access to sensitive files and directories. As a temporary workaround, consider disabling the qmail-verify module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** netqmail version 1.06 **Description** The issue is related to a lack of input validation in the qmail-verify module of the netqmail email client. This can be exploited by a remote attacker to compromise data integrity. The vulnerability allows for a mail-address verification bypass. **Recommendations** For netqmail version 1.06, consider disabling the qmail-verify module until a patch is available to prevent potential exploitation. Restrict access to the mail-address verification feature to minimize the risk of data integrity compromise.

**Name of the Vulnerable Software and Affected Versions** apt (affected versions not specified) **Description** The issue is related to the incorrect validation of gpg keys with the master keyring by apt-key in apt, which can lead to a potential man-in-the-middle attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APT versions 0.7.x through 0.7.24 APT versions 0.8.x through 0.8.15 **Description** The issue allows remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack, due to reliance on GnuPG argument order and lack of checks for GPG subkeys when using the apt-key net-update to import keyrings. **Recommendations** For APT versions 0.7.x through 0.7.24, update to version 0.7.25 or later. For APT versions 0.8.x through 0.8.15, update to version 0.8.16 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 0.9.7 through 1.0.0a OpenSSL versions prior to 1.0.0e **Description** A double free vulnerability in the ssl3 get key exchange function in the OpenSSL client allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted private key with an invalid prime. This issue may also be referred to as a use-after-free issue. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. **Recommendations** For OpenSSL versions 0.9.7 through 1.0.0a, update to a version later than 1.0.0a to resolve the issue. For OpenSSL versions prior to 1.0.0e, update to version 1.0.0e or later to resolve the issue. As a temporary workaround, consider restricting the use of ECDH in the OpenSSL client until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.0.x through 3.0.17 Mozilla Firefox versions 3.5.x through 3.5.7 SeaMonkey versions prior to 2.0.3 **Description** The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document, due to improper support for the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element. **Recommendations** For Mozilla Firefox versions 3.0.x through 3.0.17, update to version 3.0.18 or later. For Mozilla Firefox versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For SeaMonkey versions prior to 2.0.3, update to version 2.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.7 Thunderbird versions prior to 2.0.0.21 SeaMonkey versions prior to 1.1.15 **Description** The issue allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect. This is due to a problem with the nsIRDFService. **Recommendations** For Mozilla Firefox versions prior to 3.0.7, update to version 3.0.7 or later. For Thunderbird versions prior to 2.0.0.21, update to version 2.0.0.21 or later. For SeaMonkey versions prior to 1.1.15, update to version 1.1.15 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5.x through 1.5.0.11 Mozilla Firefox versions 2.x through 2.0.0.3 Thunderbird versions 1.5.x through 1.5.0.11 Thunderbird versions 2.x through 2.0.0.3 SeaMonkey version 1.0.9 SeaMonkey version 1.1.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues. **Recommendations** For Mozilla Firefox versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Firefox versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For Thunderbird versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Thunderbird versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For SeaMonkey version 1.0.9, update to a version later than 1.0.9. For SeaMonkey version 1.1.2, update to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Mozilla Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** The issue is related to multiple heap-based buffer overflows that can be triggered by remote attackers. This can be achieved through external message modes with long Content-Type headers or long RFC2047-encoded (MIME non-ASCII) headers, potentially allowing the execution of arbitrary code. **Recommendations** For Mozilla Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** The issue affects the layout engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and potentially execute arbitrary code. The attack vectors for this issue are not specified. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.5 Thunderbird versions prior to 1.5.0.5 SeaMonkey versions prior to 1.0.3 **Description** The issue involves multiple integer overflows in the Javascript engine. Remote attackers might execute arbitrary code via vectors involving long strings in the `toSource` method of the `Object`, `Array`, and `String` objects, as well as unspecified string function arguments. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For Thunderbird versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For SeaMonkey versions prior to 1.0.3, update to version 1.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.4 Mozilla Thunderbird versions prior to 1.5.0.4 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. This can be achieved through various means, including nested `<option>` tags in a `select` tag, a `DOMNodeRemoved` mutation event, Content-implemented tree views, BoxObjects, the XBL implementation, or an `iframe` that attempts to remove itself, leading to memory corruption. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue. For Mozilla Thunderbird versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.0.x through 1.5.0.1 Mozilla Thunderbird versions 1.0.x through 1.5.0.1 Mozilla Suite versions prior to 1.7.13 SeaMonkey versions prior to 1.0.1 Description: The issue allows remote attackers to gain chrome privileges via multiple attack vectors related to the use of XBL scripts with "Print Preview". Recommendations: For Mozilla Firefox versions 1.0.x through 1.5.0.1, update to version 1.5.0.2 or later. For Mozilla Thunderbird versions 1.0.x through 1.5.0.1, update to version 1.5.0.2 or later. For Mozilla Suite versions prior to 1.7.13, update to version 1.7.13 or later. For SeaMonkey versions prior to 1.0.1, update to version 1.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Thunderbird versions 1.0.7 and earlier **Description** The issue allows attackers to bypass javascript security settings and obtain sensitive information or cause a crash. This is achieved through an e-mail containing a javascript URI in the SRC attribute of an `IFRAME` tag, which is executed when the user edits the e-mail. **Recommendations** For Mozilla Thunderbird versions 1.0.7 and earlier, consider disabling the WYSIWYG rendering engine or restricting the use of javascript in e-mails to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox version 1.5 Thunderbird version 1.5 SeaMonkey versions prior to 1.0 **Description** The issue allows remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption. **Recommendations** For Mozilla Firefox version 1.5, update to a version that fixes the memory corruption issue. For Thunderbird version 1.5, consider disabling Javascript in mail as a temporary workaround until a patch is available. For SeaMonkey versions prior to 1.0, update to a version that fixes the memory corruption issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5 Thunderbird versions 1.5 SeaMonkey versions prior to 1.0 **Description** The issue is related to multiple integer overflows that could allow remote attackers to execute arbitrary code. This is possible via the `EscapeAttributeValue` in `jsxml.c` for E4X, `nsSVGCairoSurface::Init` in SVG, and `nsCanvasRenderingContext2D.cpp` in Canvas, when Javascript is enabled in mail. **Recommendations** For Mozilla Firefox version 1.5, update to a version that contains a fix for this issue. For Thunderbird version 1.5, update to a version that contains a fix for this issue. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

**Name of the Vulnerable Software and Affected Versions** vim versions 6.3 before 6.3.082 **Description** The issue allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels, when modelines are enabled. **Recommendations** For vim versions 6.3 before 6.3.082, update to version 6.3.082 or later to resolve the issue. As a temporary workaround, consider disabling modelines to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 1.0.4 Mozilla Suite versions prior to 1.7.8 **Description** The issue is related to improper implementation of security checks for script injection, allowing remote attackers to execute scripts via `javascript:` URLs. This can be achieved through various methods, including using a `javascript:` URL in a `view-source:` URL, a `javascript:` URL in a `jar:` URL, or a nested variant. **Recommendations** For Firefox versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. For Mozilla Suite versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** qmail (affected versions not specified) **Description** The issue is caused by an integer overflow in the `stralloc readyplus` function in qmail. This allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request, particularly when running on 64-bit platforms with a large amount of virtual memory. Researchers from Qualys demonstrated the possibility of exploiting this vulnerability, which was known since 2005, by preparing an exploit that initiates remote code execution on the server through sending a specially crafted message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** qmail (affected versions not specified) **Description** The issue is related to an integer signedness error in the `qmail put` and `substdio put` functions of qmail. This error can be exploited by remote attackers, particularly when qmail is running on 64-bit platforms with a large amount of virtual memory. The exploitation can occur via a large number of SMTP RCPT TO commands, potentially leading to a denial of service and possibly allowing the execution of arbitrary code. The vulnerability is also associated with uncontrolled resource consumption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.