KLA11454 Multiple vulnerabilities in SeaMonkey

Multiple vulnerabilities were found in SeaMonkey. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions and spoof user interface.

Below is a complete list of vulnerabilities:

1. Multiple memory corruption vulnerabilities in SeaMonkey can be exploited remotely to cause denial of service or execute arbitrary code;
2. Memory leak vulnerability in SeaMonkey can be exploited to bypass security restrictions;
3. Vulnerability related to ECMAScript 5 API in SeaMonkey can be exploited to execute arbitrary code;
4. Vulnerability related to dragging and dropping images in SeaMonkey can be exploited to bypass security restrictions;
5. Vulnerability related to handling of CORS preflight request headers in SeaMonkey can be exploited to bypass security restrictions;
6. Memory safety vulnerabilities in libGLES in the ANGLE graphics library in SeaMonkey can be exploited to cause denial of service;
7. Out of bounds read vulnerability in SeaMonkey can be exploited to cause denial of service;
8. Vulnerability related to using the debugger API in SeaMonkey can be exploited to cause denial of service;
9. Vulnerability related to manipulating the loaded URL in SeaMonkey can be exploited to spoof user interface;
10. Use-after-free vulnerability in SeaMonkey can be exploited to cause denial of service;
11. Buffer overflow vulnerability in SeaMonkey can be exploited to cause denial of service;
12. Out of bounds read vulnerability in SeaMonkey can be exploited to bypass security restrictions;
13. Vulnerability related to creating a scripted proxy by web page in SeaMonkey can be exploited to bypass security restrictions.

Original advisories

Advisories for SeaMonkey 2.38

Related products

Mozilla-SeaMonkey

CVE list

CVE-2015-7180 critical

CVE-2015-7179 critical

CVE-2015-7178 critical

CVE-2015-7177 critical

CVE-2015-7176 critical

CVE-2015-7175 critical

CVE-2015-7174 critical

CVE-2015-4522 critical

CVE-2015-4521 critical

CVE-2015-4520 high

CVE-2015-4519 warning

CVE-2015-4517 critical

CVE-2015-4516 critical

CVE-2015-4512 high

CVE-2015-4511 high

CVE-2015-4510 high

CVE-2015-4509 critical

CVE-2015-4508 warning

CVE-2015-4507 high

CVE-2015-4506 high

CVE-2015-4504 high

CVE-2015-4503 critical

CVE-2015-4502 warning

CVE-2015-4501 critical

CVE-2015-4500 critical

Solution

Update to the latest version

Download SeaMonkey

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• SeaMonkey versions earlier than 2.38