US-CERT Cyber Security Alert SA07-151A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                        National Cyber Alert System

                       Cyber Security Alert SA07-151A


Mozilla Updates for Multiple Vulnerabilities

   Original release date: May 31, 2007
   Last revised: --
   Source: US-CERT


Systems Affected

     * Mozilla Firefox
     * Mozilla Thunderbird
     * Mozilla SeaMonkey
     * Netscape Browser

   Other products based on Mozilla components may also be affected.


Overview

     Mozilla Firefox, Thunderbird, and derived products contain several
     vulnerabilities. By taking advantage of one or more of these
     vulnerabilities, an attacker may be able to take control of your
     computer.


Solution

Upgrade to the latest versions of Firefox, Thunderbird, and SeaMonkey

     Mozilla has released Firefox 1.5.0.12, Firefox 2.0.0.4, Thunderbird
     1.5.0.12, Thunderbird 2.0.0.4, SeaMonkey 1.0.9, and SeaMonkey 1.1.2
     to correct these problems. Mozilla Firefox, Thunderbird, and
     SeaMonkey automatically check for updates by default.

     Support for Firefox 1.5 is scheduled to end in June 2007. According
     to Mozilla:

     Firefox 1.5.0.x will be maintained with security and stability
     updates until June 2007. All users are strongly encouraged to
     upgrade to Firefox 2. 


Disable JavaScript and Java

     These vulnerabilities can be mitigated by disabling JavaScript and
     Java. For more information about configuring Firefox, please see
     the "Securing Your Web Browser" document. Netscape users should see
     the "Site Controls" document for details.
     Thunderbird disables JavaScript and Java by default.


Description

     Mozilla products, including the Firefox web browser and Thunderbird
     email application, contain a number of vulnerabilities. These
     vulnerabilities may allow an attacker to access your computer, run
     programs that could cause your computer to crash, or gain control
     of your computer. An attacker could exploit these vulnerabilities
     by convincing you to visit a web site or read an HTML formatted
     email message.

     For more technical information, please see US-CERT Technical Alert
     TA07-151A.


References

     * US-CERT Technical Alert TA07-151A -
       <http://www.us-cert.gov/cas/techalerts/TA07-151A.html>

     * US-CERT Vulnerability Notes -
       <http://www.kb.cert.org/vuls/byid?searchview&query=mozilla_20070531>

     * Securing Your Web Browser -
       
<http://www.us-cert.gov/reading_room/securing_browser/browser_security.html#Mozilla_Firefox>

     * Mozilla Foundation Security Advisories - 
<http://www.mozilla.org/security/announce/>

     * Firefox - Rediscover the Web - <http://www.mozilla.com/firefox/>

     * Thunderbird - Reclaim your inbox - <http://www.mozilla.com/thunderbird/>

     * The SeaMonkey Project - <http://www.mozilla.org/projects/seamonkey/>

     * Mozilla Hall of Fame - <http://www.mozilla.org/university/HOF.html>

     * Site Controls - <http://browser.netscape.com/ns8/help/options-site.jsp>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.preview.us-cert.gov/cas/alerts/SA07-151A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "SA07-151A Feedback VU#751636" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2007 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   May 31, 2007: Initial release





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRl8vWuxOF3G+ig+rAQI6+Qf9FtWHtv84xUAqMnq22SX97fW90Wdky7xT
SmSNIqEi7vdM1w6HlyIbbLHd3Os82AiwWmfZjr1dHLfD9UDLzL3kvfehPYQ4te8i
bYXesVAgGpRaEg+Tqvs1d8h128TiAmdgDJX38utstKu3KbaqmaaNKGne7zxYbS5Y
ZQoVUGxPCs1kjZKsqHtjFCD3dNTzk8Efix5lT4GJv6nJHwNuo0dKgTGucTrcXKOc
cuscRtNzB9DwARqU8P4dsCSzKtFRn+zMecea4E2AXkLULgKVmGFnENsw4kAxcbEr
UfGXxWIOBk6/hMxrAi8M/8hX+v/mb2srsd5Re8X9y3Li+FIdMCEsXA==
=SicL
-----END PGP SIGNATURE-----