DSA-2295-1

Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2011-0084 CVE-2011-2378 CVE-2011-2981 CVE-2011-2982 CVE-2011-2983 CVE-2011-2984

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of Seamonkey:

CVE-2011-0084

"regenrecht" discovered that incorrect pointer handling in the SVG processing code could lead to the execution of arbitrary code.

CVE-2011-2378

"regenrecht" discovered that incorrect memory management in DOM processing could lead to the execution of arbitrary code.

CVE-2011-2981

"moz_bug_r_a_4" discovered a Chrome privilege escalation vulnerability in the event handler code.

CVE-2011-2982

Gary Kwong, Igor Bukanov, Nils and Bob Clary discovered memory corruption bugs, which may lead to the execution of arbitrary code.

CVE-2011-2983

"shutdown" discovered an information leak in the handling of RegExp.input.

CVE-2011-2984

"moz_bug_r_a4" discovered a Chrome privilege escalation vulnerability.

The oldstable distribution (lenny) is not affected. The iceape package only provides the XPCOM code.