セキュリティ情報

ここは、Mozilla Firefox / Thunderbirdのセキュリティ情報をまとめたページです。

2005-12-15現在、Mozilla Firefox 1.5の未対策セキュリティ脆弱性は4件 (Secunia報告)が報じられています。

公式公開情報

• Mozilla Foundation Security Advisory
• Mozilla Foundationセキュリティアドバイザリ

まず第一は、公式に発表されている情報を参照しましょう。ただしこの情報は原則的に新しいバージョンがリリースされた後に更新されます。最新版で修正されていない問題については掲載されません。

その他の情報

• Bugzilla :
  • Blocking 1.8.0.1
    • blocking1.8.0.1+ Firefox / Thunderbird 1.5.0.1で修正される予定のバグ一覧
    • blocking1.8.0.1? Firefox / Thunderbird 1.5.0.1で修正が要求されているバグ一覧
  • Avaiary 1.0.8
    • blocking-aviary1.0.8+ Firefox / Thunderbird 1.0.8で修正される予定のバグ一覧
    • blocking-aviary1.0.8? Firefox / Thunderbird 1.0.8で修正が要求されているバグ一覧
    • fixed-aviary1.0.8 Firefox / Thunderbird 1.0.8で修正されたバグ一覧
  • 個人的に気になるバグ
    • Bug 122445 URL: Spoof - userpass looks like a hostname
    • Bug 162134 [OSX] (Java applet, Real, QuickTime) XPCOM plug-ins draw on wrong tabs and leave detritus during scroll
    • Bug 182176 ".." exploit in chrome registry using '%' escaping
    • Bug 213280 denial-of-service-attack using iframe & telnet-urls
    • Bug 230134 css background url allows execution of javascript and allows opening of other non-graphic URIs
    • Bug 230606 Tighten the same-origin policy for local files (file: URLs, trusted, security)
    • Bug 233865 URL: DNS: very long domain name (VLDN) as spoofing
    • Bug 239777 Statusbar: Spoof - userpass looks like a hostname
    • Bug 246804 [Win32/MacOSX only] Address Bar Spoofing Weakness (Secunia Advisory SA11856) - %2F %20 trick, invalid HOST header
    • Bug 252257 security information bar is spoofable
    • Bug 252342 fix cookie domain checks to not allow .co.uk
    • Bug 273419 Disclosure of local file content in Mozilla Firefox and Opera

外部による情報

Secunia

• Secunia Advisory : Mozilla Firefox 1.x / Mozilla Firefox 0.x
  • Mozilla / Mozilla Firefox Apple Java Plugin Tab Spoofing Vulnerability
  • Mozilla / Mozilla Firefox Cross-Domain Cookie Injection Vulnerability
  • Mozilla Firefox Image Javascript URI Dragging Cross-Site Scripting
  • [Partial Fix]Mozilla Firefox Download Dialog Spoofing Vulnerabilities
  • [FIXED]Mozilla / Firefox / Camino Dialog Origin Spoofing Vulnerability
  • Mozilla Firefox History Information Denial of Service Weakness

Security Focus

• SecurityFocus : HOME Vulns Archive: Vendor
  • Multiple Vendor URI Protocol Handler Arbitrary File Creation/Modification Vulnerability
  • Mozilla Browser URI Obfuscation Weakness
  • Multiple Vendor Internet Browser User Action Prediction/Interception Weakness
  • Mozilla Browser Cache File Multiple Vulnerabilities
  • Mozilla/Netscape/Firefox Browsers JavaScript IFRAME Rendering Denial Of Service Vulnerability
  • Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
  • Multiple Browser Cross-Domain Cookie Injection Vulnerability
  • Mozilla Temporary File Insecure Permissions Information Disclosure Vulnerability
  • Mozilla Firefox Infinite Array Sort Denial Of Service Vulnerability
  • Mozilla Browser and Mozilla Firefox Remote Window Hijacking Vulnerability
  • Multiple Mozilla Browser enable.IDN Setting Weakness
  • Firefox Remote SMB Document Local File Disclosure Vulnerability
  • Mozilla Firefox Address Bar Image Dragging Remote Script Execution Vulnerability
  • Multiple Browser Information Disclosure Weakness
  • Mozilla Suite/Firefox/Thunderbird Nested Anchor Tag Status Bar Spoofing Weakness
  • [FIXED]Mozilla/Firefox Browsers Dialog Box Origin Spoofing Vulnerability
  • Mozilla Firefox Weak Authentication Mechanism Vulnerability

作成：2004-07-30