Security vulnerabilities are present in the mail client and the browser components of Mozilla 1.7 (for Solaris 8, 9 and 10). (Mozilla can be used as a web browser and editor, an IRC client, an email client and a news client)

These vulnerabilities may allow a remote unprivileged user who either controls a website that is visited by a local user using the Mozilla browser or sends an email that is read by a local user using Mozilla to execute arbitrary code with the privileges of the user running Mozilla.

BugID 6447022 - For Mozilla 1.7:

This issue is described in the following documents:

• http://www.mozilla.org/security/announce/2006/mfsa2006-37.html
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776
• http://www.kb.cert.org/vuls/id/575969

BugID 6508400 - For Mozilla 1.7:

This issue is described in the following documents:

• http://www.mozilla.org/security/announce/mfsa2006-74.html
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6505
• http://www.kb.cert.org/vuls/id/887332

These issues can occur in the following releases:

SPARC Platform

• Mozilla 1.7 (for Solaris 8 and 9) without patch 120671-05
• Mozilla 1.7 (for Solaris 10) without patch 119115-23

x86 Platform

• Mozilla 1.7 (for Solaris 8 and 9) without patch 120672-04
• Mozilla 1.7 (for Solaris 10) without patch 119116-23

Note: Mozilla 1.4 may be vulnerable to one or more of these security issues. Customers are advised to upgrade to Mozilla 1.7 to get these security fixes.

To determine the version of Mozilla on a Solaris system, the following command can be run:

    % /usr/sfw/bin/mozilla -version
    Mozilla 1.7, (Sun Java Desktop System), build 2005031721

There are no predictable symptoms that would indicate the described issues have been exploited.

BugID 6508400:

There is no workaround for this issue.

BugID 6447022:

To work around this issue, disable Javascript in Mozilla mail by doing the following:

1. Open the Preferences dialog from the Edit menu
2. Select the Advanced tree
3. Select the Scripts & Plug-ins leaf
4. Uncheck the Navigator and Mail & Newsgroups check boxes
5. Click the OK button

These issues are addressed in the following releases:

SPARC Platform

• Mozilla 1.7 (for Solaris 8 and 9) with patch 120671-05 or later
• Mozilla 1.7 (for Solaris 10) with patch 119115-23 or later

x86 Platform

• Mozilla 1.7 (for Solaris 8 and 9) with patch 120672-04 or later
• Mozilla 1.7 (for Solaris 10) with patch 119116-23 or later

• Updated Contributing Factors and Relief/Workaround sections

• State: Resolved
• Updated Contributing Factors and Resolution sections

• Updated Contributing Factors and Resolution sections

This solution has no attachment