Secunia

Description

MandrakeSoft has issued updated packages for Mozilla. These fix various older vulnerabilities, which can be exploited by malicious people to disclose users' proxy server credentials, bypass certain cookie path restrictions, cause a DoS (Denial of Service), and potentially compromise a user's system.

1) A handling error in the NSS security suite's S/MIME implementation can be exploited by malicious people to cause a DoS and potentially compromise a user's system.

For more information:
SA11096

2) A vulnerability can reportedly be exploited by certain malicious websites to access users' authentication credentials for proxy servers by returning a "407: Proxy authentication required" response.

3) An error within Script.prototype.freeze/thaw can potentially be exploited by malicious people to execute arbitrary code on a user's system.

4) A vulnerability in the cookie handling can be exploited by malicious people to bypass certain cookie restrictions.

For more information:
SA9680

Solution
Upgrade automatically using MandrakeUpdate or manually by downloading the updated packages from one of MandrakeSoft's FTP server mirrors:
Further details available in Customer Area

Original Advisory
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:021

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area