Synopsis: Critical: seamonkey security update Issue Date: 2012-02-01 CVE Numbers: CVE-2012-0442 CVE-2011-3670 SeaMonkey is an open source web browser, e-mail and newsgroup client, IRC chat client, and HTML editor. A flaw was found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2012-0442) The same-origin policy in SeaMonkey treated http://example.com and http://[example.com] as interchangeable. A malicious script could possibly use this flaw to gain access to sensitive information (such as a client's IP and user e-mail address, or httpOnly cookies) that may be included in HTTP proxy error replies, generated in response to invalid URLs using square brackets. (CVE-2011-3670) All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect. SL4: i386 seamonkey-1.0.9-78.el4.i386.rpm seamonkey-chat-1.0.9-78.el4.i386.rpm seamonkey-debuginfo-1.0.9-78.el4.i386.rpm seamonkey-devel-1.0.9-78.el4.i386.rpm seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm seamonkey-js-debugger-1.0.9-78.el4.i386.rpm seamonkey-mail-1.0.9-78.el4.i386.rpm x86_64 seamonkey-1.0.9-78.el4.x86_64.rpm seamonkey-chat-1.0.9-78.el4.x86_64.rpm seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm seamonkey-devel-1.0.9-78.el4.x86_64.rpm seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm seamonkey-mail-1.0.9-78.el4.x86_64.rpm - Scientific Linux Development Team