(PVS) Signatures - Tenable Network Security

same-origin policy could allow for cross-site scripting attacks (MFSA 2008-22).\n -
JavaScript can be injected into the context of signed JARs and executed under the context
of the JAR's signer (MFSA 2008-23).\n - By taking advantage of the privilege level stored
in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code
with chrome privileges (MFSA 2008-24).\n - Arbitrary code execution is possible in
'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).\n - An attacker can steal files
from known locations on a victim's computer via originalTarget and DOM Range (MFSA
2008-27).\n - It is possible for a malicious Java applet to bypass the same-origin policy and
create arbitrary socket connections to other domains (MFSA 2008-28).\n - An improperly
encoded '.properties' file in an add-on can result in uninitialized memory being used, which
could lead to data formerly used by other programs being exposed to the add-on code
(MFSA 2008-29).\n - File URLs in directory listings are not properly HTML-escaped when
the filenames contained particular characters (MFSA 2008-30).\n - A weakness in the trust
model regarding alt names on peer-trusted certs could lead to spoofing secure connections
to any other site (MFSA 2008-31).\n - URL shortcut files on Windows (for example, saved
IE favorites) could be interpreted as if they were in the local file context when opened by
Firefox, although the referenced remote content would be downloaded and displayed
(MFSA 2008-32).\n - A crash in Mozilla's block reflow code could be used by an attacker
to crash the browser and run arbitrary code on the victim's computer (MFSA 2008-33).
Solution: Upgrade to version 2.0.0.15 or higher.
CVE-2008-2811
SeaMonkey < 1.1.10 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4568 FAMILY: Web Clients RISK: HIGH NESSUS ID:33394
Description: Synopsis :\n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of SeaMonkey is affected by various
security issues :\n\n - Several stability bugs leading to crashes that, in some cases, show
traces of memory corruption (MFSA 2008-21).\n - A vulnerability involving violation of
the same-origin policy could allow for cross-site scripting attacks (MFSA 2008-22).\n -
JavaScript can be injected into the context of signed JARs and executed under the context
of the JAR's signer (MFSA 2008-23).\n - By taking advantage of the privilege level stored
in the pre-compiled 'fastload' file, an attacker may be able to run arbitrary JavaScript code
with chrome privileges (MFSA 2008-24).\n - Arbitrary code execution is possible in
'mozIJSSubScriptLoader.loadSubScript()' (MFSA 2008-25).\n - An attacker can steal files
from known locations on a victim's computer via originalTarget and DOM Range (MFSA
2008-27).\n - It is possible for a malicious Java applet to bypass the same-origin policy and
create arbitrary socket connections to other domains (MFSA 2008-28).\n - An improperly
encoded '.properties' file in an add-on can result in uninitialized memory being used, which
could lead to data formerly used by other programs being exposed to the add-on code
(MFSA 2008-29).\n - File URLs in directory listings are not properly HTML-escaped when
the filenames contained particular characters (MFSA 2008-30).\n - A weakness in the trust
model regarding alt names on peer-trusted certs could lead to spoofing secure connections
to any other site (MFSA 2008-31).\n - URL shortcut files on Windows (for example, saved
IE favorites) could be interpreted as if they were in the local file context when opened by
Seamonkey, although the referenced remote content would be downloaded and displayed
(MFSA 2008-32).\n - A crash in Mozilla's block reflow code could be used by an attacker
Family Internet Services 1194