27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

CVE-2008-4068<br />

Firefox < 2.0.0.17 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 4692 FAMILY: Web Clients RISK: HIGH NESSUS ID:34268<br />

Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by<br />

multiple vulnerabilities.\n\nThe installed version of Firefox is affected by various security<br />

issues : \n\n - Using a specially crafted UTF-8 URL in a hyperlink, an attacker might be<br />

able to exploit a stack buffer overflow in the Mozilla URL parsing routes to execute<br />

arbitrary code (MFSA 2008-37).\n - It is possible to bypass the same-origin check in<br />

'nsXMLDocument: : OnChannelRedirect()' (MFSA 2008-38).\n - There are a series of<br />

vulnerabilities in 'feedWriter' that allow scripts from page content to run with chrome<br />

privileges (MFSA 2008-39).\n - An attacker can cause the content window to move while<br />

the mouse is being clicked, causing an item to be dragged rather than clicked-on (MFSA<br />

2008-40).\n - Privilege escalation is possible via 'XPCnativeWrapper' pollution (MFSA<br />

2008-41).\n - There are several stability bugs in the browser engine that may lead to crashes<br />

with evidence of memory corruption (MFSA 2008-42).\n - Certain BOM characters and<br />

low surrogate characters, if HTML-escaped, are stripped from JavaScript code before it is<br />

executed, which could allow for cross-site scripting attacks (MFSA 2008-43).\n - The<br />

'resource: ' protocol allows directory traversal on Linux when using URL-encoded slashes,<br />

and it can be used to bypass restrictions on local HTML files (MFSA 2008-44).\n - A bug<br />

in the XBM decoder allows random small chunks of uninitialized memory to be read<br />

(MFSA 2008-45).\nThe reported browser version was: \n %L<br />

Solution: Upgrade to version 2.0.0.17 or higher.<br />

CVE-2008-4069<br />

SeaMonkey < 1.1.12 Multiple Vulnerabilities<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

<strong>PVS</strong> ID: 4693 FAMILY: Web Clients RISK: HIGH NESSUS ID:34269<br />

Description: Synopsis : \n\nA web browser on the remote host is affected by multiple vulnerabilities.\n\n<br />

The installed version of SeaMonkey is affected by various security issues : \n\n - Using a<br />

specially crafted UTF-8 URL in a hyperlink, an attacker might be able to exploit a stack<br />

buffer overflow in the Mozilla URL parsing routes to execute arbitrary code (MFSA<br />

2008-37).\n - It is possible to bypass the same-origin check in 'nsXMLDocument: :<br />

OnChannelRedirect()' (MFSA 2008-38).\n - An attacker can cause the content window to<br />

move while the mouse is being clicked, causing an item to be dragged rather than<br />

clicked-on (MFSA 2008-40).\n - Privilege escalation is possible via 'XPCnativeWrapper'<br />

pollution (MFSA 2008-41).\n - There are several stability bugs in the browser engine that<br />

may lead to crashes with evidence of memory corruption (MFSA 2008-42).\n - Certain<br />

BOM characters and low surrogate characters, if HTML-escaped, are stripped from<br />

JavaScript code before it is executed, which could allow for cross-site scripting attacks<br />

(MFSA 2008-43).\n - The 'resource: ' protocol allows directory traversal on Linux when<br />

using URL-encoded slashes, and it can by used to bypass restrictions on local HTML files<br />

(MFSA 2008-44).\n - A bug in the XBM decoder allows random small chunks of<br />

uninitialized memory to be read (MFSA 2008-45).\nThe reported browser version was: \n<br />

%L<br />

Family Internet Services 1232

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!