(PVS) Signatures - Tenable Network Security

place a lock on a non-native object, leading to a crash and possible code execution. (MFSA
2008-50)\n - 'file: ' URIs are given chrome privileges when opened in the same tab as a
chrome page or privileged 'about: ' page, which could allow an attacker to run arbitrary
JavaScript with chrome privileges. (MFSA 2008-51)\n - There are several stability bugs in
the browser engine that may lead to crashes with evidence of memory corruption. (MFSA
2008-52)\n - The browser's session restore feature can be used to violate the same-origin
policy and run JavaScript in the context of another site. (MFSA 2008-53)\n - There is a
buffer overflow that can be triggered by sending a specially crafted 200 header line in the
HTTP index response. (MFSA 2008-54)\n - Crashes and remote code execution in
nsFrameManager are possible by modifying certain properties of a file input element before
it has finished initializing. (MFSA 2008-55)\n - The same-origin check in
'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)\n - The
'-moz-binding' CSS property can be used to bypass security checks that validate codebase
principals. (MFSA 2008-57)\n - There is an error in the method used to parse the default
namespace in an E4X document caused by quote characters in the namespace not being
properly escaped. (MFSA 2008-58)\nThe reported version of Firefox is: \n %L
Solution: Upgrade to version 3.0.4 or higher.
CVE-2008-5024
SeaMonkey < 1.1.13 Multiple Vulnerabilities
PVS ID: 4753 FAMILY: Web Clients RISK: HIGH NESSUS ID:34768
Description: Synopsis : \n\nA web browser on the remote host is affected by multiple
vulnerabilities.\n\nThe installed version of SeaMonkey is earlier than 1.1.13. Such versions
are potentially affected by the following security issues : \n\n - Locally saved '.url' shortcut
files can be used to read information stored in the local cache. (MFSA 2008-47)\n - By
tampering with the window.__proto__.__proto__ object, one can cause the browser to
place a lock on a non-native object, leading to a crash and possible code execution. (MFSA
2008-50)\n - 'file: ' URIs are given chrome privileges when opened in the same tab as a
chrome page or privileged 'about: ' page, which could allow an attacker to run arbitrary
JavaScript with chrome privileges. (MFSA 2008-51)\n - There are several stability bugs in
the browser engine that may lead to crashes with evidence of memory corruption. (MFSA
2008-52)\n - The browser's session restore feature can be used to violate the same-origin
policy and run JavaScript in the context of another site. (MFSA 2008-53)\n - There is a
buffer overflow that can be triggered by sending a specially crafted 200 header line in the
HTTP index response. (MFSA 2008-54)\n - Crashes and remote code execution in
nsFrameManager are possible by modifying certain properties of a file input element before
it has finished initializing. (MFSA 2008-55)\n - The same-origin check in
'nsXMLHttpRequest: : NotifyEventListeners()' can be bypassed. (MFSA 2008-56)\n - The
'-moz-binding' CSS property can be used to bypass security checks that validate codebase
principals. (MFSA 2008-57)\n - There is an error in the method used to parse the default
namespace in an E4X document caused by quote characters in the namespace not being
properly escaped. (MFSA 2008-58)\nThe reported version of SeaMonkey is: \n %L
Solution: Upgrade to version 1.1.13 or higher.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1250