(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 10.5.6 or higher.
CVE-2008-4824
Opera < 9.63 Multiple Vulnerabilities
PVS ID: 4791 FAMILY: Web Clients RISK: HIGH NESSUS ID:35185
Description: Synopsis : \n\nThe remote host contains a web browser that is affected by several
issues.\n\nThe version of Opera installed on the remote host is earlier than 9.63 and is
reportedly affected by several issues : \n\n - It may be possible to execute arbitrary code on
the remote system by manipulating certain text-area contents. (920)\n\n - It may be possible
to crash the remote browser using certain HTML constructs or inject code under certain
conditions. (921)\n\n - While previewing news feeds, Opera does not correctly block
certain scripted URLs. Such scripts, if not blocked, may be able to subscribe a user to other
arbitrary feeds and view contents of the feeds to which the user is currently subscribed.
(923)\n\n - By displaying content using XSLT as escaped strings, it may be possible for a
website to inject scripted markup. (924)\n\nThe reported version of Opera browser is: \n
%L
Solution: Upgrade to version 9.63 or higher.
CVE Not available
Firefox < 2.0.0.19 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4792 FAMILY: Web Clients RISK: HIGH NESSUS ID:35218
Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox is earlier than 2.0.0.19. Such
versions are potentially affected by the following security issues : \n\n - There are several
stability bugs in the browser engine that may lead to crashes with evidence of memory
corruption. (MFSA 2008-60)\n\n - XBL bindings can be used to read data from other
domains. (MFSA 2008-61)\n\n - The feed preview still allows for JavaScript privilege
escalation. (MFSA 2008-62)\n\n - Sensitive data may be disclosed in an XHR response
when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a
resource in a different domain. (MFSA 2008-64)\n\n - A website may be able to access a
limited amount of data from a different domain by loading a same-domain JavaScript URL
which redirects to an off-domain target resource containing data that is not parsable as
JavaScript. (MFSA 2008-65)\n\n - Errors arise when parsing URLs with leading
whitespace and control characters. (MFSA 2008-66)\n\n - An escaped null byte is ignored
by the CSS parser and treated as if it was not present in the CSS input string. (MFSA
2008-67)\n\n - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)\n\n -
XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin
policy and performing an XSS attack or running arbitrary JavaScript with chrome
privileges. (MFSA 2008-69)\n\nNote that Mozilla is not planning further security / stability
updates for Firefox 2.x.\n\n - A denial of service issue when the application handles a
maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length
attribute.\n\nThe reported version of Firefox is: \n %L
Family Internet Services 1263