(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 2.0.0.19, 3.0.5 or higher.
CVE-2008-5513
Firefox < 3.0.5 Multiple Vulnerabilities
PVS ID: 4793 FAMILY: Web Clients RISK: HIGH NESSUS ID:35219
Description: Synopsis : \n\nThe remote Windows host contains a web browser that is affected by
multiple vulnerabilities.\n\nThe installed version of Firefox 3.0 is earlier than 3.0.5. Such
versions are potentially affected by the following security issues : \n\n - There are several
stability bugs in the browser engine that may lead to crashes with evidence of memory
corruption. (MFSA 2008-60)\n\n - XBL bindings can be used to read data from other
domains. (MFSA 2008-61)\n\n - The feed preview still allows for JavaScript privilege
escalation. (MFSA 2008-62)\n\n - Sensitive data may be disclosed in an XHR response
when an XMLHttpRequest is made to a same-origin resource, which 302 redirects to a
resource in a different domain. (MFSA 2008-64)\n\n - A website may be able to access a
limited amount of data from a different domain by loading a same-domain JavaScript URL
which redirects to an off-domain target resource containing data that is not parsable as
JavaScript. (MFSA 2008-65)\n\n - Errors arise when parsing URLs with leading
whitespace and control characters. (MFSA 2008-66)\n\n - An escaped null byte is ignored
by the CSS parser and treated as if it was not present in the CSS input string. (MFSA
2008-67)\n\n - XSS and JavaScript privilege escalation are possible. (MFSA 2008-68)\n\n -
XSS vulnerabilities in SessionStore may allow for violating the browser's same-origin
policy and performing an XSS attack or running arbitrary JavaScript with chrome
privileges. (MFSA 2008-69)\n\n - A denial of service issue when the application handles a
maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length
attribute.\n\nThe reported version of Firefox is: \n %L
Solution: Upgrade to version 3.0.5 or higher.
CVE-2009-2535
SeaMonkey < 1.1.14 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4794 FAMILY: Web Clients RISK: HIGH NESSUS ID:35220
Description: Synopsis : \n\nA web browser on the remote host is affected by multiple
vulnerabilities.\n\nThe installed version of SeaMonkey is earlier than 1.1.14. Such versions
are potentially affected by the following security issues : \n\n - There are several stability
bugs in the browser engine that may lead to crashes with evidence of memory corruption.
(MFSA 2008-60)\n\n - XBL bindings can be used to read data from other domains. (MFSA
2008-61)\n\n - The feed preview still allows for JavaScript privilege escalation. (MFSA
2008-62)\n\n - Sensitive data may be disclosed in an XHR response when an
XMLHttpRequest is made to a same-origin resource, which 302 redirects to a resource in a
different domain. (MFSA 2008-64)\n\n - A website may be able to access a limited amount
of data from a different domain by loading a same-domain JavaScript URL which redirects
to an off-domain target resource containing data that is not parsable as JavaScript. (MFSA
2008-65)\n\n - Errors arise when parsing URLs with leading whitespace and control
characters. (MFSA 2008-66)\n\n - An escaped null byte is ignored by the CSS parser and
treated as if it was not present in the CSS input string. (MFSA 2008-67)\n\n - XSS and
Family Internet Services 1264