(PVS) Signatures - Tenable Network Security

'NodeIterator' implementation could lead to arbitrary code execution. (MFSA 2010-36)\n\n
An error in the code to store the names and values of plugin parameters could lead to
arbitrary code execution. (MFSA 2010-37)\n\n - The array class used to store CSS values is
affected by an integer overflow vulnerability. (MFSA 2010-39)\n\n - An integer overflow
vulnerability exists in the 'selection' attribute of the XUL tree element. (MFSA
2010-40)\n\n - A buffer overflow exists in Mozilla graphics code could lead to arbitrary
code execution. (MFSA 2010-41)\n\n - It is possible to read and parse resources from other
domains even when the content is not valid javascript leading to cross-domain data
disclosure. (MFSA 2010-42)\n\n - Multiple location bar spoofing vulnerabilities exist.
(MFSA 2010-45)\n\n - It is possible to read data across domains by injecting bogus CSS
selectors into a target site. (MFSA 2010-46)\n\n - Potentially sensitive URL parameters
could be leaked across domains via script errors. (MFSA 2010-47)
Solution: Upgrade to Mozilla Firefox 3.5.11 or later.
CVE-2010-2754
Firefox 3.6.x < 3.6.7 Multiple Vulnerabilities
PVS ID: 5607 FAMILY: Web Clients RISK: HIGH NESSUS ID:47782
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Firefox is %L.\n\nVersions
of Firefox 3.6.x earlier than 3.6.7 are potentially affected by multiple vulnerabilities :\n\n
Multiple memory safety bugs could result in memory corruption, potentially resulting in
arbitrary code execution. (MFSA 2010-34)\n\n - An error in DOM attribute cloning could
result in arbitrary code execution. (MFSA 2010-35)\n\n - An error in Mozilla's
'NodeIterator' implementation could lead to arbitrary code execution. (MFSA 2010-36)\n\n
An error in the code to store the names and values of plugin parameters could lead to
arbitrary code execution. (MFSA 2010-37)\n\n - It may be possible to run arbitrary
JavaScript with chrome privileges using SJOW and fast native function. (MFSA
2010-38)\n\n - The array class used to store CSS values is affected by an integer overflow
vulnerability. (MFSA 2010-39)\n\n - An integer overflow vulnerability exists in the
'selection' attribute of the XUL tree element. (MFSA 2010-40)\n\n - A buffer overflow
exists in Mozilla graphics code could lead to arbitrary code execution. (MFSA
2010-41)\n\n - It is possible to read and parse resources from other domains even when the
content is not valid javascript leading to cross-domain data disclosure. (MFSA
2010-42)\n\n - The canvas element can be used to read data from another site leading to a
same-origin bypass vulnerability. (MFSA 2010-43)\n\n - Characters mapped to U+FFFD in
8 bit encodings cause subsequent characteres to dissapear, potentially contributing to
cross-site scripting issues on certain websites. (MFSA 2010-44)\n\n - Multiple location bar
spoofing vulnerabilities exist. (MFSA 2010-45)\n\n - It is possible to read data across
domains by injecting bogus CSS selectors into a target site. (MFSA 2010-46)\n\n -
Potentially sensitive URL parameters could be leaked across domains via script errors.
(MFSA 2010-47)
Solution: Upgrade to Mozilla Firefox 3.6.7 or later.
CVE-2010-2754
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1506