(PVS) Signatures - Tenable Network Security

than 5.601 are potentially affected by a stack buffer overflow vulnerability due to an error
in the 'in_midi.dll' plugin which improperly serializes timestamps in MIDI file. A specially
crafted MIDI file can cause the application to overwrite the saved base pointer and allows
execution of arbitrary code.
Solution: Upgrade to Winamp 5.601 or later.
CVE Not available
Mozilla Firefox 3.6.x < 3.6.13 Multiple Vulnerabilities
PVS ID: 5727 FAMILY: Web Clients RISK: HIGH NESSUS ID:51121
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Firefox is
:%L.\n\nVersions of Firefox 3.6.x earlier than 3.6.13 are potentially affected by multiple
vulnerabilities :\n\n - Multiple memory corruption issues could lead to arbitrary code
execution. (MFSA 2010-74)\n\n - On the Windows platform, when 'document.write()' is
called witha very long string a buffer voerflow could be triggered. (MFSA 2010-75)\n\n - A
privilege escalation vulnerability exists with 'window.open' and the '' element.
(MFSA 2010-76)\n\n - Arbitrary code execution is possible when using HTML tags inside
a XUL tree. (MFSA 2010-77)\n\n - Downloadable fonts could expose vulnerabilities in the
underlying OS font code. (MFSA 2010-78)\n\n - A Java security bypass vulnerability when
LiveConnect is loaded via a 'data:' URL meta refresh. (MFSA 2010-79)\n\n - A use-after
free error exists with nsDOMAttribute MutationObserver. (MFSA 2010-80)\n\n - An
integer overflow exists in NewIdArray. (MFSA 2010-81)\n\n - It is possible to circumvent
the fix for CVE-2010-0179. (MFSA 2010-82)\n\n - It is possible to spoof SSL in the
location bar using the network error page. (MFSA 2010-83)\n\n - A cross-site scripting
hazard exists in multiple character encodings. (MFSA 2010-84)
Solution: Upgrade to Firefox 3.6.13 or later.
CVE-2010-3777
Mozilla Firefox < 3.5.16 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5728 FAMILY: Web Clients RISK: HIGH NESSUS ID:51120
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors..\n\nFor your information, the observed version of Firefox is
:%L.\n\nVersions of Firefox 3.5.x earlier than 3.5.16 are potentially affected by multiple
vulnerabilities :\n\n - Multiple memory corruption issues could lead to arbitrary code
execution. (MFSA 2010-74)\n\n - On the Windows platform, when 'document.write()' is
called with a very long string a buffer overflow could be triggered. (MFSA 2010-75)\n\n -
A privilege escalation vulnerability exists with 'window.open' and the '' element.
(MFSA 2010-76)\n\n - Arbitrary code execution is possible when using HTML tags inside
a XUL tree. (MFSA 2010-77)\n\n - Downloadable fonts could expose vulnerabilities in the
underlying OS font code. (MFSA 2010-78)\n\n - A Java security bypass vulnerability when
LiveConnect is loaded via a 'data:' URL meta refresh. (MFSA 2010-79)\n\n - A
use-after-free error exists with nsDOMAttribute MutationObserver. (MFSA 2010-80)\n\n -
Family Internet Services 1550