(PVS) Signatures - Tenable Network Security

potentially affected by multiple vulnerabilities :\n\n - A weakness could allow a user to
gain unauthorized access to another Bugzilla account.\n\n - A weakness in the Perl CGI.pm
module allows injecting HTTP headers and content to users via several pages.\n\n - It is
possible to insert harmful 'javascript:' or 'data:' URLs into Bugzilla's 'URL' field which in
some cases Buzilla will make clickable.\n\n - Various pages lack protection against
cross-site request forgeries.
Solution: Upgrade to Bugzilla 3.2.10, 3.4.10, 3.6.4 or later.
CVE-2011-0048
OpenOffice < 3.3 Multiple Vulnerabilities
PVS ID: 5745 FAMILY: Generic RISK: HIGH NESSUS ID:51773
Description: Synopsis :\n\nThe remote host has a program that is affected by multiple
vulnerabilities.\n\nFor your information, the observed version of OpenOffice is
%L.\n\nVersions of OpenOffice earlier than 3.3 are potentially affected by several issues
:\n\n - Issues exist relating to PowerPoint document parsing that may lead to arbitrary code
execution. (CVE-2010-2935, CVE-2010-2936)\n\n - A directory traversal vulnerability
exists in zip / jar package extraction. (CVE-2010-3450)\n\n - Issues exist relating to RTF
document processing that may lead to arbitrary code execution. (CVE-2010-3451,
CVE-2010-3452)\n\n - Issues exist relating to Word document processing that may lead to
arbitrary code execution. (CVE-2010-3453, CVE-2010-3454)\n\n - The OpenOffice.org
start script and other shell scripts expand the LD_LIBRARY_PATH in a way that the
current directory might be searched for libraries before /lib and /usr/lib.
(CVE-2010-3689)\n\n - Issues exist in the third party XPDF library relating to PDf
processing that may allow arbitrary code execution. (CVE-2010-3702,
CVE-2010-3704)\n\n - OpenOffice.org includes a version of LIBXML2 that is affected by
multiple vulnerabilities. (CVE-2010-4008, CVE-2010-4494)\n\n - An issue exists with
PNG file processing that may allow arbitrary code execution. (CVE-2010-4253)\n\n - An
issue exists with TGA file processing that may allow arbitrary code execution.
(CVE-2010-4643)
Solution: Upgrade to OpenOffice version 3.3 or later.
CVE-2010-4643
VLC Media Player < 1.1.6 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 5746 FAMILY: Web Clients RISK: HIGH NESSUS ID:51772
Description: Synopsis :\n\nThe remote host contains an application that allows arbitrary code
execution.\n\nThe remote host contains VLC player, a multi-media application. For your
information, the observed version of VLC is %L.\n\nVersions of VLC media player earlier
than 1.1.6 are potentially affected by multiple vulnerabilities :\n\n - An integer overflow
vulnerability exists due to a failure to properly parse the header of a Real Media, which
could then trigger a heap-based buffer overflow. It is not yet known if this issue can be
exploited to execute arbitrary code. (CVE-2010-3907)\n\n - There are two heap corruption
vulnerabilities in the CDG decoders that arise because of a failure to validate indices into
Family Internet Services 1557