(PVS) Signatures - Tenable Network Security

Description: Hotmail UserID is: %P
Solution: N/A
realtimeonly
CVE Not available
Mozilla Firefox 3.6.x < 3.6.18 Multiple Vulnerabilities
PVS ID: 5964 FAMILY: Web Clients RISK: HIGH NESSUS ID:55418
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 3.6.x earlier than 3.6.18 are potentially affected by multiple
vulnerabilities : \n\n - Multiple memory safety issues can lead to application crashes and
possibly remote code execution. (CVE-2011-2374, CVE-2011-2376, CVE-2011-2364,
CVE-2011-2365, CVE-2011-2605)\n\n - A use-after-free issue when viewing XUL
documents with scripts disabled could lead to code execution. (CVE-2011-2373)\n\n - A
memory corruption issue due to multipart/x-mixed-replace images could lead to memory
corruption. (CVE-2011-2377)\n\n - When a JavaScript Array object has its length set to an
extremely large value, the iteration of array elements that occurs when its reduceRight
method is called could result in code execution due to an invalid index value being used.
(CVE-211-2371)\n\n - Multiple dangling pointer vulnerabilities could lead to code
execution. (CVE-2011-0083, CVE-2011-2363, CVE-2011-0085)\n\n - An error in the way
cookies are handled could lead to information disclosure. (CVE-2011-2362)
Solution: Upgrade to Firefox 3.6.18 or later.
CVE-2011-2605
Passive Vulnerability Scanner (PVS) Signatures
Mozilla Firefox > 4.0 and < 5.0 Multiple Vulnerabilities
PVS ID: 5965 FAMILY: Web Clients RISK: HIGH NESSUS ID:55419
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox greater than 4.0 and earlier than 5.0 are potentially affected by
multiple vulnerabilities : \n\n - Multiple memory safety issues can lead to application
crashes and possibly remote code execution. (CVE-2011-2374, CVE-2011-2375,
CVE-2011-2605)\n\n - A use-after-free issue when viewing XUL documents with scripts
disabled could lead to code execution. (CVE-2011-2373)\n\n - A memory corruption issue
due to multipart/x-mixed-replace images could lead to memory corruption.
(CVE-2011-2377)\n\n - When a JavaScript Array object has its length set to an extremely
large value, the iteration of array elements that occurs when its reduceRight method is
called could result in code execution due to an invalid index value being used.
(CVE-2011-2371)\n\n - It is possible for an image from a different domain to be loaded
into a WebGL texture which could be used to steal image data from a different site.
(CVE-2011-2366)\n\n - An out-of-bounds read issue and an invalid write issue could cause
Family Internet Services 1623