(PVS) Signatures - Tenable Network Security

elies on called 'jsvc' contains an error in that it does not drop capabilities after starting and
can allow access to sensitive files owned by the super user. Note that this vulnerability only
affects Linux operating systems and only when the following are true : \n\n - jsvc is
compiled with libpcap.\n\n - The '-user' parameter is used
Solution: Upgrade to Apache Tomcat 7.0.20 or later.
CVE-2011-2729
Mozilla Firefox 5.0 Multiple Vulnerabilities
PVS ID: 6008 FAMILY: Web Clients RISK: HIGH NESSUS ID:55902
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 5 are potentially affected by the following security issues : \n\n - A
dangling pointer vulnerability exists in an SVG text manipulation routine.
(CVE-2011-0084)\n\n - Several memory safety bugs exist in the browser engine that may
permit remote code execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991,
CVE-2011-2992)\n\n - A cross-origin data theft vulnerability exists when using CANVAS
and Windows D2D hardware acceleration. (CVE-2011-2986)\n\n - A heap overflow
vulnerability exists in WebGL's ANGLE library. (CVE-2011-2987)\n\n - A buffer overflow
vulnerability exists in WebGL when using an overly long shader program.
(CVE-2011-2988)\n\n - Two errors exist related to Content Security Policy that can lead to
information disclosure. (CVE-2011-2990)\n\n - An unspecified error exists that can allow
unsigned JavaScript to call into a signed JAR and inherit the signed JAR's permissions and
identity. (CVE-2011-2993)
Solution: Upgrade to Firefox 6.0 or later.
CVE-2011-2993
Passive Vulnerability Scanner (PVS) Signatures
Mozilla Firefox 3.6 < 3.6.20 Multiple Vulnerabilities
PVS ID: 6009 FAMILY: Web Clients RISK: HIGH NESSUS ID:55901
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 3.6 earlier than 3.6.20 are potentially affected by the following
security issues : \n\n - A dangling pointer vulnerability exists in an SVG text manipulation
routine. (CVE-2011-0084)\n\n. -A DOM accounting error exists in the 'appendChild'
JavaScript function that can allow an invalid pointer to be dereferenced.
(CVE-2011-2378)\n\n - An error exists in 'ThinkPadSensor: : Startup' that can allow
malicious DLLs to be loaded. (CVE-2011-2980)\n\n - An error exists in the event
management code that can allow JavaScript to execute in the context of a different website
and possibly in the chrome-privileged context. (CVE-2011-2981)\n\n - Various unspecified
memory safety issues exist. (CVE-2011-2982)\n\n - A cross-domain information disclosure
vulnerability exists if the configuration option 'RegExp.input' is set. (CVE-2011-2983)\n\n -
Family Internet Services 1638