(PVS) Signatures - Tenable Network Security

A privilege escalation vulnerability exists if web content is registered to handle 'drop'
events and a browser tab is dropped in that element's area. This can allow the web content
to execute with browser chrome privileges. (CVE-2011-2984)
Solution: Upgrade to Firefox 6.0 or later.
CVE-2011-2984
Mozilla Thunderbird 5 Multiple Vulnerabilities
PVS ID: 6010 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:55887
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Thunderbird is
:%L.\n\nVersions of Thunderbird 5.x are potentially affected by multiple vulnerabilities
:\n\n - Several memory safety bugs exist in the browser engine that may permit remote code
execution. (CVE-2011-2985, CVE-2011-2989, CVE-2011-2991, CVE-2011-2992)\n\n - A
dangling pointer vulnerability exists in an SVG text manipulation routine.
(CVE-2011-0084)\n\n - A buffer overflow vulnerability exists in WebGL when using an
overly long shader program. (CVE-2011-2988)\n\n - A heap overflow vulnerability exists
in WebGL's ANGLE library. (CVE-2011-2987)\n\n - A cross-origin data theft vulnerability
exists when using canvas and Windows D2D hardware acceleration. (CVE-2011-2986)
Solution: Upgrade to Thunderbird 6.0 or later.
CVE-2011-2992
Mozilla Thunderbird 3.1 < 3.1.12 Multiple Vulnerabilities
PVS ID: 6011 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:55886
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Thunderbird is
:%L.\n\nVersions of Thunderbird 3.1 earlier than 3.1.12 are potentially affected by multiple
vulnerabilities :\n\n - Several memory safety bugs exist in the browser engine that may
permit remote code execution. (CVE-2011-2982)\n\n - A dangling pointer vulnerability
exists in an SVG text manipulation routine. (CVE-2011-0084)\n\n - A dangling pointer
vulnerability exists in appendChild, which did not correctly account for DOM objects it
operated upon. (CVE-2011-2378)\n\n - A privilege escalation vulnerability in the event
management code could permit JavaScript to be run in the wrong context.
(CVE-2011-2981)\n\n - A privilege escalation vulnerability exists if a web page registered
for drop events and a browser tab element was dropped into the content area.
(CVE-2011-2984)\n\n - A binary planing vulnerability in ThinkPadSensor::Startup could
permit loading a malicious DLL into the running process. (CVE-2011-2980)\n\n - A data
leakage vulnerability triggered when RegExp.input was set could allow data from other
domains to be read. (CVE-2011-2983)<
Solution: Upgrade to Thunderbird 6.0 or later.
CVE-2011-2984
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1639