(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 6.0 are potentially affected by the following security issues : \n\n -
If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for
example, a malicious application or extension could be downloaded and executed.
(CVE-2011-2372)\n\n - Unspecified errors exist that can be exploited to corrupt memory.
No additional information is available at this time. (CVE-2011-2995, CVE-2011-2997)\n\n
- A weakness exists when handling the 'Location' header. This can lead to response splitting
attacks when visiting a vulnerable web server. The same fix has been applied to the headers
'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)\n\n - An error exists within
WebGL's ANGLE library. It does not properly check for return values from the
'GrowAtomTable()' function. This vulnerability can be exploited to cause a buffer overflow
by sending a series of requests. Additionally, an unspecified error exists within WebGL that
can be exploited to corrupt memory. (CVE-2011-3002, CVE-2011-3003)\n\n - There is an
error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By
tricking a user into installing a malicious plug-in, an attacker could exploit this issue to
execute arbitrary code. (CVE-2011-3004)\n\n - A use-after-free error exists when parsing
OGG headers. (CVE-2011-3005)\n\n - There is an unspecified error within the YARR
regular expression library that can be exploited to corrupt memory. (CVE-2011-3232)
Solution: Upgrade to Firefox 7.0 or later.
CVE-2011-3232
Mozilla Thunderbird 6 Multiple Vulnerabilities
PVS ID: 6029 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:56336
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Thunderbird is
:%L.\n\nThunderbird 6.0 is potentially affected by multiple vulnerabilities :\n\n - If an
attacker could trick a user into holding down the 'Enter' key, via a malicious game, for
example, a malicious application or extension could be downloaded or executed.
(CVE-2011-2372, CVE-2011-3001)\n\n - Unspecified errors exist that can be exploited to
corrupt memory. No additional information is avialable at this time. (CVE-2011-2995,
CVE-2011-2997)\n\n - A weakness exists when handling the 'Location' header. This can
lead to response splitting attacks when visiting a vulnerable web server. The same fix has
been applied to the headers 'Content-Length' and 'Content-Disposition.
(CVE-2011-3000)\n\n - A use-after-free error exists when parsing OGG headers.
(CVE-2011-3005)\n\n - There is an unspecified error within the YARR regular expression
library that can be exploited to corrupt memory. (CVE-2011-3232)
Solution: Upgrade to Thunderbird 7.0 or later.
CVE-2011-3232
Passive Vulnerability Scanner (PVS) Signatures
Mozilla SeaMonkey 2.x < 2.4.0 Multiple Vulnerabilities
PVS ID: 6030 FAMILY: Web Clients RISK: HIGH NESSUS ID:56337
Family Internet Services 1646