(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of SeaMonkey is : \n %L
\n\nVersions of SeaMonkey earlier than 2.4.0 are potentially affected by multiple
vulnerabilities : \n\n - If an attacker could trick a user into holding down the 'Enter' key, via
a malicious game, for example, a malicious application or extension could be downloaded
and executed. (CVE-2011-2372, CVE-2011-3001)\n\n - Unspecified errors exist that can be
exploited to corrupt memory. No additional information is available at this time.
(CVE-2011-2995, CVE-2011-2997)\n\n - A weakness exists when handling the 'Location'
header. This can be lead to response splitting attacks when visiting a vulnerable web server.
The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'.
(CVE-2011-3000)\n\n - An error exists with WebGL's ANGLE library. It does not properly
check for return values from the 'GrowAtomTable()' function. This vulnerability can be
exploited to cause a buffer overflow by sending a series of requests. Additionally, an
unspecified error exists within WebGL that can be exploited to corrupt memory.
(CVE-2011-3002, CVE-2011-3003)\n\n - There is an error within the JSSubScriptLoader
that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a
malicious plug-in, an attacker could exploit this issue to execute arbitrary code.
(CVE-2011-3004)\n\n - A use-after-free error exists when parsing OGG headers.
(CVE-2011-3005)\n\n - There is an unspecified error within the YARR regular expression
library that can be exploited to corrupt memory. (CVE-2011-3232)
Solution: Upgrade to SeaMonkey 2.4.0 or later.
CVE-2011-3232
Symantec IM Manager < 8.4.18 Multiple Vulnerabilities (SYM11-012)
PVS ID: 6031 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:56378
Description: Synopsis : \n\nThe remote host contains a web application that is vulnerable to multiple
attack vectors.\n\nThe remote host is running Symantec IM Manager, an application for
managing instant messaging traffic. For your information, the observed version of
Symantec IM Manager is : \n %L \n\nVersions of Symantec IM Manager earlier than build
8.4.18 are potentially affected by multiple vulnerabilities : \n\n - An unspecified cross-site
scripting vulnerability. (CVE-2011-0552)\n\n - An unspecified SQL injection vulnerability.
(CVE-2011-0553)\n\n - An unspecified code injection vulnerability. (CVE-2011-0554)
Solution: Upgrade to Symantec IM Manager build 8.4.18 or later.
CVE-2011-0554
Passive Vulnerability Scanner (PVS) Signatures
Google Chrome < 14.0.835.202 Multiple Vulnerabilities
PVS ID: 6032 FAMILY: Web Clients RISK: HIGH NESSUS ID:56391
Description: Synopsis : \n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nFor your information, the observed version of Google Chrome is : \n %L
.\n\nVersions of Google Chrome earlier than 14.0.835.202 are affected by multiple
vulnerabilities : \n\n - A use-after-free issue exists in text line box handling. (Issue
Family Internet Services 1647