(PVS) Signatures - Tenable Network Security

encoding icon images. (CVE-2012-0447)\n\n - If a user chooses to export their Thunderbird
Sync key the 'Thunderbird Recover Key.html' file is saved with incorrect permissions,
making the file contents potentially readable by other users. Note that this issue only affects
Thunderbird on Linux and Mac OS X systems. (CVE-2012-0450)
Solution: Upgrade to Thunderbird 10.0 or later.
CVE-2012-0450
Mozilla Thunderbird 3.1.x Multiple Vulnerabilities
PVS ID: 6309 FAMILY: Web Clients RISK: HIGH NESSUS ID:57776
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Thunderbird is :
\n %L \n\nVersions of Thunderbird 3.1.x earlier than 3.1.18 are potentially affected by the
following security issues : \n\n - A use-after-free error exists related to removed
nsDOMAttribute child nodes. (CVE-2011-3659)\n\n - The IPv6 literal syntax in web
addresses is not being properly enforced. (CVE-2011-3670)\n\n - Various memory safety
issues exist. (CVE-2012-0442)\n\n - Memory corruption errors exist related to the decoding
of Ogg Vorbis files and processing of malformed XSLT stylesheets. (CVE-2012-0444,
CVE-2012-0449)
Solution: Upgrade to Thunderbird 3.1.18 or later.
CVE-2012-0449
Passive Vulnerability Scanner (PVS) Signatures
Mozilla SeaMonkey 2.x < 2.7.0 Multiple Vulnerabilities
PVS ID: 6310 FAMILY: Web Clients RISK: HIGH NESSUS ID:57772
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of SeaMonkey is : \n
%L \n\nVersions of SeaMonkey 2.x earlier than 2.7.0 are potentially affected by the
following security issues : \n\n - A use-after-free error exists related to removed
nsDOMAttribute child nodes. (CVE-2011-3659)\n\n - Various memory safety issues exist.
(CVE-2012-0442, CVE-2012-0443)\n\n - Memory corruption errors exist related to the
decoding of Ogg Vorbis files and processing of malformed XSLT stylesheets.
(CVE-2012-0444, CVE-2012-0449)\n\n - The HTML5 frame navigation policy can be
violated by allowing an attacker to replace a sub-frame in another domain's document.
(CVE-2012-0445)\n\n - Scripts in frames are able to bypass security restrictions in
XPConnect. This bypass can allow malicious web sites to carry out cross-site scripting
attacks. (CVE-2012-0446)\n\n - An information disclosure issue exists when uninitialized
memory is used as padding when encoding icon images. (CVE-2012-0447)\n\n - If a user
chooses to export their SeaMonkey Sync key the 'SeaMonkey Recover Key.html' file is
saved with incorrect permissions, making the file contents potentially readable by other
users. Note that this issue only affects SeaMonkey on Linux and Mac OS X systems.
(CVE-2012-0450)
Family Internet Services 1723