(PVS) Signatures - Tenable Network Security

specially crafted page, these issues may allow an attacker to execute arbitrary code in the
context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459,
CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)\n\n - Ah HTTP
Header security bypass vulnerability that can be leveraged by attackers to bypass certain
security restrictions and conduct cross-site scripting attacks. (CVE-2012-0451)\n\n - A
security bypass vulnerability that can be exploited by an attacker if the victim can be
tricked into setting a new home page by dragging a specially crafted link to the 'home'
button URL, which will set the user's home page to a 'javascript:' URL.
(CVE-2012-0458)\n\n - An information disclosure vulnerability due to an out of bounds
read in SVG filters. (CVE-2012-0456)\n\n - A cross-site scripting vulnerability that can be
triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)\n\n -
'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI
spoofing attacks. (CVE-2012-0460)
Solution: Upgrade to Firefox 10.0.3 ESR or later.
CVE-2012-0464
Mozilla Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities
PVS ID: 6351 FAMILY: Web Clients RISK: HIGH NESSUS ID:58354
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 3.6.x earlier than 3.6.28 are potentially affected by the following
security issues :\n\n - Multiple memory corruption issues. By tricking a user into visiting a
specially crafted page, these issues may allow an attacker to execute arbitrary code in the
context of the affected application. (CVE-2012-0457, CVE-2012-0461, CVE-2012-0463,
CVE-2012-0464)\n\n - A security bypass vulnerability that can be exploited by an attacker
if the victim can be tricked into setting a new home page by dragging a specially crafted
link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL.
(CVE-2012-0458)\n\n - An information disclosure vulnerability due to an out of bounds
read in SVG filters. (CVE-2012-0456)\n\n - A cross-site scripting vulnerability that can be
triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)
Solution: Upgrade to Firefox 3.6.28 or later.
CVE-2012-0464
Passive Vulnerability Scanner (PVS) Signatures
Mozilla Thunderbird 10.x < 10.0.3 Multiple Vulnerabilities
PVS ID: 6352 FAMILY: Web Clients RISK: HIGH NESSUS ID:58355
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 10.x earlier than 10.0.3 are potentially affected by the following
security issues :\n\n - Multiple memory corruption issues. By tricking a user into visiting a
specially crafted page, these issues may allow an attacker to execute arbitrary code in the
context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459,
CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)\n\n - Ah HTTP
Family Internet Services 1737