(PVS) Signatures - Tenable Network Security

security bypass vulnerability that can be exploited by an attacker if the victim can be
tricked into setting a new home page by dragging a specially crafted link to the 'home'
button URL, which will set the user's home page to a 'javascript:' URL.
(CVE-2012-0458)\n\n - An information disclosure vulnerability due to an out of bounds
read in SVG filters. (CVE-2012-0456)\n\n - A cross-site scripting vulnerability that can be
triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)\n\n -
'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI
spoofing attacks. (CVE-2012-0460)
Solution: Upgrade to SeaMonkey 2.8 or later.
CVE-2012-0464
VLC Media Player < 2.0.1 Multiple Code Execution Vulnerabilities
PVS ID: 6355 FAMILY: Web Clients RISK: HIGH NESSUS ID:58416
Description: Synopsis :\n\nThe remote host contains an application that is vulnerable to multiple attack
vectors\n\nThe remote host contains VLC player, a multi-media application. For your
information, the observed version of VLC is : \n %L .\n\nVersions of VLC media player
earlier than 2.0.1 are potentially affected by multiple vulnerabilities :\n\n - A stack
overflow exists in MMS support. (CVE-2012-1775)\n\n - Multiple heap overflows exist in
Real RTSP support. (CVE-2012-1776)
Solution: Upgrade to VLC Media Player version 2.0.1 or later.
CVE-2012-1776
Google Chrome < 17.0.963.83 Multiple Vulnerabilities
PVS ID: 6356 FAMILY: Web Clients RISK: HIGH NESSUS ID:58434
Description: Synopsis :\n\nThe remote host contains a web browser that is affected by multiple
vulnerabilities.\n\nFor your information, the observed version of Google Chrome is :\n %L
\n\nVersions of Google Chrome earlier than 17.0.963.83 are potentially affected by the
following vulnerabilities :\n\n - An unspecified integer issue exists in libpng.
(CVE-2011-3045)\n\n - Use-after-free errors exist related to 'first-letter' handling, CSS
cross-fade handling and block splitting. (CVE-2011-3050, CVE_2011-3051,
CVE-2011-3053)\n\n - A memory corruption error exists related to WebGL canvas
handling. (CVE-2011-3052)\n\n - An error exists related to webui privilege isolation.
(CVE-2011-3054)\n\n - Installation of unpacked extensions does not use the application's
native user interface for prompts. (CVE-2011-3055)\n\n - A cross-origin violation is
possible with 'magic iframe'. (CVE-2011-3056)\n\n - The v8 JavaScript engine can allow
invalid reads to take place. (CVE-2011-3057)
Solution: Upgrade to Google Chrome 17.0.963.83 or later.
CVE-2011-3056
E-mail Client Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1739