(PVS) Signatures - Tenable Network Security

PVS ID: 6517 FAMILY: Mobile Devices RISK: INFO NESSUS ID:Not Available
Description: The remote host is a Mobile ActiveSync client
Solution: N/A
realtimeonly
CVE Not available
VLC Media Player < 2.0.2 Ogg_DecodePacket Function OGG File Handling Overflow
PVS ID: 6518 FAMILY: Web Clients RISK: HIGH NESSUS ID:60049
Description: Synopsis :\n\nThe remote host contains an application that is vulnerable to a buffer
overflow vulnerability\n\nThe remote host contains VLC player, a multi-media application.
For your information, the observed version of VLC is : \n %L .\n\nVersions of VLC media
player earlier than 2.0.2 are potentially affected by a heap-based buffer overflow
vulnerability. An error exists in the function 'Ogg_DecodePacket' in the file
'modules/demux/ogg.c' that does not properly validate input and can allow a heap-based
buffer overflow. Opening a specially crafted file can result in the execution of arbitrary
code. (CVE-2012-3377)
Solution: Upgrade to VLC Media Player version 2.0.2 or later.
CVE-2012-3377
Mozilla Firefox 13.x < 13 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 6519 FAMILY: Web Clients RISK: HIGH NESSUS ID:60043
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 13.x are potentially affected by the following security issues :\n\n -
Several memory safety issues exist, some of which could potentially allow arbitrary code
execution. (CVE-2012-1948, CVE-2012-1949)\n\n - An error related to drag and drop can
allow incorrect URLs to be displayed. (CVE-2012-1950)\n\n - Several memory safety
issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952,
CVE-2012-1953, CVE-2012-1954)\n\n - An error related to JavaScript functions
'history.forward' and 'history.back' can allow incorrect URLs to be displayed.
(CVE-2012-1955)\n\n - Cross-site scripting attacks are possible due to an error related to
the '' tag within an RSS '' element. (CVE-2012-1957)\n\n - A
use-after-free error exists related to the method 'nsGlobalWindow::PageHidden'.
(CVE-2012-1958)\n\n - An error exists that can allow 'same-compartment security
wrappers' (SCSW) to be bypassed. (CVE-2012-1959)\n\n - An out-of-bounds read error
exists related to the color management library (QCMS). (CVE-2012-1960)\n\n - The
'X-Frames-Options' header is ignored if it is duplicated. (CVE-2012-1961)\n\n - A memory
corruption error exists related to the method 'JSDependentString::undepend'.
(CVE-2012-1962)\n\n - An error related to the 'Content Security Policy' (CSP)
implementation can allow the disclosure of OAuth 2.0 access tokens and OpenID
credentials. (CVE-2012-1963)\n\n - An error exists related to the 'feed:' URL that can allow
Family Internet Services 1781