(PVS) Signatures - Tenable Network Security

cross-site scripting attacks. (CVE-2012-1965)\n\n - Cross-site scripting attacks are possible
due to an error related to the 'data:' URL and context menus. (CVE-2012-1966)\n\n - An
error exists related to the 'javascript:' URL that can allow scripts to run at elevated
privileges outside the sandbox. (CVE-2012-1967)
Solution: Upgrade to Firefox 14.0 or later.
CVE-2012-1967
Mozilla Thunderbird 13.x < 13 Multiple Vulnerabilities
PVS ID: 6520 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:60045
Description: Synopsis :\n\nThe remote host has a mail client installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Thunderbird is : \n %L
\n\nVersions of Thunderbird 13.x are potentially affected by the following security issues
:\n\n - Several memory safety issues exist, some of which could potentially allow arbitrary
code execution. (CVE-2012-1948, CVE-2012-1949)\n\n - Several memory safety issues
exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952,
CVE-2012-1953, CVE-2012-1954)\n\n - An error related to JavaScript functions
'history.forward' and 'history.back' can allow incorrect URLs to be displayed.
(CVE-2012-1955)\n\n - Cross-site scripting attacks are possible due to an error related to
the '' tag within an RSS '' element. (CVE-2012-1957)\n\n - A
use-after-free error exists related to the method 'nsGlobalWindow::PageHidden'.
(CVE-2012-1958)\n\n - An error exists that can allow 'same-compartment security
wrappers' (SCSW) to be bypassed. (CVE-2012-1959)\n\n - An out-of-bounds read error
exists related to the color management library (QCMS). (CVE-2012-1960)\n\n - The
'X-Frames-Options' header is ignored if it is duplicated. (CVE-2012-1961)\n\n - A memory
corruption error exists related to the method 'JSDependentString::undepend'.
(CVE-2012-1962)\n\n - An error related to the 'Content Security Policy' (CSP)
implementation can allow the disclosure of OAuth 2.0 access tokens and OpenID
credentials. (CVE-2012-1963)\n\n - An error exists related to the 'javascript:' URL that can
allow scripts to run at elevated privileges outside the sandbox. (CVE-2012-1967)
Solution: Upgrade to Thunderbird 14.0 or later.
CVE-2012-1967
Passive Vulnerability Scanner (PVS) Signatures
Mozilla SeaMonkey 2.x < 2.11 Multiple Vulnerabilities
PVS ID: 6521 FAMILY: Web Clients RISK: HIGH NESSUS ID:60046
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of SeaMonkey is : \n %L
\n\nVersions of SeaMonkey 2.x earlier than 2.11 are potentially affected by the following
security issues :\n\n - Several memory safety issues exist, some of which could potentially
allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949)\n\n - Several memory
safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952,
CVE-2012-1953, CVE-2012-1954)\n\n - An error related to JavaScript functions
'history.forward' and 'history.back' can allow incorrect URLs to be displayed.
Family Internet Services 1782