(PVS) Signatures - Tenable Network Security

CVE-2012-5354
Mozilla Thunderbird 15.x <
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 6604 FAMILY: SMTP Clients RISK: HIGH NESSUS ID:62582
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 16.x are potentially affected by the following security issues :\n\n -
Multiple memory-corruption vulnerabilities in the browser engine that could lead to
arbitrary code execution. (CVE-2012-3982, CVE-2012-3983, CVE-2012-4191)\n\n - A
URI-spoofing vulnerability due to an error when handling the '' dropdown menu.
This issue can be exploited to display arbitrary content while showing the URL of another
site. An attacker can also exploit this issue to cause click jacking attacks. (CVE-2012-3984,
CVE-2012-5354)\n\n - A security-bypass vulnerability exists because it fails to properly
enforce the same-origin policy. Specifically, the error occurs when handling
'document.domain'. An attacker can exploit this issue to execute cross-site scripting attacks.
(CVE-2012-3985)\n\n - Multiple security bypass vulnerabilities exists in the
'nsDOMWindowUtils' methods. (CVE-2012-3986)\n\n - A cross-site scripting vulnerability
exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue
occurs when transitioning into Reader Mode. Note: This issue affects only Firefox for
Android. CVE-2012-3987)\n\n - A use-after-free issue occurs when invoking full screen
mode and navigating backwards in history. (CVE-2012-3988)\n\n - A denial-of-service
vulnerability that occurs due to invalid cast error. Specifically, this issue occurs when using
the instanceof operator on certain JavaScript objects. (CVE-2012-3989)\n\n - A
security-bypass vulnerability exists because it fails to properly enforce the cross-origin
policy. Specifically, this issue occurs when invoking the 'GetProperty()' function through
JSAPI. An attacker can exploit this issue to perform arbitrary code-execution.
(CVE-2012-3991)\n\n - A cross-site scripting vulnerability exists because it fails to
sufficiently sanitize user-supplied input. Specifically, this issue occurs when handling the
'location' property through binary plugins. (CVE-2012-3994)\n\n - A security-bypass
vulnerability exists because of an error in the Chrome Object Wrapper (COW) when
handling the 'InstallTrigger' object. An attacker can exploit this issue to access certain
privileged functions and properties. (CVE-2012-4184, CVE-2012-3993)\n\n - An arbitrary
code-execution occurs when handling the 'location.hash' property and history navigation.
(CVE-2012-3992)\n\n - An out-of-bounds read error affects the
'IsCSSWordSpacingSpace()' function. (CVE-2012-3995)\n\n - A use-after-free error affects
the 'nsHTMLCSSUtils::CreateCSSPropertyTxn()' function. (CVE-2012-4179)\n\n - A
heap-based buffer-overflow vulnerability exists in the
'nsHTMLEditor::IsPrevCharInNodeWhitespace()' function. (CVE-2012-4180)\n\n - A
use-after-free error affects the 'nsSMILAnimationController::DoSample()' function.
(CVE-2012-4181)\n\n - A use-after-free error affects the 'nsTextEditRules::WillInsert()'
function. (CVE-2012-4182)\n\n - A use-after-free error affects the
'DOMSVGTests::GetRequiredFeatures()' function. (CVE-2012-4183)\n\n - A
buffer-overflow vulnerability exists in the 'nsCharTraits::length()' function.
(CVE-2012-4185)\n\n - A heap-based buffer-overflow vulnerability exists in the
'nsWaveReader::DecodeAudioData()" function. (CVE-2012-4186)\n\n - A
memory-corruption vulnerability exists in the 'insPos' property. (CVE-2012-4187)\n\n - A
heap-based buffer-overflow exists in the 'Convolve3x3()' function. (CVE-2012-4188)\n\n -
A use-after-free error affects the 'nsIContent::GetNameSpaceID()' function.
(CVE-2012-3990)\n\n - A cross domain information disclosure exists due to improper
Family Internet Services 1811