(PVS) Signatures - Tenable Network Security

CVE-2012-3180
BigFix Client Patch Update
PVS ID: 6612 FAMILY: Web Clients RISK: INFO NESSUS ID:Not Available
Description: The remote host is a BigFix client downloading the following patches from the BigFix
server
Solution: N/A
realtimeonly
CVE Not available
Mozilla SeaMonkey 2.13.x < 2.13.2 Multiple Vulnerabilities
PVS ID: 6613 FAMILY: Web Clients RISK: HIGH NESSUS ID:62747
Description: Synopsis :\n\nThe remote host has a web browser installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of SeaMonkey is : \n %L
\n\nVersions of SeaMonkey 2.13.1 and earlier are potentially affected by the following
security issues :\n\n - The true value of 'window.location' can be shadowed by user content
through the use of the 'valueOf' method, which can be combined with some plugins to
perform cross-site scripting attacks. (CVE-2012-4194)\n\n - The 'CheckURL' function of
'window.location' can be forced to return the wrong calling document and principal,
allowing a cross-site scripting attack. (CVE-2012-4195)\n\n - It is possible to use property
injection by prototype to bypass security wrapper protections on the 'Location' object,
allowing the cross-origin reading of the 'Location' object. (CVE-2012-4196)\n
Solution: Upgrade to SeaMonkey 2.13.2 or later.
CVE-2012-4196
Mozilla Thunderbird 16.x < 16.0.2 Multiple Vulnerabilities
PVS ID: 6614 FAMILY: SMTP Clients
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:62746
Description: Synopsis :\n\nThe remote host has a mail client installed that is vulnerable to multiple
vulnerabilities.\n\nFor your information, the observed version of Thunderbird is : \n %L
\n\nVersions earlier than Thunderbird 16.0.2 are potentially affected by the following
security issues :\n\n - The true value of 'window.location' can be shadowed by user content
through the use of the 'valueOf' method, which can be combined with some plugins to
perform cross-site scripting attacks. (CVE-2012-4194)\n\n - The 'CheckURL' function of
'window.location' can be forced to return the wrong calling document and principal,
allowing a cross-site scripting attack. (CVE-2012-4195)\n\n - It is possible to use property
injection by prototype to bypass security wrapper protections on the 'Location' object,
allowing the cross-origin reading of the 'Location' object. (CVE-2012-4196)\n
Solution: Upgrade to Thunderbird 16.0.2 or later.
Family Internet Services 1814