(PVS) Signatures - Tenable Network Security

compartmental mismatches that can lead potentially exploitable crashes.
(CVE-2013-0746)\n\n - Errors exist related to events in the plugin handler that can allow
same-origin policy bypass. (CVE-2013-0747)\n\n - An error related to the 'toString' method
of XBL objects can lead to address information leakage. (CVE-2013-0748)\n\n - An
unspecified memory corruption issue exists. (CVE-2013-0749, CVE-2013-0769,
CVE-2013-0770)\n\n - A buffer overflow exists related to JavaScript string concatenation.
(CVE-2013-0750)\n\n - An error exists related to multiple XML bindings with SVG
content, contained in XBL files. (CVE-2013-0752)\n\n - A use-after-free error exists
related to 'XMLSerializer' and 'serializeToStream'. (CVE-2013-0753)\n\n - A use-after-free
error exists related to garbage collection and 'ListenManager'. (CVE-2013-0754)\n\n - A
use-after-free error exists related to the 'Vibrate' library and 'domDoc'.
(CVE-2013-0755)\n\n - A use-after-free error exists related to JavaScript 'Proxy' objects.
(CVE-2013-0756)\n\n - 'Chrome Object Wrappers' (COW) can be bypassed by changing
object prototypes and can allow arbitrary code execution. (CVE-2013-0757)\n\n - An error
related to SVG elements and plugins can allow privilege escalation. (CVE-2013-0758)\n\n
- An error exists related to the address bar that can allow URL spoofing attacks.
(CVE-2013-0759)\n\n - An error exists related to SSL and threading that can result in
potentially exploitable crashes. (CVE-2013-0764)\n\n - An error exists related to 'Canvas'
and bad height or width values passed to it from HTML. (CVE-2013-0768)
Solution: Upgrade to SeaMonkey 2.15 or later.
CVE-2013-0770
PHP 5.3.x < 5.3.21 cuRL X.509 Certificate Domain Name Matching MiTM Weakness
PVS ID: 6671 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:63621
Description: Synopsis :\n\nThe remote web server uses a version of PHP that is affected by a
man-in-the-middle attack.\n\nFor your information, the version of PHP installed on the
remote host is :\n %L \n\nPHP versions 5.3.x earlier than 5.3.21 are affected by a weakness
in the cURL extension that call allow SSL spoofing and man-in-the-middle
attacks.\n\nWhen attempting to validate a certificate, the cURL library (libcurl) fails to
verify that a server hostname matches a domain name in an X.509 certificate's 'Subject
Common Name' (CN) or 'SubjectAltName'.\n\nNote that this plugin does not attempt to
verify whether the PHP install has been built with the cURL extention but instead relies
only on PHP's self-reported version number.
Solution: Upgrade to PHP version 5.3.21 or later.
CVE Not available
PHP 5.4.x < 5.4.11 cURL X.509 Certificate Domain Name Matching MiTM Weakness
PVS ID: 6672 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:63622
Family Internet Services 1835