Vulnerabilities > CVE-2012-0474 - Cross-Site Scripting vulnerability in Mozilla products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
mozilla
CWE-79
nessus

Summary

Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."

Vulnerable Configurations

Part Description Count
Application
Mozilla
165

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_120.NASL
    descriptionThe installed version of Thunderbird is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that could lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58900
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58900
    titleMozilla Thunderbird < 12.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58900);
      script_version("1.15");
      script_cvs_date("Date: 2018/07/17 12:00:07");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0472",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53218,
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Mozilla Thunderbird < 12.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Windows host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Thunderbird is earlier than 12.0 and thus, 
    is potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        could lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        that could lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' that could lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists that could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists related to font rendering with 'cairo-
        dwrite' that could cause memory corruption leading to 
        crashes and potentially code execution. (CVE-2012-0472)
    
      - An error exists in 'WebGLBuffer' that could lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error could allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports could allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets that could lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that could allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-25/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Thunderbird 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Thunderbird/Version");
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport");
    
    installs = get_kb_list("SMB/Mozilla/Thunderbird/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Thunderbird");
    
    mozilla_check_version(installs:installs, product:'thunderbird', esr:FALSE, fix:'12.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_12_0.NASL
    descriptionThe installed version of Firefox is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58894
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58894
    titleFirefox < 12.0 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58894);
      script_version("1.15");
      script_cvs_date("Date: 2018/07/16 12:48:31");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Firefox < 12.0 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Mac OS X host contains a web browser that is affected by
    multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Firefox is earlier than 12.0 and thus, is
    potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        can lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        which can lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' which can lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists which could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists in 'WebGLBuffer' that can lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error can allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports can allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets which can lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that can allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Firefox 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_firefox_installed.nasl");
      script_require_keys("MacOSX/Firefox/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Firefox";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');
    
    mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'12.0', skippat:'^10\\.0\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-3.NASL
    descriptionUSN-1430-1 fixed vulnerabilities in Firefox. This update provides the corresponding fixes for Thunderbird. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id59015
    published2012-05-07
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59015
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1430-3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1430-3. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59015);
      script_version("1.14");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
      script_bugtraq_id(46785, 53219, 53220, 53221, 53222, 53223, 53224, 53225, 53227, 53228, 53229, 53230, 53231);
      script_xref(name:"USN", value:"1430-3");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1430-3)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-1430-1 fixed vulnerabilities in Firefox. This update provides the
    corresponding fixes for Thunderbird.
    
    Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong,
    Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli
    Pettay discovered memory safety issues affecting Firefox. If the user
    were tricked into opening a specially crafted page, an attacker could
    exploit these to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Firefox. (CVE-2012-0467, CVE-2012-0468)
    
    Aki Helin discovered a use-after-free vulnerability in
    XPConnect. An attacker could potentially exploit this to
    execute arbitrary code with the privileges of the user
    invoking Firefox. (CVE-2012-0469)
    
    Atte Kettunen discovered that invalid frees cause heap
    corruption in gfxImageSurface. If a user were tricked into
    opening a malicious Scalable Vector Graphics (SVG) image
    file, an attacker could exploit these to cause a denial of
    service via application crash, or potentially execute code
    with the privileges of the user invoking Firefox.
    (CVE-2012-0470)
    
    Anne van Kesteren discovered a potential cross-site
    scripting (XSS) vulnerability via multibyte content
    processing errors. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0471)
    
    Matias Juntunen discovered a vulnerability in Firefox's
    WebGL implementation that potentially allows the reading of
    illegal video memory. An attacker could possibly exploit
    this to cause a denial of service via application crash.
    (CVE-2012-0473)
    
    Jordi Chancel, Eddy Bordi, and Chris McGowen discovered that
    Firefox allowed the address bar to display a different
    website than the one the user was visiting. This could
    potentially leave the user vulnerable to cross-site
    scripting (XSS) attacks. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0474)
    
    Simone Fabiano discovered that Firefox did not always send
    correct origin headers when connecting to an IPv6 websites.
    An attacker could potentially use this to bypass intended
    access controls. (CVE-2012-0475)
    
    Masato Kinugawa discovered that cross-site scripting (XSS)
    injection is possible during the decoding of ISO-2022-KR and
    ISO-2022-CN character sets. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0477)
    
    It was discovered that certain images rendered using WebGL
    could cause Firefox to crash. If the user were tricked into
    opening a specially crafted page, an attacker could exploit
    this to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2012-0478)
    
    Mateusz Jurczyk discovered an off-by-one error in the
    OpenType Sanitizer. If the user were tricked into opening a
    specially crafted page, an attacker could exploit this to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2011-3062)
    
    Daniel Divricean discovered a defect in the error handling
    of JavaScript errors can potentially leak the file names and
    location of JavaScript files on a server. This could
    potentially lead to inadvertent information disclosure and a
    vector for further attacks. (CVE-2011-1187)
    
    Jeroen van der Gun discovered a vulnerability in the way
    Firefox handled RSS and Atom feeds. Invalid RSS or ATOM
    content loaded over HTTPS caused the location bar to be
    updated with the address of this content, while the main
    window still displays the previously loaded content. An
    attacker could potentially exploit this vulnerability to
    conduct phishing attacks. (CVE-2012-0479).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1430-3/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected thunderbird package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/07");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201204-120426.NASL
    descriptionMozilla Firefox was updated to the 10.0.4 ESR release to fix various bugs and security issues. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-20) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Christian Holler a reported memory safety and security problem affecting Firefox 11. (CVE-2012-0468) Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay reported memory safety problems and crashes that affect Firefox ESR and Firefox 11. (CVE-2012-0467) - Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. When it is destroyed, this causes a use-after-free, which is potentially exploitable. (MFSA 2012-22 / CVE-2012-0469) - Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found a heap corruption in gfxImageSurface which allows for invalid frees and possible remote code execution. This happens due to float error, resulting from graphics values being passed through different number systems. (MFSA 2012-23 / CVE-2012-0470) - Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages. (MFSA 2012-24 / CVE-2012-0471) - Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems. (MFSA 2012-25 / CVE-2012-0472) - Mozilla community member Matias Juntunen discovered an error in WebGLBuffer where FindMaxElementInSubArray receives wrong template arguments from FindMaxUshortElement. This bug causes maximum index to be computed incorrectly within WebGL.drawElements, allowing the reading of illegal video memory. (MFSA 2012-26 / CVE-2012-0473) - Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is loaded in the window in the addressbar. Security researcher Chris McGowen independently reported the same flaw, and further demonstrated that this could lead to loading scripts from the attacker
    last seen2020-06-05
    modified2012-05-03
    plugin id58973
    published2012-05-03
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58973
    titleSuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6224)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58973);
      script_version("1.10");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0472", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
    
      script_name(english:"SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6224)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox was updated to the 10.0.4 ESR release to fix various
    bugs and security issues.
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-20)
    
        In general these flaws cannot be exploited through email
        in the Thunderbird and SeaMonkey products because
        scripting is disabled, but are potentially a risk in
        browser or browser-like contexts in those products.
    
        Christian Holler a reported memory safety and security
        problem affecting Firefox 11. (CVE-2012-0468)
    
        Bob Clary, Christian Holler, Brian Hackett, Bobby
        Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse
        Ruderman, Julian Seward, and Olli Pettay reported memory
        safety problems and crashes that affect Firefox ESR and
        Firefox 11. (CVE-2012-0467)
    
      - Using the Address Sanitizer tool, security researcher
        Aki Helin from OUSPG found that IDBKeyRange of indexedDB
        remains in the XPConnect hashtable instead of being
        unlinked before being destroyed. When it is destroyed,
        this causes a use-after-free, which is potentially
        exploitable. (MFSA 2012-22 / CVE-2012-0469)
    
      - Using the Address Sanitizer tool, security researcher
        Atte Kettunen from OUSPG found a heap corruption in
        gfxImageSurface which allows for invalid frees and
        possible remote code execution. This happens due to
        float error, resulting from graphics values being passed
        through different number systems. (MFSA 2012-23 /
        CVE-2012-0470)
    
      - Anne van Kesteren of Opera Software found a multi-octet
        encoding issue where certain octets will destroy the
        following octets in the processing of some multibyte
        character sets. This can leave users vulnerable to
        cross-site scripting (XSS) attacks on maliciously
        crafted web pages. (MFSA 2012-24 / CVE-2012-0471)
    
      - Security research firm iDefense reported that researcher
        wushi of team509 discovered a memory corruption on
        Windows Vista and Windows 7 systems with hardware
        acceleration disabled or using incompatible video
        drivers. This is created by using cairo-dwrite to
        attempt to render fonts on an unsupported code path.
        This corruption causes a potentially exploitable crash
        on affected systems. (MFSA 2012-25 / CVE-2012-0472)
    
      - Mozilla community member Matias Juntunen discovered an
        error in WebGLBuffer where FindMaxElementInSubArray
        receives wrong template arguments from
        FindMaxUshortElement. This bug causes maximum index to
        be computed incorrectly within WebGL.drawElements,
        allowing the reading of illegal video memory. (MFSA
        2012-26 / CVE-2012-0473)
    
      - Security researchers Jordi Chancel and Eddy Bordi
        reported that they could short-circuit page loads to
        show the address of a different site than what is loaded
        in the window in the addressbar. Security researcher
        Chris McGowen independently reported the same flaw, and
        further demonstrated that this could lead to loading
        scripts from the attacker's site, leaving users
        vulnerable to cross-site scripting (XSS) attacks. (MFSA
        2012-27 / CVE-2012-0474)
    
      - Security researcher Simone Fabiano reported that if a
        cross-site XHR or WebSocket is opened on a web server on
        a non-standard port for web traffic while using an IPv6
        address, the browser will send an ambiguous origin
        headers if the IPv6 address contains at least 2
        consecutive 16-bit fields of zeroes. If there is an
        origin access control list that uses IPv6 literals, this
        issue could be used to bypass these access controls on
        the server. (MFSA 2012-28 / CVE-2012-0475)
    
      - Security researcher Masato Kinugawa found that during
        the decoding of ISO-2022-KR and ISO-2022-CN character
        sets, characters near 1024 bytes are treated
        incorrectly, either doubling or deleting bytes. On
        certain pages it might be possible for an attacker to
        pad the output of the page such that these errors fall
        in the right place to affect the structure of the page,
        allowing for cross-site script (XSS) injection. (MFSA
        2012-29 / CVE-2012-0477)
    
      - Mozilla community member Ms2ger found an image rendering
        issue with WebGL when texImage2D uses use
        JSVAL_TO_OBJECT on arbitrary objects. This can lead to a
        crash on a maliciously crafted web page. While there is
        no evidence that this is directly exploitable, there is
        a possibility of remote code execution. (MFSA 2012-30 /
        CVE-2012-0478)
    
      - Mateusz Jurczyk of the Google Security Team discovered
        an off-by-one error in the OpenType Sanitizer using the
        Address Sanitizer tool. This can lead to an
        out-of-bounds read and execution of an uninitialized
        function pointer during parsing and possible remote code
        execution. (MFSA 2012-31 / CVE-2011-3062)
    
      - Security researcher Daniel Divricean reported that a
        defect in the error handling of JavaScript errors can
        leak the file names and location of JavaScript files on
        a server, leading to inadvertent information disclosure
        and a vector for further attacks. (MFSA 2012-32 /
        CVE-2011-1187)
    
      - Security researcher Jeroen van der Gun reported that if
        RSS or Atom XML invalid content is loaded over HTTPS,
        the addressbar updates to display the new location of
        the loaded resource, including SSL indicators, while the
        main window still displays the previously loaded
        content. This allows for phishing attacks where a
        malicious page can spoof the identify of another
        seemingly secure site. (MFSA 2012-33 / CVE-2012-0479)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-20.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-22.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-23.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-24.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-25.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-26.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-27.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-28.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-29.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-30.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-31.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-32.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-33.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=758408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1187.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-3062.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0467.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0468.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0469.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0470.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0471.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0472.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0473.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0474.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0475.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0477.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0478.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0479.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6224.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-254.NASL
    descriptionChanges in xulrunner : - update to 12.0 (bnc#758408) - rebased patches - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - added mozilla-libnotify.patch to allow fallback from libnotify to xul based events if no notification-daemon is running - gcc 4.7 fixes - mozilla-gcc47.patch - disabled crashreporter temporarily for Factory Changes in MozillaFirefox : - update to Firefox 12.0 (bnc#758408) - rebased patches - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - added mozilla-libnotify.patch to allow fallback from libnotify to xul based events if no notification-daemon is running - gcc 4.7 fixes - mozilla-gcc47.patch - disabled crashreporter temporarily for Factory - recommend libcanberra0 for proper sound notifications Changes in MozillaThunderbird : - update to Thunderbird 12.0 (bnc#758408) - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - update Enigmail to 1.4.1 - added mozilla-revert_621446.patch - added mozilla-libnotify.patch (bmo#737646) - added mailnew-showalert.patch (bmo#739146) - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7 - disabled crashreporter temporarily for Factory (gcc 4.7 issue) Changes in seamonkey : - update to SeaMonkey 2.9 (bnc#758408) - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - update to 2.9b4 - added mozilla-sle11.patch and add exceptions to be able to build for SLE11/11.1 - exclude broken gl locale from build - fixed build on 11.2-x86_64 by adding mozilla-revert_621446.patch - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7
    last seen2020-06-05
    modified2014-06-13
    plugin id74612
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74612
    titleopenSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-254.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74612);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-2985", "CVE-2011-2986", "CVE-2011-2987", "CVE-2011-2988", "CVE-2011-2989", "CVE-2011-2991", "CVE-2011-2992", "CVE-2011-3005", "CVE-2011-3062", "CVE-2011-3232", "CVE-2011-3651", "CVE-2011-3652", "CVE-2011-3654", "CVE-2011-3655", "CVE-2011-3658", "CVE-2011-3660", "CVE-2011-3661", "CVE-2011-3663", "CVE-2012-0445", "CVE-2012-0446", "CVE-2012-0447", "CVE-2012-0451", "CVE-2012-0452", "CVE-2012-0459", "CVE-2012-0460", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0472", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
    
      script_name(english:"openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)");
      script_summary(english:"Check for the openSUSE-2012-254 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Changes in xulrunner :
    
      - update to 12.0 (bnc#758408)
    
      - rebased patches
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - added mozilla-libnotify.patch to allow fallback from
        libnotify to xul based events if no notification-daemon
        is running
    
      - gcc 4.7 fixes
    
      - mozilla-gcc47.patch
    
      - disabled crashreporter temporarily for Factory
    
    Changes in MozillaFirefox :
    
      - update to Firefox 12.0 (bnc#758408)
    
      - rebased patches
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - added mozilla-libnotify.patch to allow fallback from
        libnotify to xul based events if no notification-daemon
        is running
    
      - gcc 4.7 fixes
    
      - mozilla-gcc47.patch
    
      - disabled crashreporter temporarily for Factory
    
      - recommend libcanberra0 for proper sound notifications
    
    Changes in MozillaThunderbird :
    
      - update to Thunderbird 12.0 (bnc#758408)
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - update Enigmail to 1.4.1
    
      - added mozilla-revert_621446.patch
    
      - added mozilla-libnotify.patch (bmo#737646)
    
      - added mailnew-showalert.patch (bmo#739146)
    
      - added mozilla-gcc47.patch and mailnews-literals.patch to
        fix compilation issues with recent gcc 4.7
    
      - disabled crashreporter temporarily for Factory (gcc 4.7
        issue)
    
    Changes in seamonkey :
    
      - update to SeaMonkey 2.9 (bnc#758408)
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - update to 2.9b4
    
      - added mozilla-sle11.patch and add exceptions to be able
        to build for SLE11/11.1
    
      - exclude broken gl locale from build
    
      - fixed build on 11.2-x86_64 by adding
        mozilla-revert_621446.patch
    
      - added mozilla-gcc47.patch and mailnews-literals.patch to
        fix compilation issues with recent gcc 4.7"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=712224"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=714931"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=720264"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=726758"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=728520"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=732898"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=733002"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=744275"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=746616"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=747328"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=749440"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=750044"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=755060"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=758408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-04/msg00066.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MozillaFirefox / MozillaThunderbird / seamonkey / etc packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox nsSVGValue Out-of-Bounds Access Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-venkman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-branding-upstream-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-buildsymbols-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-debugsource-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-devel-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-translations-common-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-translations-other-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-buildsymbols-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-debuginfo-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-debugsource-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-devel-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-translations-common-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-translations-other-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"enigmail-1.4.1+12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"enigmail-debuginfo-1.4.1+12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"mozilla-js-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"mozilla-js-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-debuginfo-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-debugsource-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-dom-inspector-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-irc-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-translations-common-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-translations-other-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-venkman-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-buildsymbols-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-debugsource-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-devel-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-devel-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"mozilla-js-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"mozilla-js-debuginfo-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"xulrunner-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"xulrunner-debuginfo-32bit-12.0-2.26.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox / MozillaFirefox-branding-upstream / etc");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_10_0_4.NASL
    descriptionThe installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58895
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58895
    titleThunderbird 10.0.x < 10.0.4 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58895);
      script_version("1.14");
      script_cvs_date("Date: 2018/07/16 12:48:31");
    
      script_cve_id(
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53219,
        53220,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53231
      );
    
      script_name(english:"Thunderbird 10.0.x < 10.0.4 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Mac OS X host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Thunderbird 10.0.x is potentially affected 
    by the following security issues :
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        which can lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' which can lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists which can allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists in 'WebGLBuffer' that can lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error can allow URL bar spoofing.
        (CVE-2012-0474)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets which can lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that can allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
     
      script_set_attribute(
        attribute:"solution",
        value:"Upgrade to Thunderbird 10.0.4 ESR or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_thunderbird_installed.nasl");
      script_require_keys("MacOSX/Thunderbird/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Thunderbird";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    mozilla_check_version(product:'thunderbird', version:version, path:path, fix:'10.0.4', skippat:'^3\\.6\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-0516.NASL
    descriptionAn updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in Sanitiser for OpenType (OTS), used by Thunderbird to help prevent potential exploits in malformed OpenType fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2011-3062) Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) Content containing a malicious Scalable Vector Graphics (SVG) image file could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0470) A flaw was found in the way Thunderbird used its embedded Cairo library to render certain fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0472) A flaw was found in the way Thunderbird rendered certain images using WebGL. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious content could cause Thunderbird to run JavaScript code with the permissions of different content. (CVE-2012-0471) A flaw was found in the way Thunderbird rendered certain graphics using WebGL. Malicious content could cause Thunderbird to crash. (CVE-2012-0473) A flaw in the built-in feed reader in Thunderbird allowed the Website field to display the address of different content than the content the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-05-31
    modified2012-04-25
    plugin id58868
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58868
    titleRHEL 5 / 6 : thunderbird (RHSA-2012:0516)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_120.NASL
    descriptionThe installed version of Firefox is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that could lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58898
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58898
    titleFirefox < 12.0 Multiple Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-2.NASL
    descriptionUSN-1430-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the latest Firefox. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id58923
    published2012-04-30
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58923
    titleUbuntu 10.04 LTS / 11.04 / 11.10 : ubufox update (USN-1430-2)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_12_0.NASL
    descriptionThe installed version of Thunderbird is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58896
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58896
    titleThunderbird < 12.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-0515.NASL
    descriptionUpdated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in Sanitiser for OpenType (OTS), used by Firefox to help prevent potential exploits in malformed OpenType fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3062) A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0470) A flaw was found in the way Firefox used its embedded Cairo library to render certain fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0472) A flaw was found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website. (CVE-2012-0471) A flaw was found in the way Firefox rendered certain graphics using WebGL. A web page containing malicious content could cause Firefox to crash. (CVE-2012-0473) A flaw in Firefox allowed the address bar to display a different website than the one the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-06-01
    modified2020-06-02
    plugin id58850
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58850
    titleCentOS 5 / 6 : firefox (CESA-2012:0515)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FIREFOX10-201205-8154.NASL
    descriptionMozillaFirefox was updated to the 10.0.4 ESR release to fix various bugs and security issues. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-20) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. o Christian Holler a reported memory safety and security problem affecting Firefox 11. (CVE-2012-0468) o Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay reported memory safety problems and crashes that affect Firefox ESR and Firefox 11. (CVE-2012-0467) - Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. When it is destroyed, this causes a use-after-free, which is potentially exploitable. (MFSA 2012-22 / CVE-2012-0469) - Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found a heap corruption in gfxImageSurface which allows for invalid frees and possible remote code execution. This happens due to float error, resulting from graphics values being passed through different number systems. (MFSA 2012-23 / CVE-2012-0470) - Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages. (MFSA 2012-24 / CVE-2012-0471) - Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems. (MFSA 2012-25 / CVE-2012-0472) - Mozilla community member Matias Juntunen discovered an error in WebGLBuffer where FindMaxElementInSubArray receives wrong template arguments from FindMaxUshortElement. This bug causes maximum index to be computed incorrectly within WebGL.drawElements, allowing the reading of illegal video memory. (MFSA 2012-26 / CVE-2012-0473) - Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is loaded in the window in the addressbar. Security researcher Chris McGowen independently reported the same flaw, and further demonstrated that this could lead to loading scripts from the attacker
    last seen2020-06-05
    modified2012-06-04
    plugin id59354
    published2012-06-04
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59354
    titleSuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 8154)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_1004.NASL
    descriptionThe installed version of Firefox 10.0.x is potentially affected by the following security issues : - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58897
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58897
    titleFirefox 10.0.x < 10.0.4 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_1004.NASL
    descriptionThe installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58899
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58899
    titleMozilla Thunderbird 10.0.x < 10.0.4 Multiple Vulnerabilities
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120424_THUNDERBIRD_ON_SL5_X.NASL
    descriptionMozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in Sanitiser for OpenType (OTS), used by Thunderbird to help prevent potential exploits in malformed OpenType fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2011-3062) Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) Content containing a malicious Scalable Vector Graphics (SVG) image file could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0470) A flaw was found in the way Thunderbird used its embedded Cairo library to render certain fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0472) A flaw was found in the way Thunderbird rendered certain images using WebGL. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious content could cause Thunderbird to run JavaScript code with the permissions of different content. (CVE-2012-0471) A flaw was found in the way Thunderbird rendered certain graphics using WebGL. Malicious content could cause Thunderbird to crash. (CVE-2012-0473) A flaw in the built-in feed reader in Thunderbird allowed the Website field to display the address of different content than the content the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-03-18
    modified2012-08-01
    plugin id61306
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61306
    titleScientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120424)
  • NASL familyWindows
    NASL idSEAMONKEY_29.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.9.0. Such versions are potentially affected by the following security issues : - An error exists with the handling of JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58901
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58901
    titleSeaMonkey < 2.9.0 Multiple Vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-0516.NASL
    descriptionFrom Red Hat Security Advisory 2012:0516 : An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in Sanitiser for OpenType (OTS), used by Thunderbird to help prevent potential exploits in malformed OpenType fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2011-3062) Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) Content containing a malicious Scalable Vector Graphics (SVG) image file could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0470) A flaw was found in the way Thunderbird used its embedded Cairo library to render certain fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0472) A flaw was found in the way Thunderbird rendered certain images using WebGL. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious content could cause Thunderbird to run JavaScript code with the permissions of different content. (CVE-2012-0471) A flaw was found in the way Thunderbird rendered certain graphics using WebGL. Malicious content could cause Thunderbird to crash. (CVE-2012-0473) A flaw in the built-in feed reader in Thunderbird allowed the Website field to display the address of different content than the content the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-05-31
    modified2013-07-12
    plugin id68518
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68518
    titleOracle Linux 6 : thunderbird (ELSA-2012-0516)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_THUNDERBIRD_20120814.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file. (CVE-2011-3062) - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2012-0467) - The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly execute arbitrary code via vectors related to jsval.h and the js::array_shift function. (CVE-2012-0468) - Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::T race function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data. (CVE-2012-0469) - Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (invalid gfxImageSurface free operation) or possibly execute arbitrary code by leveraging the use of
    last seen2020-06-01
    modified2020-06-02
    plugin id80786
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80786
    titleOracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird5)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_380E8C568E3211E195804061862B8C22.NASL
    descriptionThe Mozilla Project reports : MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4) MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9 MFSA 2012-22 use-after-free in IDBKeyRange MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface MFSA 2012-24 Potential XSS via multibyte content processing errors MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error MFSA 2012-27 Page load short-circuit can lead to XSS MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues MFSA 2012-30 Crash with WebGL content using textImage2D MFSA 2012-31 Off-by-one error in OpenType Sanitizer MFSA 2012-32 HTTP Redirections and remote content can be read by JavaScript errors MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds
    last seen2020-06-01
    modified2020-06-02
    plugin id58864
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58864
    titleFreeBSD : mozilla -- multiple vulnerabilities (380e8c56-8e32-11e1-9580-4061862b8c22)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-066.NASL
    descriptionSecurity issues were identified and fixed in mozilla firefox and thunderbird : Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-0468, CVE-2012-0467). Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. When it is destroyed, this causes a use-after-free, which is potentially exploitable (CVE-2012-0469). Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found a heap corruption in gfxImageSurface which allows for invalid frees and possible remote code execution. This happens due to float error, resulting from graphics values being passed through different number systems (CVE-2012-0470). Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages (CVE-2012-0471). Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems (CVE-2012-0472). Mozilla community member Matias Juntunen discovered an error in WebGLBuffer where FindMaxElementInSubArray receives wrong template arguments from FindMaxUshortElement. This bug causes maximum index to be computed incorrectly within WebGL.drawElements, allowing the reading of illegal video memory (CVE-2012-0473). Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is loaded in the window in the addressbar. Security researcher Chris McGowen independently reported the same flaw, and further demonstrated that this could lead to loading scripts from the attacker
    last seen2020-06-01
    modified2020-06-02
    plugin id58921
    published2012-04-30
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58921
    titleMandriva Linux Security Advisory : mozilla (MDVSA-2012:066)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-1.NASL
    descriptionBob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id58922
    published2012-04-30
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58922
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1430-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120424_FIREFOX_ON_SL5_X.NASL
    descriptionMozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in Sanitiser for OpenType (OTS), used by Firefox to help prevent potential exploits in malformed OpenType fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3062) A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0470) A flaw was found in the way Firefox used its embedded Cairo library to render certain fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0472) A flaw was found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website. (CVE-2012-0471) A flaw was found in the way Firefox rendered certain graphics using WebGL. A web page containing malicious content could cause Firefox to crash. (CVE-2012-0473) A flaw in Firefox allowed the address bar to display a different website than the one the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-03-18
    modified2012-08-01
    plugin id61304
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61304
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120424)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-0516.NASL
    descriptionAn updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in Sanitiser for OpenType (OTS), used by Thunderbird to help prevent potential exploits in malformed OpenType fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2011-3062) Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) Content containing a malicious Scalable Vector Graphics (SVG) image file could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0470) A flaw was found in the way Thunderbird used its embedded Cairo library to render certain fonts. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0472) A flaw was found in the way Thunderbird rendered certain images using WebGL. Malicious content could cause Thunderbird to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious content could cause Thunderbird to run JavaScript code with the permissions of different content. (CVE-2012-0471) A flaw was found in the way Thunderbird rendered certain graphics using WebGL. Malicious content could cause Thunderbird to crash. (CVE-2012-0473) A flaw in the built-in feed reader in Thunderbird allowed the Website field to display the address of different content than the content the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-05-31
    modified2012-04-25
    plugin id58851
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58851
    titleCentOS 5 / 6 : firefox / thunderbird (CESA-2012:0516)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_FIREFOX_20120918.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file. (CVE-2011-3062) - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2012-0467) - The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly execute arbitrary code via vectors related to jsval.h and the js::array_shift function. (CVE-2012-0468) - Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::T race function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data. (CVE-2012-0469) - Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (invalid gfxImageSurface free operation) or possibly execute arbitrary code by leveraging the use of
    last seen2020-06-01
    modified2020-06-02
    plugin id80607
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/80607
    titleOracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_in_firefox_web1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_10_0_4.NASL
    descriptionThe installed version of Firefox is earlier than 10.0.4 and thus, is potentially affected by the following security issues : - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58893
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58893
    titleFirefox < 10.0.4 Multiple Vulnerabilities (Mac OS X)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-0515.NASL
    descriptionFrom Red Hat Security Advisory 2012:0515 : Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in Sanitiser for OpenType (OTS), used by Firefox to help prevent potential exploits in malformed OpenType fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3062) A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0470) A flaw was found in the way Firefox used its embedded Cairo library to render certain fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0472) A flaw was found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website. (CVE-2012-0471) A flaw was found in the way Firefox rendered certain graphics using WebGL. A web page containing malicious content could cause Firefox to crash. (CVE-2012-0473) A flaw in Firefox allowed the address bar to display a different website than the one the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-05-31
    modified2013-07-12
    plugin id68517
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68517
    titleOracle Linux 5 / 6 : firefox (ELSA-2012-0515)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-0515.NASL
    descriptionUpdated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in Sanitiser for OpenType (OTS), used by Firefox to help prevent potential exploits in malformed OpenType fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-3062) A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0467, CVE-2012-0468, CVE-2012-0469) A web page containing a malicious Scalable Vector Graphics (SVG) image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0470) A flaw was found in the way Firefox used its embedded Cairo library to render certain fonts. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0472) A flaw was found in the way Firefox rendered certain images using WebGL. A web page containing malicious content could cause Firefox to crash or, under certain conditions, possibly execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-0478) A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website. (CVE-2012-0471) A flaw was found in the way Firefox rendered certain graphics using WebGL. A web page containing malicious content could cause Firefox to crash. (CVE-2012-0473) A flaw in Firefox allowed the address bar to display a different website than the one the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site, or allowing scripts to be loaded from the attacker
    last seen2020-05-31
    modified2012-04-25
    plugin id58867
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58867
    titleRHEL 5 / 6 : firefox (RHSA-2012:0515)

Oval

accepted2014-10-06T04:01:48.757-04:00
classvulnerability
contributors
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
  • commentMozilla Firefox ESR is installed
    ovaloval:org.mitre.oval:def:22414
  • commentMozilla Thunderbird ESR is installed
    ovaloval:org.mitre.oval:def:22216
descriptionCross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."
familywindows
idoval:org.mitre.oval:def:16107
statusaccepted
submitted2013-05-13T10:26:26.748+04:00
titleCross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."
version36

Redhat

rpms
  • firefox-0:10.0.4-1.el5_8
  • firefox-0:10.0.4-1.el6_2
  • firefox-debuginfo-0:10.0.4-1.el5_8
  • firefox-debuginfo-0:10.0.4-1.el6_2
  • xulrunner-0:10.0.4-1.el5_8
  • xulrunner-0:10.0.4-1.el6_2
  • xulrunner-debuginfo-0:10.0.4-1.el5_8
  • xulrunner-debuginfo-0:10.0.4-1.el6_2
  • xulrunner-devel-0:10.0.4-1.el5_8
  • xulrunner-devel-0:10.0.4-1.el6_2
  • thunderbird-0:10.0.4-1.el5_8
  • thunderbird-0:10.0.4-1.el6_2
  • thunderbird-debuginfo-0:10.0.4-1.el5_8
  • thunderbird-debuginfo-0:10.0.4-1.el6_2