Vulnerabilities > CVE-2012-0475 - Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox, Seamonkey and Thunderbird

047910
CVSS 2.6 - LOW
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
high complexity
mozilla
CWE-264
nessus

Summary

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.

Vulnerable Configurations

Part Description Count
Application
Mozilla
157

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_120.NASL
    descriptionThe installed version of Thunderbird is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that could lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58900
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58900
    titleMozilla Thunderbird < 12.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58900);
      script_version("1.15");
      script_cvs_date("Date: 2018/07/17 12:00:07");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0472",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53218,
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Mozilla Thunderbird < 12.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Windows host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Thunderbird is earlier than 12.0 and thus, 
    is potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        could lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        that could lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' that could lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists that could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists related to font rendering with 'cairo-
        dwrite' that could cause memory corruption leading to 
        crashes and potentially code execution. (CVE-2012-0472)
    
      - An error exists in 'WebGLBuffer' that could lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error could allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports could allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets that could lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that could allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-25/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Thunderbird 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Thunderbird/Version");
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport");
    
    installs = get_kb_list("SMB/Mozilla/Thunderbird/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Thunderbird");
    
    mozilla_check_version(installs:installs, product:'thunderbird', esr:FALSE, fix:'12.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_12_0.NASL
    descriptionThe installed version of Firefox is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58894
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58894
    titleFirefox < 12.0 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58894);
      script_version("1.15");
      script_cvs_date("Date: 2018/07/16 12:48:31");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Firefox < 12.0 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Mac OS X host contains a web browser that is affected by
    multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Firefox is earlier than 12.0 and thus, is
    potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        can lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        which can lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' which can lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists which could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists in 'WebGLBuffer' that can lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error can allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports can allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets which can lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that can allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Firefox 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_firefox_installed.nasl");
      script_require_keys("MacOSX/Firefox/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Firefox";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');
    
    mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'12.0', skippat:'^10\\.0\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-3.NASL
    descriptionUSN-1430-1 fixed vulnerabilities in Firefox. This update provides the corresponding fixes for Thunderbird. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id59015
    published2012-05-07
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59015
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1430-3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1430-3. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59015);
      script_version("1.14");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
      script_bugtraq_id(46785, 53219, 53220, 53221, 53222, 53223, 53224, 53225, 53227, 53228, 53229, 53230, 53231);
      script_xref(name:"USN", value:"1430-3");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1430-3)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-1430-1 fixed vulnerabilities in Firefox. This update provides the
    corresponding fixes for Thunderbird.
    
    Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong,
    Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli
    Pettay discovered memory safety issues affecting Firefox. If the user
    were tricked into opening a specially crafted page, an attacker could
    exploit these to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Firefox. (CVE-2012-0467, CVE-2012-0468)
    
    Aki Helin discovered a use-after-free vulnerability in
    XPConnect. An attacker could potentially exploit this to
    execute arbitrary code with the privileges of the user
    invoking Firefox. (CVE-2012-0469)
    
    Atte Kettunen discovered that invalid frees cause heap
    corruption in gfxImageSurface. If a user were tricked into
    opening a malicious Scalable Vector Graphics (SVG) image
    file, an attacker could exploit these to cause a denial of
    service via application crash, or potentially execute code
    with the privileges of the user invoking Firefox.
    (CVE-2012-0470)
    
    Anne van Kesteren discovered a potential cross-site
    scripting (XSS) vulnerability via multibyte content
    processing errors. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0471)
    
    Matias Juntunen discovered a vulnerability in Firefox's
    WebGL implementation that potentially allows the reading of
    illegal video memory. An attacker could possibly exploit
    this to cause a denial of service via application crash.
    (CVE-2012-0473)
    
    Jordi Chancel, Eddy Bordi, and Chris McGowen discovered that
    Firefox allowed the address bar to display a different
    website than the one the user was visiting. This could
    potentially leave the user vulnerable to cross-site
    scripting (XSS) attacks. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0474)
    
    Simone Fabiano discovered that Firefox did not always send
    correct origin headers when connecting to an IPv6 websites.
    An attacker could potentially use this to bypass intended
    access controls. (CVE-2012-0475)
    
    Masato Kinugawa discovered that cross-site scripting (XSS)
    injection is possible during the decoding of ISO-2022-KR and
    ISO-2022-CN character sets. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0477)
    
    It was discovered that certain images rendered using WebGL
    could cause Firefox to crash. If the user were tricked into
    opening a specially crafted page, an attacker could exploit
    this to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2012-0478)
    
    Mateusz Jurczyk discovered an off-by-one error in the
    OpenType Sanitizer. If the user were tricked into opening a
    specially crafted page, an attacker could exploit this to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2011-3062)
    
    Daniel Divricean discovered a defect in the error handling
    of JavaScript errors can potentially leak the file names and
    location of JavaScript files on a server. This could
    potentially lead to inadvertent information disclosure and a
    vector for further attacks. (CVE-2011-1187)
    
    Jeroen van der Gun discovered a vulnerability in the way
    Firefox handled RSS and Atom feeds. Invalid RSS or ATOM
    content loaded over HTTPS caused the location bar to be
    updated with the address of this content, while the main
    window still displays the previously loaded content. An
    attacker could potentially exploit this vulnerability to
    conduct phishing attacks. (CVE-2012-0479).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1430-3/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected thunderbird package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/07");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird", pkgver:"12.0.1+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201204-120426.NASL
    descriptionMozilla Firefox was updated to the 10.0.4 ESR release to fix various bugs and security issues. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-20) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Christian Holler a reported memory safety and security problem affecting Firefox 11. (CVE-2012-0468) Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay reported memory safety problems and crashes that affect Firefox ESR and Firefox 11. (CVE-2012-0467) - Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. When it is destroyed, this causes a use-after-free, which is potentially exploitable. (MFSA 2012-22 / CVE-2012-0469) - Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found a heap corruption in gfxImageSurface which allows for invalid frees and possible remote code execution. This happens due to float error, resulting from graphics values being passed through different number systems. (MFSA 2012-23 / CVE-2012-0470) - Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages. (MFSA 2012-24 / CVE-2012-0471) - Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems. (MFSA 2012-25 / CVE-2012-0472) - Mozilla community member Matias Juntunen discovered an error in WebGLBuffer where FindMaxElementInSubArray receives wrong template arguments from FindMaxUshortElement. This bug causes maximum index to be computed incorrectly within WebGL.drawElements, allowing the reading of illegal video memory. (MFSA 2012-26 / CVE-2012-0473) - Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is loaded in the window in the addressbar. Security researcher Chris McGowen independently reported the same flaw, and further demonstrated that this could lead to loading scripts from the attacker
    last seen2020-06-05
    modified2012-05-03
    plugin id58973
    published2012-05-03
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58973
    titleSuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6224)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58973);
      script_version("1.10");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0472", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
    
      script_name(english:"SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6224)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox was updated to the 10.0.4 ESR release to fix various
    bugs and security issues.
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-20)
    
        In general these flaws cannot be exploited through email
        in the Thunderbird and SeaMonkey products because
        scripting is disabled, but are potentially a risk in
        browser or browser-like contexts in those products.
    
        Christian Holler a reported memory safety and security
        problem affecting Firefox 11. (CVE-2012-0468)
    
        Bob Clary, Christian Holler, Brian Hackett, Bobby
        Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse
        Ruderman, Julian Seward, and Olli Pettay reported memory
        safety problems and crashes that affect Firefox ESR and
        Firefox 11. (CVE-2012-0467)
    
      - Using the Address Sanitizer tool, security researcher
        Aki Helin from OUSPG found that IDBKeyRange of indexedDB
        remains in the XPConnect hashtable instead of being
        unlinked before being destroyed. When it is destroyed,
        this causes a use-after-free, which is potentially
        exploitable. (MFSA 2012-22 / CVE-2012-0469)
    
      - Using the Address Sanitizer tool, security researcher
        Atte Kettunen from OUSPG found a heap corruption in
        gfxImageSurface which allows for invalid frees and
        possible remote code execution. This happens due to
        float error, resulting from graphics values being passed
        through different number systems. (MFSA 2012-23 /
        CVE-2012-0470)
    
      - Anne van Kesteren of Opera Software found a multi-octet
        encoding issue where certain octets will destroy the
        following octets in the processing of some multibyte
        character sets. This can leave users vulnerable to
        cross-site scripting (XSS) attacks on maliciously
        crafted web pages. (MFSA 2012-24 / CVE-2012-0471)
    
      - Security research firm iDefense reported that researcher
        wushi of team509 discovered a memory corruption on
        Windows Vista and Windows 7 systems with hardware
        acceleration disabled or using incompatible video
        drivers. This is created by using cairo-dwrite to
        attempt to render fonts on an unsupported code path.
        This corruption causes a potentially exploitable crash
        on affected systems. (MFSA 2012-25 / CVE-2012-0472)
    
      - Mozilla community member Matias Juntunen discovered an
        error in WebGLBuffer where FindMaxElementInSubArray
        receives wrong template arguments from
        FindMaxUshortElement. This bug causes maximum index to
        be computed incorrectly within WebGL.drawElements,
        allowing the reading of illegal video memory. (MFSA
        2012-26 / CVE-2012-0473)
    
      - Security researchers Jordi Chancel and Eddy Bordi
        reported that they could short-circuit page loads to
        show the address of a different site than what is loaded
        in the window in the addressbar. Security researcher
        Chris McGowen independently reported the same flaw, and
        further demonstrated that this could lead to loading
        scripts from the attacker's site, leaving users
        vulnerable to cross-site scripting (XSS) attacks. (MFSA
        2012-27 / CVE-2012-0474)
    
      - Security researcher Simone Fabiano reported that if a
        cross-site XHR or WebSocket is opened on a web server on
        a non-standard port for web traffic while using an IPv6
        address, the browser will send an ambiguous origin
        headers if the IPv6 address contains at least 2
        consecutive 16-bit fields of zeroes. If there is an
        origin access control list that uses IPv6 literals, this
        issue could be used to bypass these access controls on
        the server. (MFSA 2012-28 / CVE-2012-0475)
    
      - Security researcher Masato Kinugawa found that during
        the decoding of ISO-2022-KR and ISO-2022-CN character
        sets, characters near 1024 bytes are treated
        incorrectly, either doubling or deleting bytes. On
        certain pages it might be possible for an attacker to
        pad the output of the page such that these errors fall
        in the right place to affect the structure of the page,
        allowing for cross-site script (XSS) injection. (MFSA
        2012-29 / CVE-2012-0477)
    
      - Mozilla community member Ms2ger found an image rendering
        issue with WebGL when texImage2D uses use
        JSVAL_TO_OBJECT on arbitrary objects. This can lead to a
        crash on a maliciously crafted web page. While there is
        no evidence that this is directly exploitable, there is
        a possibility of remote code execution. (MFSA 2012-30 /
        CVE-2012-0478)
    
      - Mateusz Jurczyk of the Google Security Team discovered
        an off-by-one error in the OpenType Sanitizer using the
        Address Sanitizer tool. This can lead to an
        out-of-bounds read and execution of an uninitialized
        function pointer during parsing and possible remote code
        execution. (MFSA 2012-31 / CVE-2011-3062)
    
      - Security researcher Daniel Divricean reported that a
        defect in the error handling of JavaScript errors can
        leak the file names and location of JavaScript files on
        a server, leading to inadvertent information disclosure
        and a vector for further attacks. (MFSA 2012-32 /
        CVE-2011-1187)
    
      - Security researcher Jeroen van der Gun reported that if
        RSS or Atom XML invalid content is loaded over HTTPS,
        the addressbar updates to display the new location of
        the loaded resource, including SSL indicators, while the
        main window still displays the previously loaded
        content. This allows for phishing attacks where a
        malicious page can spoof the identify of another
        seemingly secure site. (MFSA 2012-33 / CVE-2012-0479)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-20.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-22.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-23.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-24.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-25.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-26.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-27.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-28.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-29.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-30.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-31.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-32.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-33.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=758408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1187.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-3062.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0467.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0468.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0469.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0470.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0471.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0472.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0473.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0474.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0475.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0477.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0478.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0479.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6224.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-translations-10.0.4-0.3.3")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"libfreebl3-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"mozilla-nss-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"mozilla-nss-tools-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"s390x", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.4-0.2.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.2.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-254.NASL
    descriptionChanges in xulrunner : - update to 12.0 (bnc#758408) - rebased patches - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - added mozilla-libnotify.patch to allow fallback from libnotify to xul based events if no notification-daemon is running - gcc 4.7 fixes - mozilla-gcc47.patch - disabled crashreporter temporarily for Factory Changes in MozillaFirefox : - update to Firefox 12.0 (bnc#758408) - rebased patches - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - added mozilla-libnotify.patch to allow fallback from libnotify to xul based events if no notification-daemon is running - gcc 4.7 fixes - mozilla-gcc47.patch - disabled crashreporter temporarily for Factory - recommend libcanberra0 for proper sound notifications Changes in MozillaThunderbird : - update to Thunderbird 12.0 (bnc#758408) - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - update Enigmail to 1.4.1 - added mozilla-revert_621446.patch - added mozilla-libnotify.patch (bmo#737646) - added mailnew-showalert.patch (bmo#739146) - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7 - disabled crashreporter temporarily for Factory (gcc 4.7 issue) Changes in seamonkey : - update to SeaMonkey 2.9 (bnc#758408) - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous memory safety hazards - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free in IDBKeyRange - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees causes heap corruption in gfxImageSurface - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS via multibyte content processing errors - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory corruption during font rendering using cairo-dwrite - MFSA 2012-26/CVE-2012-0473 (bmo#743475) WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page load short-circuit can lead to XSS - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6 in Origin headers may bypass webserver access restrictions - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL content using textImage2D - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error in OpenType Sanitizer - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP Redirections and remote content can be read by JavaScript errors - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site identity spoofing when loading RSS and Atom feeds - update to 2.9b4 - added mozilla-sle11.patch and add exceptions to be able to build for SLE11/11.1 - exclude broken gl locale from build - fixed build on 11.2-x86_64 by adding mozilla-revert_621446.patch - added mozilla-gcc47.patch and mailnews-literals.patch to fix compilation issues with recent gcc 4.7
    last seen2020-06-05
    modified2014-06-13
    plugin id74612
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74612
    titleopenSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-254.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74612);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-2985", "CVE-2011-2986", "CVE-2011-2987", "CVE-2011-2988", "CVE-2011-2989", "CVE-2011-2991", "CVE-2011-2992", "CVE-2011-3005", "CVE-2011-3062", "CVE-2011-3232", "CVE-2011-3651", "CVE-2011-3652", "CVE-2011-3654", "CVE-2011-3655", "CVE-2011-3658", "CVE-2011-3660", "CVE-2011-3661", "CVE-2011-3663", "CVE-2012-0445", "CVE-2012-0446", "CVE-2012-0447", "CVE-2012-0451", "CVE-2012-0452", "CVE-2012-0459", "CVE-2012-0460", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0472", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
    
      script_name(english:"openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)");
      script_summary(english:"Check for the openSUSE-2012-254 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Changes in xulrunner :
    
      - update to 12.0 (bnc#758408)
    
      - rebased patches
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - added mozilla-libnotify.patch to allow fallback from
        libnotify to xul based events if no notification-daemon
        is running
    
      - gcc 4.7 fixes
    
      - mozilla-gcc47.patch
    
      - disabled crashreporter temporarily for Factory
    
    Changes in MozillaFirefox :
    
      - update to Firefox 12.0 (bnc#758408)
    
      - rebased patches
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - added mozilla-libnotify.patch to allow fallback from
        libnotify to xul based events if no notification-daemon
        is running
    
      - gcc 4.7 fixes
    
      - mozilla-gcc47.patch
    
      - disabled crashreporter temporarily for Factory
    
      - recommend libcanberra0 for proper sound notifications
    
    Changes in MozillaThunderbird :
    
      - update to Thunderbird 12.0 (bnc#758408)
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - update Enigmail to 1.4.1
    
      - added mozilla-revert_621446.patch
    
      - added mozilla-libnotify.patch (bmo#737646)
    
      - added mailnew-showalert.patch (bmo#739146)
    
      - added mozilla-gcc47.patch and mailnews-literals.patch to
        fix compilation issues with recent gcc 4.7
    
      - disabled crashreporter temporarily for Factory (gcc 4.7
        issue)
    
    Changes in seamonkey :
    
      - update to SeaMonkey 2.9 (bnc#758408)
    
      - MFSA 2012-20/CVE-2012-0467/CVE-2012-0468 Miscellaneous
        memory safety hazards
    
      - MFSA 2012-22/CVE-2012-0469 (bmo#738985) use-after-free
        in IDBKeyRange
    
      - MFSA 2012-23/CVE-2012-0470 (bmo#734288) Invalid frees
        causes heap corruption in gfxImageSurface
    
      - MFSA 2012-24/CVE-2012-0471 (bmo#715319) Potential XSS
        via multibyte content processing errors
    
      - MFSA 2012-25/CVE-2012-0472 (bmo#744480) Potential memory
        corruption during font rendering using cairo-dwrite
    
      - MFSA 2012-26/CVE-2012-0473 (bmo#743475)
        WebGL.drawElements may read illegal video memory due to
        FindMaxUshortElement error
    
      - MFSA 2012-27/CVE-2012-0474 (bmo#687745, bmo#737307) Page
        load short-circuit can lead to XSS
    
      - MFSA 2012-28/CVE-2012-0475 (bmo#694576) Ambiguous IPv6
        in Origin headers may bypass webserver access
        restrictions
    
      - MFSA 2012-29/CVE-2012-0477 (bmo#718573) Potential XSS
        through ISO-2022-KR/ISO-2022-CN decoding issues
    
      - MFSA 2012-30/CVE-2012-0478 (bmo#727547) Crash with WebGL
        content using textImage2D
    
      - MFSA 2012-31/CVE-2011-3062 (bmo#739925) Off-by-one error
        in OpenType Sanitizer
    
      - MFSA 2012-32/CVE-2011-1187 (bmo#624621) HTTP
        Redirections and remote content can be read by
        JavaScript errors
    
      - MFSA 2012-33/CVE-2012-0479 (bmo#714631) Potential site
        identity spoofing when loading RSS and Atom feeds
    
      - update to 2.9b4
    
      - added mozilla-sle11.patch and add exceptions to be able
        to build for SLE11/11.1
    
      - exclude broken gl locale from build
    
      - fixed build on 11.2-x86_64 by adding
        mozilla-revert_621446.patch
    
      - added mozilla-gcc47.patch and mailnews-literals.patch to
        fix compilation issues with recent gcc 4.7"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=712224"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=714931"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=720264"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=726758"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=728520"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=732898"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=733002"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=744275"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=746616"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=747328"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=749440"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=750044"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=755060"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=758408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-04/msg00066.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MozillaFirefox / MozillaThunderbird / seamonkey / etc packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox nsSVGValue Out-of-Bounds Access Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-venkman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-branding-upstream-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-buildsymbols-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-debugsource-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-devel-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-translations-common-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaFirefox-translations-other-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-buildsymbols-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-debuginfo-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-debugsource-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-devel-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-translations-common-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"MozillaThunderbird-translations-other-12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"enigmail-1.4.1+12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"enigmail-debuginfo-1.4.1+12.0-33.20.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"mozilla-js-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"mozilla-js-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-debuginfo-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-debugsource-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-dom-inspector-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-irc-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-translations-common-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-translations-other-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"seamonkey-venkman-2.9-2.18.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-buildsymbols-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-debugsource-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-devel-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"xulrunner-devel-debuginfo-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"mozilla-js-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"mozilla-js-debuginfo-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"xulrunner-32bit-12.0-2.26.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"xulrunner-debuginfo-32bit-12.0-2.26.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox / MozillaFirefox-branding-upstream / etc");
    }
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_120.NASL
    descriptionThe installed version of Firefox is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that could lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58898
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58898
    titleFirefox < 12.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58898);
      script_version("1.15");
      script_cvs_date("Date: 2018/07/17 12:00:07");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0472",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53218,
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Firefox < 12.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Firefox is earlier than 12.0 and thus, is
    potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        could lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        that could lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' that could lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists that could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists related to font rendering with 'cairo-
        dwrite' that could cause memory corruption leading to
        crashes and potentially code execution. (CVE-2012-0472)
    
      - An error exists in 'WebGLBuffer' that could lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error could allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports could allow this
        application to send ambiguous origin headers.
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets that could lead to cross-
        site scripting attacks. (CVE-2012-0477)
    
      - An error exists related to 'WebGL' and 'texImage2D'
        that could allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-25/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Firefox 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport");
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'12.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-2.NASL
    descriptionUSN-1430-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the latest Firefox. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id58923
    published2012-04-30
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58923
    titleUbuntu 10.04 LTS / 11.04 / 11.10 : ubufox update (USN-1430-2)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1430-2. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58923);
      script_version("1.13");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
      script_xref(name:"USN", value:"1430-2");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 : ubufox update (USN-1430-2)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-1430-1 fixed vulnerabilities in Firefox. This update provides an
    updated ubufox package for use with the latest Firefox.
    
    Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong,
    Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli
    Pettay discovered memory safety issues affecting Firefox. If the user
    were tricked into opening a specially crafted page, an attacker could
    exploit these to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Firefox. (CVE-2012-0467, CVE-2012-0468)
    
    Aki Helin discovered a use-after-free vulnerability in
    XPConnect. An attacker could potentially exploit this to
    execute arbitrary code with the privileges of the user
    invoking Firefox. (CVE-2012-0469)
    
    Atte Kettunen discovered that invalid frees cause heap
    corruption in gfxImageSurface. If a user were tricked into
    opening a malicious Scalable Vector Graphics (SVG) image
    file, an attacker could exploit these to cause a denial of
    service via application crash, or potentially execute code
    with the privileges of the user invoking Firefox.
    (CVE-2012-0470)
    
    Anne van Kesteren discovered a potential cross-site
    scripting (XSS) vulnerability via multibyte content
    processing errors. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0471)
    
    Matias Juntunen discovered a vulnerability in Firefox's
    WebGL implementation that potentially allows the reading of
    illegal video memory. An attacker could possibly exploit
    this to cause a denial of service via application crash.
    (CVE-2012-0473)
    
    Jordi Chancel, Eddy Bordi, and Chris McGowen discovered that
    Firefox allowed the address bar to display a different
    website than the one the user was visiting. This could
    potentially leave the user vulnerable to cross-site
    scripting (XSS) attacks. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0474)
    
    Simone Fabiano discovered that Firefox did not always send
    correct origin headers when connecting to an IPv6 websites.
    An attacker could potentially use this to bypass intended
    access controls. (CVE-2012-0475)
    
    Masato Kinugawa discovered that cross-site scripting (XSS)
    injection is possible during the decoding of ISO-2022-KR and
    ISO-2022-CN character sets. With cross-site scripting
    vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this
    to modify the contents, or steal confidential data, within
    the same domain. (CVE-2012-0477)
    
    It was discovered that certain images rendered using WebGL
    could cause Firefox to crash. If the user were tricked into
    opening a specially crafted page, an attacker could exploit
    this to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2012-0478)
    
    Mateusz Jurczyk discovered an off-by-one error in the
    OpenType Sanitizer. If the user were tricked into opening a
    specially crafted page, an attacker could exploit this to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2011-3062)
    
    Daniel Divricean discovered a defect in the error handling
    of JavaScript errors can potentially leak the file names and
    location of JavaScript files on a server. This could
    potentially lead to inadvertent information disclosure and a
    vector for further attacks. (CVE-2011-1187)
    
    Jeroen van der Gun discovered a vulnerability in the way
    Firefox handled RSS and Atom feeds. Invalid RSS or ATOM
    content loaded over HTTPS caused the location bar to be
    updated with the address of this content, while the main
    window still displays the previously loaded content. An
    attacker could potentially exploit this vulnerability to
    conduct phishing attacks. (CVE-2012-0479).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1430-2/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xul-ext-ubufox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:xul-ext-ubufox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"xul-ext-ubufox", pkgver:"0.9.5-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"xul-ext-ubufox", pkgver:"0.9.5-0ubuntu1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"xul-ext-ubufox", pkgver:"1.0.4-0ubuntu1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xul-ext-ubufox");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_12_0.NASL
    descriptionThe installed version of Thunderbird is earlier than 12.0 and thus, is potentially affected by the following security issues : - An error exists with handling JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58896
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58896
    titleThunderbird < 12.0 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58896);
      script_version("1.14");
      script_cvs_date("Date: 2018/07/16 12:48:31");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"Thunderbird < 12.0 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Mac OS X host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of Thunderbird is earlier than 12.0 and thus, is 
    potentially affected by the following security issues :
    
      - An error exists with handling JavaScript errors that
        can lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        which can lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist that could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' which can lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists which could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists in 'WebGLBuffer' that can lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error can allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports can allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets which could lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that can allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
      script_set_attribute(attribute:"solution", value:"Upgrade to Thunderbird 12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_thunderbird_installed.nasl");
      script_require_keys("MacOSX/Thunderbird/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Thunderbird";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    mozilla_check_version(product:'thunderbird', version:version, path:path, esr:FALSE, fix:'12.0', skippat:'^10\\.0\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FIREFOX10-201205-8154.NASL
    descriptionMozillaFirefox was updated to the 10.0.4 ESR release to fix various bugs and security issues. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-20) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. o Christian Holler a reported memory safety and security problem affecting Firefox 11. (CVE-2012-0468) o Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay reported memory safety problems and crashes that affect Firefox ESR and Firefox 11. (CVE-2012-0467) - Using the Address Sanitizer tool, security researcher Aki Helin from OUSPG found that IDBKeyRange of indexedDB remains in the XPConnect hashtable instead of being unlinked before being destroyed. When it is destroyed, this causes a use-after-free, which is potentially exploitable. (MFSA 2012-22 / CVE-2012-0469) - Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found a heap corruption in gfxImageSurface which allows for invalid frees and possible remote code execution. This happens due to float error, resulting from graphics values being passed through different number systems. (MFSA 2012-23 / CVE-2012-0470) - Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages. (MFSA 2012-24 / CVE-2012-0471) - Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems. (MFSA 2012-25 / CVE-2012-0472) - Mozilla community member Matias Juntunen discovered an error in WebGLBuffer where FindMaxElementInSubArray receives wrong template arguments from FindMaxUshortElement. This bug causes maximum index to be computed incorrectly within WebGL.drawElements, allowing the reading of illegal video memory. (MFSA 2012-26 / CVE-2012-0473) - Security researchers Jordi Chancel and Eddy Bordi reported that they could short-circuit page loads to show the address of a different site than what is loaded in the window in the addressbar. Security researcher Chris McGowen independently reported the same flaw, and further demonstrated that this could lead to loading scripts from the attacker
    last seen2020-06-05
    modified2012-06-04
    plugin id59354
    published2012-06-04
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59354
    titleSuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 8154)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59354);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-1187", "CVE-2011-3062", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0472", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479");
    
      script_name(english:"SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 8154)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "MozillaFirefox was updated to the 10.0.4 ESR release to fix various
    bugs and security issues.
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-20)
    
        In general these flaws cannot be exploited through email
        in the Thunderbird and SeaMonkey products because
        scripting is disabled, but are potentially a risk in
        browser or browser-like contexts in those products.
    
    o
    
    Christian Holler a reported memory safety and security
    problem affecting Firefox 11. (CVE-2012-0468)
    
    o
    
    Bob Clary, Christian Holler, Brian Hackett, Bobby Holley,
    Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman,
    Julian Seward, and Olli Pettay reported memory safety
    problems and crashes that affect Firefox ESR and Firefox 11.
    (CVE-2012-0467)
    
      - Using the Address Sanitizer tool, security researcher
        Aki Helin from OUSPG found that IDBKeyRange of indexedDB
        remains in the XPConnect hashtable instead of being
        unlinked before being destroyed. When it is destroyed,
        this causes a use-after-free, which is potentially
        exploitable. (MFSA 2012-22 / CVE-2012-0469)
    
      - Using the Address Sanitizer tool, security researcher
        Atte Kettunen from OUSPG found a heap corruption in
        gfxImageSurface which allows for invalid frees and
        possible remote code execution. This happens due to
        float error, resulting from graphics values being passed
        through different number systems. (MFSA 2012-23 /
        CVE-2012-0470)
    
      - Anne van Kesteren of Opera Software found a multi-octet
        encoding issue where certain octets will destroy the
        following octets in the processing of some multibyte
        character sets. This can leave users vulnerable to
        cross-site scripting (XSS) attacks on maliciously
        crafted web pages. (MFSA 2012-24 / CVE-2012-0471)
    
      - Security research firm iDefense reported that researcher
        wushi of team509 discovered a memory corruption on
        Windows Vista and Windows 7 systems with hardware
        acceleration disabled or using incompatible video
        drivers. This is created by using cairo-dwrite to
        attempt to render fonts on an unsupported code path.
        This corruption causes a potentially exploitable crash
        on affected systems. (MFSA 2012-25 / CVE-2012-0472)
    
      - Mozilla community member Matias Juntunen discovered an
        error in WebGLBuffer where FindMaxElementInSubArray
        receives wrong template arguments from
        FindMaxUshortElement. This bug causes maximum index to
        be computed incorrectly within WebGL.drawElements,
        allowing the reading of illegal video memory. (MFSA
        2012-26 / CVE-2012-0473)
    
      - Security researchers Jordi Chancel and Eddy Bordi
        reported that they could short-circuit page loads to
        show the address of a different site than what is loaded
        in the window in the addressbar. Security researcher
        Chris McGowen independently reported the same flaw, and
        further demonstrated that this could lead to loading
        scripts from the attacker's site, leaving users
        vulnerable to cross-site scripting (XSS) attacks. (MFSA
        2012-27 / CVE-2012-0474)
    
      - Security researcher Simone Fabiano reported that if a
        cross-site XHR or WebSocket is opened on a web server on
        a non-standard port for web traffic while using an IPv6
        address, the browser will send an ambiguous origin
        headers if the IPv6 address contains at least 2
        consecutive 16-bit fields of zeroes. If there is an
        origin access control list that uses IPv6 literals, this
        issue could be used to bypass these access controls on
        the server. (MFSA 2012-28 / CVE-2012-0475)
    
      - Security researcher Masato Kinugawa found that during
        the decoding of ISO-2022-KR and ISO-2022-CN character
        sets, characters near 1024 bytes are treated
        incorrectly, either doubling or deleting bytes. On
        certain pages it might be possible for an attacker to
        pad the output of the page such that these errors fall
        in the right place to affect the structure of the page,
        allowing for cross-site script (XSS) injection. (MFSA
        2012-29 / CVE-2012-0477)
    
      - Mozilla community member Ms2ger found an image rendering
        issue with WebGL when texImage2D uses use
        JSVAL_TO_OBJECT on arbitrary objects. This can lead to a
        crash on a maliciously crafted web page. While there is
        no evidence that this is directly exploitable, there is
        a possibility of remote code execution. (MFSA 2012-30 /
        CVE-2012-0478)
    
      - Mateusz Jurczyk of the Google Security Team discovered
        an off-by-one error in the OpenType Sanitizer using the
        Address Sanitizer tool. This can lead to an
        out-of-bounds read and execution of an uninitialized
        function pointer during parsing and possible remote code
        execution. (MFSA 2012-31 / CVE-2011-3062)
    
      - Security researcher Daniel Divricean reported that a
        defect in the error handling of JavaScript errors can
        leak the file names and location of JavaScript files on
        a server, leading to inadvertent information disclosure
        and a vector for further attacks. (MFSA 2012-32 /
        CVE-2011-1187)
    
      - Security researcher Jeroen van der Gun reported that if
        RSS or Atom XML invalid content is loaded over HTTPS,
        the addressbar updates to display the new location of
        the loaded resource, including SSL indicators, while the
        main window still displays the previously loaded
        content. This allows for phishing attacks where a
        malicious page can spoof the identify of another
        seemingly secure site. (MFSA 2012-33 / CVE-2012-0479)"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-20.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-22.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-23.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-24.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-25.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-25/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-26.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-27.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-28.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-29.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-30.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-31.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-1187.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2011-3062.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0467.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0468.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0469.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0470.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0471.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0472.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0473.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0474.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0475.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0477.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0478.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-0479.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 8154.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/03/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/04");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-10.0.4-0.7.6")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-branding-SLED-7-0.8.12")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-translations-10.0.4-0.7.6")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"beagle-0.2.18-78.13.1.102")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"beagle-evolution-0.2.18-78.13.1.102")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"beagle-firefox-0.2.18-78.13.1.102")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"beagle-gui-0.2.18-78.13.1.102")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"firefox3-gtk2-2.10.6-0.10.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mhtml-firefox-0.5-1.11.5")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-devel-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-tools-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"firefox3-gtk2-32bit-2.10.6-0.10.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-10.0.4-0.7.6")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-branding-SLED-7-0.8.12")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-translations-10.0.4-0.7.6")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"firefox3-gtk2-2.10.6-0.10.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-devel-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-tools-3.13.4-0.5.5")) flag++;
    if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"firefox3-gtk2-32bit-2.10.6-0.10.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.4-0.5.5")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idSEAMONKEY_29.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.9.0. Such versions are potentially affected by the following security issues : - An error exists with the handling of JavaScript errors that can lead to information disclosure. (CVE-2011-1187) - An off-by-one error exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id58901
    published2012-04-27
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58901
    titleSeaMonkey < 2.9.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58901);
      script_version("1.14");
      script_cvs_date("Date: 2018/07/30 11:55:12");
    
      script_cve_id(
        "CVE-2011-1187",
        "CVE-2011-3062",
        "CVE-2012-0467",
        "CVE-2012-0468",
        "CVE-2012-0469",
        "CVE-2012-0470",
        "CVE-2012-0471",
        "CVE-2012-0472",
        "CVE-2012-0473",
        "CVE-2012-0474",
        "CVE-2012-0475",
        "CVE-2012-0477",
        "CVE-2012-0478",
        "CVE-2012-0479"
      );
      script_bugtraq_id(
        53218,
        53219,
        53220,
        53221,
        53222,
        53223,
        53224,
        53225,
        53227,
        53228,
        53229,
        53230,
        53231
      );
    
      script_name(english:"SeaMonkey < 2.9.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of SeaMonkey");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The installed version of SeaMonkey is earlier than 2.9.0. Such
    versions are potentially affected by the following security issues :
    
      - An error exists with the handling of JavaScript errors 
        that can lead to information disclosure. (CVE-2011-1187)
    
      - An off-by-one error exists in the 'OpenType Sanitizer'
        that can lead to out-bounds-reads and possible code
        execution. (CVE-2011-3062)
    
      - Memory safety issues exist which could lead
        to arbitrary code execution. (CVE-2012-0467,
        CVE-2012-0468)
    
      - A use-after-free error exists related to 'IDBKeyRange'
        of 'indexedDB'. (CVE-2012-0469)
    
      - Heap-corruption errors exist related to
        'gfxImageSurface' which can lead to possible code
        execution. (CVE-2012-0470)
    
      - A multi-octet encoding issue exists which could allow
        cross-site scripting attacks as certain octets in
        multibyte character sets can destroy following octets.
        (CVE-2012-0471)
    
      - An error exists related to font rendering with 'cairo-
        dwrite' which can cause memory corruption leading to 
        crashes and potentially code execution. (CVE-2012-0472)
    
      - An error exists in 'WebGLBuffer' that can lead to the
        reading of illegal video memory. (CVE-2012-0473)
    
      - An unspecified error can allow URL bar spoofing.
        (CVE-2012-0474)
    
      - IPv6 addresses and cross-site 'XHR' or 'WebSocket'
        connections on non-standard ports can allow this
        application to send ambiguous origin headers. 
        (CVE-2012-0475)
    
      - A decoding issue exists related to 'ISO-2022-KR' and
        'ISO-2022-CN' character sets which could lead to cross-
        site scripting attacks. (CVE-2012-0477)
        
      - An error exists related to 'WebGL' and 'texImage2D'
        that can allow application crashes and possibly code
        execution when 'JSVAL_TO_OBJECT' is used on ordinary
        objects. (CVE-2012-0478)
    
      - Address bar spoofing is possible when 'Atom XML' or
        'RSS' data is loaded over HTTPS leading to phishing
        attacks. (CVE-2012-0479)"
      );
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-20/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-22/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-23/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-24/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-25/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-26/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-27/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-28/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-29/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-30/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-31/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-32/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-33/");
    
      script_set_attribute(
        attribute:"solution",
        value:"Upgrade to SeaMonkey 2.9.0 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:seamonkey");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
     
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("SeaMonkey/Version");
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/SeaMonkey/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "SeaMonkey");
    
    mozilla_check_version(installs:installs, product:'seamonkey', fix:'2.9.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_380E8C568E3211E195804061862B8C22.NASL
    descriptionThe Mozilla Project reports : MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4) MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9 MFSA 2012-22 use-after-free in IDBKeyRange MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface MFSA 2012-24 Potential XSS via multibyte content processing errors MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error MFSA 2012-27 Page load short-circuit can lead to XSS MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues MFSA 2012-30 Crash with WebGL content using textImage2D MFSA 2012-31 Off-by-one error in OpenType Sanitizer MFSA 2012-32 HTTP Redirections and remote content can be read by JavaScript errors MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds
    last seen2020-06-01
    modified2020-06-02
    plugin id58864
    published2012-04-25
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58864
    titleFreeBSD : mozilla -- multiple vulnerabilities (380e8c56-8e32-11e1-9580-4061862b8c22)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1430-1.NASL
    descriptionBob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0467, CVE-2012-0468) Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2012-0469) Atte Kettunen discovered that invalid frees cause heap corruption in gfxImageSurface. If a user were tricked into opening a malicious Scalable Vector Graphics (SVG) image file, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0470) Anne van Kesteren discovered a potential cross-site scripting (XSS) vulnerability via multibyte content processing errors. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2012-0471) Matias Juntunen discovered a vulnerability in Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id58922
    published2012-04-30
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58922
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1430-1)

Oval

accepted2014-10-06T04:01:51.968-04:00
classvulnerability
contributors
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
descriptionMozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.
familywindows
idoval:org.mitre.oval:def:16279
statusaccepted
submitted2013-05-13T10:26:26.748+04:00
titleMozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.
version36