Vulnerabilities > CVE-2012-3971 - Buffer Errors vulnerability in Mozilla Firefox, Seamonkey and Thunderbird

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
mozilla
CWE-119
critical
nessus

Summary

Summer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::readClassMap and (2) Pass::readPass functions.

Vulnerable Configurations

Part Description Count
Application
Mozilla
516

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-147.NASL
    descriptionSecurity issues were identified and fixed in mozilla thunderbird : Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1971). In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products (CVE-2012-1970). Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964). Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks (CVE-2012-1956). Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative height header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable (CVE-2012-3966). Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash (CVE-2012-3968, CVE-2012-3967). Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko
    last seen2020-06-01
    modified2020-06-02
    plugin id61990
    published2012-09-06
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61990
    titleMandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2012:147)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2012:147. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61990);
      script_version("1.7");
      script_cvs_date("Date: 2019/08/02 13:32:54");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3974", "CVE-2012-3975", "CVE-2012-3978", "CVE-2012-3980");
      script_xref(name:"MDVSA", value:"2012:147");
    
      script_name(english:"Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2012:147)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Security issues were identified and fixed in mozilla thunderbird :
    
    Mozilla developers identified and fixed several memory safety bugs in
    the browser engine used in Firefox and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption under certain
    circumstances, and we presume that with enough effort at least some of
    these could be exploited to run arbitrary code (CVE-2012-1971).
    
    In general these flaws cannot be exploited through email in the
    Thunderbird and SeaMonkey products because scripting is disabled, but
    are potentially a risk in browser or browser-like contexts in those
    products (CVE-2012-1970).
    
    Security researcher Abhishek Arya (Inferno) of Google Chrome Security
    Team discovered a series of use-after-free issues using the Address
    Sanitizer tool. Many of these issues are potentially exploitable,
    allowing for remote code execution (CVE-2012-1972, CVE-2012-1973,
    CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
    CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
    CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964).
    
    Security researcher Mariusz Mlynski reported that it is possible to
    shadow the location object using Object.defineProperty. This could be
    used to confuse the current location to plugins, allowing for possible
    cross-site scripting (XSS) attacks (CVE-2012-1956).
    
    Security researcher Frederic Hoguin reported two related issues with
    the decoding of bitmap (.BMP) format images embedded in icon (.ICO)
    format files. When processing a negative height header value for the
    bitmap image, a memory corruption can be induced, allowing an attacker
    to write random memory and cause a crash. This crash may be
    potentially exploitable (CVE-2012-3966).
    
    Security researcher miaubiz used the Address Sanitizer tool to
    discover two WebGL issues. The first issue is a use-after-free when
    WebGL shaders are called after being destroyed. The second issue
    exposes a problem with Mesa drivers on Linux, leading to a potentially
    exploitable crash (CVE-2012-3968, CVE-2012-3967).
    
    Security researcher Arthur Gerkis used the Address Sanitizer tool to
    find two issues involving Scalable Vector Graphics (SVG) files. The
    first issue is a buffer overflow in Gecko's SVG filter code when the
    sum of two values is too large to be stored as a signed 32-bit
    integer, causing the function to write past the end of an array. The
    second issue is a use-after-free when an element with a
    requiredFeatures attribute is moved between documents. In that
    situation, the internal representation of the requiredFeatures value
    could be freed prematurely. Both issues are potentially exploitable
    (CVE-2012-3969, CVE-2012-3970).
    
    Using the Address Sanitizer tool, Mozilla security researcher
    Christoph Diehl discovered two memory corruption issues involving the
    Graphite 2 library used in Mozilla products. Both of these issues can
    cause a potentially exploitable crash. These problems were fixed in
    the Graphite 2 library, which has been updated for Mozilla products
    (CVE-2012-3971).
    
    Security research Nicolas Gregoire used the Address Sanitizer tool to
    discover an out-of-bounds read in the format-number feature of XSLT,
    which can cause inaccurate formatting of numbers and information
    leakage. This is not directly exploitable (CVE-2012-3972).
    
    Security researcher Masato Kinugawa reported that if a crafted
    executable is placed in the root partition on a Windows file system,
    the Firefox and Thunderbird installer will launch this program after a
    standard installation instead of Firefox or Thunderbird, running this
    program with the user's privileges (CVE-2012-3974).
    
    Security researcher vsemozhetbyt reported that when the DOMParser is
    used to parse text/html data in a Firefox extension, linked resources
    within this HTML data will be loaded. If the data being parsed in the
    extension is untrusted, it could lead to information leakage and can
    potentially be combined with other attacks to become exploitable
    (CVE-2012-3975).
    
    Mozilla security researcher moz_bug_r_a4 reported that certain
    security checks in the location object can be bypassed if chrome code
    is called content in a specific manner. This allowed for the loading
    of restricted content. This can be combined with other issues to
    become potentially exploitable (CVE-2012-3978).
    
    Security researcher Colby Russell discovered that eval in the web
    console can execute injected code with chrome privileges, leading to
    the running of malicious code in a privileged context. This allows for
    arbitrary code execution through a malicious web page if the web
    console is invoked by the user (CVE-2012-3980).
    
    The mozilla thunderbird packages has been upgraded to the latest
    version which is unaffected by these security flaws."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-57.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-58.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-59.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-61.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-62.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-63.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-64.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-65.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-67.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-68.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-70.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-72.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ar");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-be");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-bg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-bn_BD");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-br");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ca");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-cs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-da");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-de");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-el");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-en_GB");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-ar");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-ca");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-cs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-de");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-el");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-es");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-fi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-fr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-it");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-ja");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-ko");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-nb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-nl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-pt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-pt_BR");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-ru");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-sl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-sv");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-tr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-vi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-zh_CN");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-enigmail-zh_TW");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-es_AR");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-es_ES");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-et");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-eu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-fi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-fr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-fy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ga");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-gl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-he");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-hu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-id");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-is");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-it");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ja");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ko");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-lightning");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-lt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-nb_NO");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-nl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-nn_NO");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-pt_BR");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-pt_PT");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ro");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ru");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-si");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-sk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-sl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-sq");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-sv_SE");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-ta_LK");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-tr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-uk");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-vi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-zh_CN");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-thunderbird-zh_TW");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:nsinstall");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2011");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ar-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-be-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-bg-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-bn_BD-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-br-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ca-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-cs-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-da-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-de-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-el-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-en_GB-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-ar-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-ca-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-cs-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-de-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-el-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-es-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-fi-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-fr-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-it-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-ja-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-ko-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-nb-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-nl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-pl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-pt-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-pt_BR-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-ru-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-sl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-sv-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-tr-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-vi-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-zh_CN-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-enigmail-zh_TW-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-es_AR-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-es_ES-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-et-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-eu-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-fi-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-fr-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-fy-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ga-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-gd-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-gl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-he-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-hu-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-id-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-is-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-it-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ja-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ko-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-lightning-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-lt-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-nb_NO-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-nl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-nn_NO-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-pl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-pt_BR-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-pt_PT-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ro-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ru-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-si-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-sk-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-sl-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-sq-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-sv_SE-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-ta_LK-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-tr-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-uk-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-vi-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-zh_CN-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"mozilla-thunderbird-zh_TW-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"nsinstall-15.0-0.1-mdv2011.0", yank:"mdv")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idSEAMONKEY_212.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.12.0. Such versions are potentially affected by the following security issues : - An error exists related to
    last seen2020-06-01
    modified2020-06-02
    plugin id61718
    published2012-08-29
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61718
    titleSeaMonkey < 2.12.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61718);
      script_version("1.19");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1956",
        "CVE-2012-1970",
        "CVE-2012-1971",
        "CVE-2012-1972",
        "CVE-2012-1973",
        "CVE-2012-1974",
        "CVE-2012-1975",
        "CVE-2012-1976",
        "CVE-2012-3956",
        "CVE-2012-3957",
        "CVE-2012-3958",
        "CVE-2012-3959",
        "CVE-2012-3960",
        "CVE-2012-3961",
        "CVE-2012-3962",
        "CVE-2012-3963",
        "CVE-2012-3964",
        "CVE-2012-3966",
        "CVE-2012-3968",
        "CVE-2012-3969",
        "CVE-2012-3970",
        "CVE-2012-3971",
        "CVE-2012-3972",
        "CVE-2012-3975",
        "CVE-2012-3976",
        "CVE-2012-3978",
        "CVE-2012-4930"
      );
      script_bugtraq_id(
        55249,
        55260,
        55264,
        55266,
        55274,
        55276,
        55278,
        55292,
        55304,
        55306,
        55310,
        55311,
        55313,
        55314,
        55316,
        55317,
        55318,
        55319,
        55320,
        55321,
        55322,
        55323,
        55324,
        55325,
        55340,
        55341,
        55342,
        55707
      );
    
      script_name(english:"SeaMonkey < 2.12.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of SeaMonkey");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of SeaMonkey is earlier than 2.12.0. Such
    versions are potentially affected by the following security issues :
    
      - An error exists related to 'Object.defineProperty'
        and the location object that could allow cross-site
        scripting attacks. (CVE-2012-1956)
    
      - Unspecified memory safety issues exist. (CVE-2012-1970,
        CVE-2012-1971)
    
      - Multiple use-after-free errors exist. (CVE-2012-1972,
        CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,
        CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,
        CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
        CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
        CVE-2012-3964)
    
      - An error exists related to bitmap (BMP) and icon (ICO)
        file decoding that can lead to memory corruption,
        causing application crashes and potentially arbitrary
        code execution. (CVE-2012-3966)
    
      - A use-after-free error exists related to WebGL shaders.
        (CVE-2012-3968)
    
      - A buffer overflow exists related to SVG filters.
        (CVE-2012-3969)
    
      - A use-after-free error exists related to elements
        having 'requiredFeatures' attributes. (CVE-2012-3970)
    
      - A 'Graphite 2' library memory corruption error exists.
        (CVE-2012-3971)
    
      - An XSLT out-of-bounds read error exists related to
        'format-number'. (CVE-2012-3972)
    
      - The DOM parser can unintentionally load linked
        resources in extensions. (CVE-2012-3975)
    
      - Incorrect SSL certificate information can be displayed
        in the address bar when two 'onLocationChange' events
        fire out of order. (CVE-2012-3976)
    
      - Security checks related to location objects can be
        bypassed if crafted calls are made to the browser
        chrome code. (CVE-2012-3978)
    
      - SPDY's request header compression leads to information
        leakage, which can allow private data such as session
        cookies to be extracted, even over an SSL connection.
        (CVE-2012-4930)");
      script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/524145/30/0/threaded");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-69/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-73/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to SeaMonkey 2.12.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3971");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:seamonkey");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("SeaMonkey/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/SeaMonkey/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "SeaMonkey");
    
    mozilla_check_version(installs:installs, product:'seamonkey', fix:'2.12.0', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_15_0.NASL
    descriptionThe installed version of Firefox is earlier than 15.0 and thus, is potentially affected by the following security issues : - An error exists related to
    last seen2020-06-01
    modified2020-06-02
    plugin id61711
    published2012-08-29
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61711
    titleFirefox < 15.0 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61711);
      script_version("1.20");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1956",
        "CVE-2012-1970",
        "CVE-2012-1971",
        "CVE-2012-1972",
        "CVE-2012-1973",
        "CVE-2012-1974",
        "CVE-2012-1975",
        "CVE-2012-1976",
        "CVE-2012-3956",
        "CVE-2012-3957",
        "CVE-2012-3958",
        "CVE-2012-3959",
        "CVE-2012-3960",
        "CVE-2012-3961",
        "CVE-2012-3962",
        "CVE-2012-3963",
        "CVE-2012-3964",
        "CVE-2012-3965",
        "CVE-2012-3966",
        "CVE-2012-3968",
        "CVE-2012-3969",
        "CVE-2012-3970",
        "CVE-2012-3971",
        "CVE-2012-3972",
        "CVE-2012-3973",
        "CVE-2012-3975",
        "CVE-2012-3976",
        "CVE-2012-3978",
        "CVE-2012-3980",
        "CVE-2012-4930"
      );
      script_bugtraq_id(
        55249,
        55256,
        55257,
        55260,
        55264,
        55266,
        55274,
        55276,
        55278,
        55292,
        55304,
        55306,
        55308,
        55310,
        55311,
        55313,
        55314,
        55316,
        55317,
        55318,
        55319,
        55320,
        55321,
        55322,
        55323,
        55324,
        55325,
        55340,
        55341,
        55342,
        55857
      );
    
      script_name(english:"Firefox < 15.0 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Mac OS X host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Firefox is earlier than 15.0 and thus, is
    potentially affected by the following security issues :
    
      - An error exists related to 'Object.defineProperty'
        and the location object that could allow cross-site
        scripting attacks. (CVE-2012-1956)
    
      - Unspecified memory safety issues exist. (CVE-2012-1970,
        CVE-2012-1971)
    
      - Multiple use-after-free errors exist. (CVE-2012-1972,
        CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,
        CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,
        CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
        CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
        CVE-2012-3964)
    
      - An error exists related to 'about:newtab' and the
        browser's history. This error can allow a newly opened
        tab to further open a new window and navigate to the
        privileged 'about:newtab' page leading to possible
        privilege escalation. (CVE-2012-3965)
    
      - An error exists related to bitmap (BMP) and icon (ICO)
        file decoding that can lead to memory corruption
        causing application crashes and potentially arbitrary
        code execution. (CVE-2012-3966)
    
      - A use-after-free error exists related to WebGL shaders.
        (CVE-2012-3968)
    
      - A buffer overflow exists related to SVG filters.
        (CVE-2012-3969)
    
      - A use-after-free error exists related to elements
        having 'requiredFeatures' attributes. (CVE-2012-3970)
    
      - A 'Graphite 2' library memory corruption error exists.
        (CVE-2012-3971)
    
      - An XSLT out-of-bounds read error exists related to
        'format-number'. (CVE-2012-3972)
    
      - Remote debugging is possible even when disabled and the
        'HTTPMonitor' extension is enabled. (CVE-2012-3973)
    
      - The DOM parser can unintentionally load linked
        resources in extensions. (CVE-2012-3975)
    
      - Incorrect SSL certificate information can be displayed
        in the address bar when two 'onLocationChange' events
        fire out of order. (CVE-2012-3976)
    
      - Security checks related to location objects can be
        bypassed if crafted calls are made to the browser
        chrome code. (CVE-2012-3978)
    
      - Calling 'eval' in the web console can allow injected
        code to be executed with browser chrome privileges.
        (CVE-2012-3980)
    
      - SPDY's request header compression leads to information
        leakage, which can allow private data such as session
        cookies to be extracted, even over an SSL connection.
        (CVE-2012-4930)");
      script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/524145/30/0/threaded");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-60/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-66/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-69/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-73/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox 15.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3971");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_firefox_installed.nasl");
      script_require_keys("MacOSX/Firefox/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Firefox";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');
    
    mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'15.0', skippat:'^10\\.0\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FIREFOX-201208-8269.NASL
    descriptionMozillaFirefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems. The following security issues have been addressed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-57) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. - Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, and Jason Smith reported memory safety problems and crashes that affect Firefox 14. (CVE-2012-1971) - Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic and Daniel Holbert reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 14. (CVE-2012-1970) - Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. (MFSA 2012-58) o Heap-use-after-free in nsHTMLEditor::CollapseAdjacentTextNodes CVE-2012-1972: o Heap-use-after-free in nsObjectLoadingContent::LoadObject CVE-2012-1973: o Heap-use-after-free in gfxTextRun::CanBreakLineBefore CVE-2012-1974: o Heap-use-after-free in PresShell::CompleteMove CVE-2012-1975 o Heap-use-after-free in nsHTMLSelectElement::SubmitNamesValues CVE-2012-1976: o Heap-use-after-free in MediaStreamGraphThreadRunnable::Run() CVE-2012-3956: o Heap-buffer-overflow in nsBlockFrame::MarkLineDirty CVE-2012-3957: o Heap-use-after-free in nsHTMLEditRules::DeleteNonTableElements CVE-2012-3958: o Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode CVE-2012-3959: o Heap-use-after-free in mozSpellChecker::SetCurrentDictionary CVE-2012-3960: o Heap-use-after-free in RangeData::~RangeData CVE-2012-3961 o Bad iterator in text runs CVE-2012-3962 o use after free in js::gc::MapAllocToTraceKind CVE-2012-3963 o Heap-use-after-free READ 8 in gfxTextRun::GetUserData CVE-2012-3964: * MFSA 2012-59 / CVE-2012-1956: Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks. - Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack. (MFSA 2012-60 / CVE-2012-3965) - Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative
    last seen2020-06-05
    modified2012-09-14
    plugin id62096
    published2012-09-14
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62096
    titleSuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8269)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62096);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3974", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3979", "CVE-2012-3980");
    
      script_name(english:"SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8269)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "MozillaFirefox was updated to 10.0.7ESR release, fixing a lot of bugs
    and security problems.
    
    The following security issues have been addressed :
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-57)
    
        In general these flaws cannot be exploited through email
        in the Thunderbird and SeaMonkey products because
        scripting is disabled, but are potentially a risk in
        browser or browser-like contexts in those products.
    
      - Gary Kwong, Christian Holler, Jesse Ruderman, Steve
        Fink, Bob Clary, Andrew Sutherland, and Jason Smith
        reported memory safety problems and crashes that affect
        Firefox 14. (CVE-2012-1971)
    
      - Gary Kwong, Christian Holler, Jesse Ruderman, John
        Schoenick, Vladimir Vukicevic and Daniel Holbert
        reported memory safety problems and crashes that affect
        Firefox ESR 10 and Firefox 14. (CVE-2012-1970)
    
      - Security researcher Abhishek Arya (Inferno) of Google
        Chrome Security Team discovered a series of
        use-after-free issues using the Address Sanitizer tool.
        Many of these issues are potentially exploitable,
        allowing for remote code execution. (MFSA 2012-58)
    
        o Heap-use-after-free in
        nsHTMLEditor::CollapseAdjacentTextNodes CVE-2012-1972: o
        Heap-use-after-free in
        nsObjectLoadingContent::LoadObject CVE-2012-1973: o
        Heap-use-after-free in gfxTextRun::CanBreakLineBefore
        CVE-2012-1974: o Heap-use-after-free in
        PresShell::CompleteMove CVE-2012-1975 o
        Heap-use-after-free in
        nsHTMLSelectElement::SubmitNamesValues CVE-2012-1976: o
        Heap-use-after-free in
        MediaStreamGraphThreadRunnable::Run() CVE-2012-3956: o
        Heap-buffer-overflow in nsBlockFrame::MarkLineDirty
        CVE-2012-3957: o Heap-use-after-free in
        nsHTMLEditRules::DeleteNonTableElements CVE-2012-3958: o
        Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode
        CVE-2012-3959: o Heap-use-after-free in
        mozSpellChecker::SetCurrentDictionary CVE-2012-3960: o
        Heap-use-after-free in RangeData::~RangeData
        CVE-2012-3961 o Bad iterator in text runs CVE-2012-3962
        o use after free in js::gc::MapAllocToTraceKind
        CVE-2012-3963 o Heap-use-after-free READ 8 in
        gfxTextRun::GetUserData CVE-2012-3964: * MFSA 2012-59 /
        CVE-2012-1956: Security researcher Mariusz Mlynski
        reported that it is possible to shadow the location
        object using Object.defineProperty. This could be used
        to confuse the current location to plugins, allowing for
        possible cross-site scripting (XSS) attacks.
    
      - Security researcher Mariusz Mlynski reported that when a
        page opens a new tab, a subsequent window can then be
        opened that can be navigated to about:newtab, a chrome
        privileged page. Once about:newtab is loaded, the
        special context can potentially be used to escalate
        privilege, allowing for arbitrary code execution on the
        local system in a maliciously crafted attack. (MFSA
        2012-60 / CVE-2012-3965)
    
      - Security researcher Frederic Hoguin reported two related
        issues with the decoding of bitmap (.BMP) format images
        embedded in icon (.ICO) format files. When processing a
        negative 'height' header value for the bitmap image, a
        memory corruption can be induced, allowing an attacker
        to write random memory and cause a crash. This crash may
        be potentially exploitable. (MFSA 2012-61 /
        CVE-2012-3966)
    
      - Security researcher miaubiz used the Address Sanitizer
        tool to discover two WebGL issues. The first issue is a
        use-after-free when WebGL shaders are called after being
        destroyed. The second issue exposes a problem with Mesa
        drivers on Linux, leading to a potentially exploitable
        crash. (MFSA 2012-62)
    
        o
    
        use after free, webgl fragment shader deleted by
        accessor CVE-2012-3968: o
    
        stack scribbling with 4-byte values choosable among a
        few values, when using more than 16 sampler uniforms, on
        Mesa, with all drivers CVE-2012-3967
    
      - Security researcher Arthur Gerkis used the Address
        Sanitizer tool to find two issues involving Scalable
        Vector Graphics (SVG) files. The first issue is a buffer
        overflow in Gecko's SVG filter code when the sum of two
        values is too large to be stored as a signed 32-bit
        integer, causing the function to write past the end of
        an array. The second issue is a use-after-free when an
        element with a 'requiredFeatures' attribute is moved
        between documents. In that situation, the internal
        representation of the 'requiredFeatures' value could be
        freed prematurely. Both issues are potentially
        exploitable. (MFSA 2012-63)
    
        o
    
        Heap-buffer-overflow in nsSVGFEMorphologyElement::Filter
        CVE-2012-3969: o
    
        Heap-use-after-free in nsTArray_base::Length()
        CVE-2012-3970
    
      - Using the Address Sanitizer tool, Mozilla security
        researcher Christoph Diehl discovered two memory
        corruption issues involving the Graphite 2 library used
        in Mozilla products. Both of these issues can cause a
        potentially exploitable crash. These problems were fixed
        in the Graphite 2 library, which has been updated for
        Mozilla products. (MFSA 2012-64 / CVE-2012-3971)
    
      - Security research Nicolas Gregoire used the Address
        Sanitizer tool to discover an out-of-bounds read in the
        format-number feature of XSLT, which can cause
        inaccurate formatting of numbers and information
        leakage. This is not directly exploitable. (MFSA 2012-65
        / CVE-2012-3972)
    
      - Mozilla security researcher Mark Goodwin discovered an
        issue with the Firefox developer tools' debugger. If
        remote debugging is disabled, but the experimental
        HTTPMonitor extension has been installed and enabled, a
        remote user can connect to and use the remote debugging
        service through the port used by HTTPMonitor. A
        remote-enabled flag has been added to resolve this
        problem and close the port unless debugging is
        explicitly enabled. (MFSA 2012-66 / CVE-2012-3973)
    
      - Security researcher Masato Kinugawa reported that if a
        crafted executable is placed in the root partition on a
        Windows file system, the Firefox and Thunderbird
        installer will launch this program after a standard
        installation instead of Firefox or Thunderbird, running
        this program with the user's privileges. (MFSA 2012-67 /
        CVE-2012-3974)
    
      - Security researcher vsemozhetbyt reported that when the
        DOMParser is used to parse text/html data in a Firefox
        extension, linked resources within this HTML data will
        be loaded. If the data being parsed in the extension is
        untrusted, it could lead to information leakage and can
        potentially be combined with other attacks to become
        exploitable. (MFSA 2012-68 / CVE-2012-3975)
    
      - Security researcher Mark Poticha reported an issue where
        incorrect SSL certificate information can be displayed
        on the addressbar, showing the SSL data for a previous
        site while another has been loaded. This is caused by
        two onLocationChange events being fired out of the
        expected order, leading to the displayed certificate
        data to not be updated. This can be used for phishing
        attacks by allowing the user to input form or other data
        on a newer, attacking, site while the credentials of an
        older site appear on the addressbar. (MFSA 2012-69 /
        CVE-2012-3976)
    
      - Mozilla security researcher moz_bug_r_a4 reported that
        certain security checks in the location object can be
        bypassed if chrome code is called content in a specific
        manner. This allowed for the loading of restricted
        content. This can be combined with other issues to
        become potentially exploitable. (MFSA 2012-70 /
        CVE-2012-3978)
    
      - Mozilla developer Blake Kaplan reported that
        __android_log_print is called insecurely in places. If a
        malicious web page used a dump() statement with a
        specially crafted string, it can trigger a potentially
        exploitable crash. (MFSA 2012-71 / CVE-2012-3979)
    
        This vulnerability only affects Firefox for Android.
    
      - Security researcher Colby Russell discovered that eval
        in the web console can execute injected code with chrome
        privileges, leading to the running of malicious code in
        a privileged context. This allows for arbitrary code
        execution through a malicious web page if the web
        console is invoked by the user. (MFSA 2012-72 /
        CVE-2012-3980)"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-57.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-58.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-59.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-60.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-60/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-61.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-62.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-63.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-64.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-65.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-66.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-66/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-67.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-67/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-68.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-69.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-69/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-70.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-71.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-71/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-72.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1956.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1970.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1971.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1972.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1973.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1974.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1975.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1976.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3956.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3957.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3958.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3959.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3960.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3961.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3962.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3963.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3964.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3965.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3966.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3967.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3968.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3969.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3970.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3971.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3972.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3973.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3974.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3975.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3976.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3978.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3979.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3980.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 8269.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-10.0.7-0.5.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-branding-SLED-7-0.8.31")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"MozillaFirefox-translations-10.0.7-0.5.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"firefox3-cairo-1.2.4-0.8.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nspr-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nspr-devel-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-devel-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, reference:"mozilla-nss-tools-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"firefox3-cairo-32bit-1.2.4-0.8.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"mozilla-nspr-32bit-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-10.0.7-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-branding-SLED-7-0.8.31")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"MozillaFirefox-translations-10.0.7-0.5.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"firefox3-cairo-1.2.4-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nspr-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nspr-devel-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-devel-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, reference:"mozilla-nss-tools-3.13.6-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"firefox3-cairo-32bit-1.2.4-0.8.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"mozilla-nspr-32bit-4.9.2-0.9.1")) flag++;
    if (rpm_check(release:"SLES10", sp:4, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.6-0.8.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1551-2.NASL
    descriptionUSN-1551-1 fixed vulnerabilities in Thunderbird. The new package caused a regression in the message editor and certain performance regressions as well. This update fixes the problems. Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted E-Mail, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1970, CVE-2012-1971) Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted E-Mail, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964) Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted E-Mail, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain. (CVE-2012-1956) Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-3966) It was discovered that Thunderbird
    last seen2020-06-01
    modified2020-06-02
    plugin id62382
    published2012-09-29
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62382
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird regressions (USN-1551-2)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1551-2. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62382);
      script_version("1.10");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3975", "CVE-2012-3978", "CVE-2012-3980");
      script_bugtraq_id(55257, 55260, 55264, 55266, 55274, 55276, 55277, 55278, 55292, 55304, 55306, 55310, 55314, 55316, 55317, 55318, 55319, 55320, 55321, 55322, 55323, 55324, 55325, 55340, 55341, 55342);
      script_xref(name:"USN", value:"1551-2");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird regressions (USN-1551-2)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-1551-1 fixed vulnerabilities in Thunderbird. The new package
    caused a regression in the message editor and certain performance
    regressions as well. This update fixes the problems.
    
    Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary,
    Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and
    Daniel Holbert discovered memory safety issues affecting Thunderbird.
    If the user were tricked into opening a specially crafted E-Mail, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Thunderbird. (CVE-2012-1970, CVE-2012-1971)
    
    Abhishek Arya discovered multiple use-after-free
    vulnerabilities. If the user were tricked into opening a
    specially crafted E-Mail, an attacker could exploit these to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Thunderbird. (CVE-2012-1972, CVE-2012-1973,
    CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
    CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
    CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
    
    Mariusz Mlynsk discovered that it is possible to shadow the
    location object using Object.defineProperty. This could
    potentially result in a cross-site scripting (XSS) attack
    against plugins. With cross-site scripting vulnerabilities,
    if a user were tricked into viewing a specially crafted
    E-Mail, a remote attacker could exploit this to modify the
    contents or steal confidential data within the same domain.
    (CVE-2012-1956)
    
    Frederic Hoguin discovered that bitmap format images with
    a negative height could potentially result in memory
    corruption. If the user were tricked into opening a
    specially crafted image, an attacker could exploit this to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Thunderbird. (CVE-2012-3966)
    
    It was discovered that Thunderbird's WebGL implementation
    was vulnerable to multiple memory safety issues. If the user
    were tricked into opening a specially crafted E-Mail, an
    attacker could exploit these to cause a denial of service
    via application crash, or potentially execute code with the
    privileges of the user invoking Thunderbird. (CVE-2012-3967,
    CVE-2012-3968)
    
    Arthur Gerkis discovered multiple memory safety issues in
    Thunderbird's Scalable Vector Graphics (SVG) implementation.
    If the user were tricked into opening a specially crafted
    image, an attacker could exploit these to cause a denial of
    service via application crash, or potentially execute code
    with the privileges of the user invoking Thunderbird.
    (CVE-2012-3969, CVE-2012-3970)
    
    Christoph Diehl discovered multiple memory safety issues in
    the bundled Graphite 2 library. If the user were tricked
    into opening a specially crafted E-Mail, an attacker could
    exploit these to cause a denial of service via application
    crash, or potentially execute code with the privileges of
    the user invoking Thunderbird. (CVE-2012-3971)
    
    Nicolas Gregoire discovered an out-of-bounds read in the
    format-number feature of XSLT. This could potentially cause
    inaccurate formatting of numbers and information leakage.
    (CVE-2012-3972)
    
    It was discovered that when the DOMParser is used to parse
    text/html data in a Thunderbird extension, linked resources
    within this HTML data will be loaded. If the data being
    parsed in the extension is untrusted, it could lead to
    information leakage and potentially be combined with other
    attacks to become exploitable. (CVE-2012-3975)
    
    It was discovered that, in some instances, certain security
    checks in the location object could be bypassed. This could
    allow for the loading of restricted content and can
    potentially be combined with other issues to become
    exploitable. (CVE-2012-3978)
    
    Colby Russell discovered that eval in the web console can
    execute injected code with chrome privileges, leading to the
    running of malicious code in a privileged context. If the
    user were tricked into opening a specially crafted E-Mail,
    an attacker could exploit this to cause a denial of service
    via application crash, or potentially execute code with the
    privileges of the user invoking Thunderbird. (CVE-2012-3980).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1551-2/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected thunderbird and / or thunderbird-globalmenu
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird-globalmenu");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"thunderbird", pkgver:"15.0.1+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"thunderbird", pkgver:"15.0.1+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"thunderbird-globalmenu", pkgver:"15.0.1+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"thunderbird", pkgver:"15.0.1+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"thunderbird-globalmenu", pkgver:"15.0.1+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird", pkgver:"15.0.1+build1-0ubuntu0.12.04.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird-globalmenu", pkgver:"15.0.1+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird / thunderbird-globalmenu");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_15_0.NASL
    descriptionThe installed version of Thunderbird is earlier than 15.0 and thus, is potentially affected by the following security issues : - An error exists related to
    last seen2020-06-01
    modified2020-06-02
    plugin id61713
    published2012-08-29
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61713
    titleThunderbird < 15.0 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61713);
      script_version("1.16");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1956",
        "CVE-2012-1970",
        "CVE-2012-1971",
        "CVE-2012-1972",
        "CVE-2012-1973",
        "CVE-2012-1974",
        "CVE-2012-1975",
        "CVE-2012-1976",
        "CVE-2012-3956",
        "CVE-2012-3957",
        "CVE-2012-3958",
        "CVE-2012-3959",
        "CVE-2012-3960",
        "CVE-2012-3961",
        "CVE-2012-3962",
        "CVE-2012-3963",
        "CVE-2012-3964",
        "CVE-2012-3966",
        "CVE-2012-3968",
        "CVE-2012-3969",
        "CVE-2012-3970",
        "CVE-2012-3971",
        "CVE-2012-3972",
        "CVE-2012-3975",
        "CVE-2012-3978",
        "CVE-2012-3980"
      );
      script_bugtraq_id(
        55249,
        55257,
        55260,
        55264,
        55266,
        55274,
        55276,
        55278,
        55292,
        55304,
        55306,
        55310,
        55311,
        55314,
        55316,
        55317,
        55318,
        55319,
        55320,
        55321,
        55322,
        55323,
        55324,
        55325,
        55340,
        55341,
        55342
      );
    
      script_name(english:"Thunderbird < 15.0 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Mac OS X host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Thunderbird is earlier than 15.0 and thus,
    is potentially affected by the following security issues :
    
      - An error exists related to 'Object.defineProperty'
        and the location object that could allow cross-site
        scripting attacks. (CVE-2012-1956)
    
      - Unspecified memory safety issues exist. (CVE-2012-1970,
        CVE-2012-1971)
    
      - Multiple use-after-free errors exist. (CVE-2012-1972,
        CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,
        CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,
        CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
        CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
        CVE-2012-3964)
    
      - An error exists related to bitmap (BMP) and icon (ICO)
        file decoding that can lead to memory corruption,
        causing application crashes and potentially arbitrary
        code execution. (CVE-2012-3966)
    
      - A use-after-free error exists related to WebGL shaders.
        (CVE-2012-3968)
    
      - A buffer overflow exists related to SVG filters.
        (CVE-2012-3969)
    
      - A use-after-free error exists related to elements
        having 'requiredFeatures' attributes. (CVE-2012-3970)
    
      - A 'Graphite 2' library memory corruption error exists.
        (CVE-2012-3971)
      
      - An XSLT out-of-bounds read error exists related to
        'format-number'. (CVE-2012-3972)
    
      - The DOM parser can unintentionally load linked
        resources in extensions. (CVE-2012-3975)
    
      - Security checks related to location objects can be
        bypassed if crafted calls are made to the browser
        chrome code. (CVE-2012-3978)
    
      - Calling 'eval' in the web console can allow injected
        code to be executed with browser chrome privileges.
        (CVE-2012-3980)");
      script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/524145/30/0/threaded");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Thunderbird 15.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3971");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_thunderbird_installed.nasl");
      script_require_keys("MacOSX/Thunderbird/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Thunderbird";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    mozilla_check_version(product:'thunderbird', version:version, path:path, esr:FALSE, fix:'15.0', skippat:'^10\\.0\\.', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_150.NASL
    descriptionThe installed version of Firefox is earlier than 15.0 and thus, is potentially affected by the following security issues : - An error exists related to
    last seen2020-06-01
    modified2020-06-02
    plugin id61715
    published2012-08-29
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61715
    titleFirefox < 15.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61715);
      script_version("1.20");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1956",
        "CVE-2012-1970",
        "CVE-2012-1971",
        "CVE-2012-1972",
        "CVE-2012-1973",
        "CVE-2012-1974",
        "CVE-2012-1975",
        "CVE-2012-1976",
        "CVE-2012-3956",
        "CVE-2012-3957",
        "CVE-2012-3958",
        "CVE-2012-3959",
        "CVE-2012-3960",
        "CVE-2012-3961",
        "CVE-2012-3962",
        "CVE-2012-3963",
        "CVE-2012-3964",
        "CVE-2012-3965",
        "CVE-2012-3966",
        "CVE-2012-3968",
        "CVE-2012-3969",
        "CVE-2012-3970",
        "CVE-2012-3971",
        "CVE-2012-3972",
        "CVE-2012-3973",
        "CVE-2012-3974",
        "CVE-2012-3975",
        "CVE-2012-3976",
        "CVE-2012-3978",
        "CVE-2012-3980",
        "CVE-2012-4930"
      );
      script_bugtraq_id(
        55249,
        55256,
        55257,
        55260,
        55264,
        55266,
        55274,
        55276,
        55278,
        55292,
        55304,
        55306,
        55308,
        55310,
        55311,
        55312,
        55313,
        55314,
        55316,
        55317,
        55318,
        55319,
        55320,
        55321,
        55322,
        55323,
        55324,
        55325,
        55340,
        55341,
        55342
      );
    
      script_name(english:"Firefox < 15.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Firefox is earlier than 15.0 and thus, is
    potentially affected by the following security issues :
    
      - An error exists related to 'Object.defineProperty'
        and the location object and  can allow cross-site
        scripting attacks. (CVE-2012-1956)
    
      - Unspecified memory safety issues exist. (CVE-2012-1970,
        CVE-2012-1971)
    
      - Multiple use-after-free errors exist. (CVE-2012-1972,
        CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,
        CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,
        CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
        CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
        CVE-2012-3964)
    
      - An error exists related to 'about:newtab' and the
        browser's history. This error can allow a newly opened
        tab to further open a new window and navigate to the
        privileged 'about:newtab' page leading to possible
        privilege escalation. (CVE-2012-3965)
    
      - An error exists related to bitmap (BMP) and icon (ICO)
        file decoding that can lead to memory corruption
        causing application crashes and potentially arbitrary
        code execution. (CVE-2012-3966)
    
      - A use-after-free error exists related to WebGL shaders.
        (CVE-2012-3968)
    
      - A buffer overflow exists related to SVG filters.
        (CVE-2012-3969)
    
      - A use-after-free error exists related to elements
        having 'requiredFeatures' attributes. (CVE-2012-3970)
    
      - A 'Graphite 2' library memory corruption error exists.
        (CVE-2012-3971)
    
      - An XSLT out-of-bounds read error exists related to
        'format-number'. (CVE-2012-3972)
    
      - Remote debugging is possible even when disabled and the
        'HTTPMonitor' extension is enabled. (CVE-2012-3973)
    
      - The installer can be ticked into running unauthorized
        executables. (CVE-2012-3974)
    
      - The DOM parser can unintentionally load linked
        resources in extensions. (CVE-2012-3975)
    
      - Incorrect SSL certificate information can be displayed
        in the address bar when two 'onLocationChange' events
        fire out of order. (CVE-2012-3976)
    
      - Security checks related to location objects can be
        bypassed if crafted calls are made to the browser
        chrome code. (CVE-2012-3978)
    
      - Calling 'eval' in the web console can allow injected
        code to be executed with browser chrome privileges.
        (CVE-2012-3980)
    
      - SPDY's request header compression leads to information
        leakage, which can allow private data such as session
        cookies to be extracted, even over an SSL connection.
        (CVE-2012-4930)");
      script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/524145/30/0/threaded");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-60/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-66/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-67/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-69/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-73/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox 15.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3971");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport");
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'15.0', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_150.NASL
    descriptionThe installed version of Thunderbird is earlier than 15.0 and thus, is potentially affected by the following security issues : - An error exists related to
    last seen2020-06-01
    modified2020-06-02
    plugin id61717
    published2012-08-29
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61717
    titleMozilla Thunderbird < 15.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61717);
      script_version("1.17");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1956",
        "CVE-2012-1970",
        "CVE-2012-1971",
        "CVE-2012-1972",
        "CVE-2012-1973",
        "CVE-2012-1974",
        "CVE-2012-1975",
        "CVE-2012-1976",
        "CVE-2012-3956",
        "CVE-2012-3957",
        "CVE-2012-3958",
        "CVE-2012-3959",
        "CVE-2012-3960",
        "CVE-2012-3961",
        "CVE-2012-3962",
        "CVE-2012-3963",
        "CVE-2012-3964",
        "CVE-2012-3966",
        "CVE-2012-3968",
        "CVE-2012-3969",
        "CVE-2012-3970",
        "CVE-2012-3971",
        "CVE-2012-3972",
        "CVE-2012-3974",
        "CVE-2012-3975",
        "CVE-2012-3978",
        "CVE-2012-3980"
      );
      script_bugtraq_id(
        55249,
        55257,
        55260,
        55264,
        55266,
        55274,
        55276,
        55278,
        55292,
        55304,
        55306,
        55310,
        55311,
        55312,
        55314,
        55316,
        55317,
        55318,
        55319,
        55320,
        55321,
        55322,
        55323,
        55324,
        55325,
        55340,
        55341,
        55342
      );
    
      script_name(english:"Mozilla Thunderbird < 15.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Thunderbird is earlier than 15.0 and thus,
    is potentially affected by the following security issues :
    
      - An error exists related to 'Object.defineProperty'
        and the location object that could allow cross-site
        scripting attacks. (CVE-2012-1956)
    
      - Unspecified memory safety issues exist. (CVE-2012-1970,
        CVE-2012-1971)
    
      - Multiple use-after-free errors exist. (CVE-2012-1972,
        CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,
        CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,
        CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
        CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
        CVE-2012-3964)
    
      - An error exists related to bitmap (BMP) and icon (ICO)
        file decoding that can lead to memory corruption,
        causing application crashes and potentially arbitrary
        code execution. (CVE-2012-3966)
    
      - A use-after-free error exists related to WebGL shaders.
        (CVE-2012-3968)
    
      - A buffer overflow exists related to SVG filters.
        (CVE-2012-3969)
    
      - A use-after-free error exists related to elements
        having 'requiredFeatures' attributes. (CVE-2012-3970)
    
      - A 'Graphite 2' library memory corruption error exists.
        (CVE-2012-3971)
      
      - An XSLT out-of-bounds read error exists related to
        'format-number'. (CVE-2012-3972)
    
      - The installer can be tricked into running unauthorized
        executables. (CVE-2012-3974)
    
      - The DOM parser can unintentionally load linked
        resources in extensions. (CVE-2012-3975)
    
      - Security checks related to location objects can be
        bypassed if crafted calls are made to the browser
        chrome code. (CVE-2012-3978)
    
      - Calling 'eval' in the web console can allow injected
        code to be executed with browser chrome privileges.
        (CVE-2012-3980)");
      script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/524145/30/0/threaded");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-67/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Thunderbird 15.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-3971");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Thunderbird/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport");
    
    installs = get_kb_list("SMB/Mozilla/Thunderbird/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Thunderbird");
    
    mozilla_check_version(installs:installs, product:'thunderbird', esr:FALSE, fix:'15.0', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1548-1.NASL
    descriptionGary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971) Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964) Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain. (CVE-2012-1956) Mariusz Mlynski discovered an escalation of privilege vulnerability through about:newtab. This could possibly lead to potentially code execution with the privileges of the user invoking Firefox. (CVE-2012-3965) Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3966) It was discovered that Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id61730
    published2012-08-30
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61730
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1548-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1548-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61730);
      script_version("1.11");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3980");
      script_xref(name:"USN", value:"1548-1");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1548-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary,
    Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and
    Daniel Holbert discovered memory safety issues affecting Firefox. If
    the user were tricked into opening a specially crafted page, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971)
    
    Abhishek Arya discovered multiple use-after-free vulnerabilities. If
    the user were tricked into opening a specially crafted page, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973,
    CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
    CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
    CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
    
    Mariusz Mlynsk discovered that it is possible to shadow the location
    object using Object.defineProperty. This could potentially result in a
    cross-site scripting (XSS) attack against plugins. With cross-site
    scripting vulnerabilities, if a user were tricked into viewing a
    specially crafted page, a remote attacker could exploit this to modify
    the contents or steal confidential data within the same domain.
    (CVE-2012-1956)
    
    Mariusz Mlynski discovered an escalation of privilege vulnerability
    through about:newtab. This could possibly lead to potentially code
    execution with the privileges of the user invoking Firefox.
    (CVE-2012-3965)
    
    Frederic Hoguin discovered that bitmap format images with a negative
    height could potentially result in memory corruption. If the user were
    tricked into opening a specially crafted image, an attacker could
    exploit this to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Firefox. (CVE-2012-3966)
    
    It was discovered that Firefox's WebGL implementation was vulnerable
    to multiple memory safety issues. If the user were tricked into
    opening a specially crafted page, an attacker could exploit these to
    cause a denial of service via application crash, or potentially
    execute code with the privileges of the user invoking Firefox.
    (CVE-2012-3967, CVE-2012-3968)
    
    Arthur Gerkis discovered multiple memory safety issues in Firefox's
    Scalable Vector Graphics (SVG) implementation. If the user were
    tricked into opening a specially crafted image, an attacker could
    exploit these to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Firefox. (CVE-2012-3969, CVE-2012-3970)
    
    Christoph Diehl discovered multiple memory safety issues in the
    bundled Graphite 2 library. If the user were tricked into opening a
    specially crafted page, an attacker could exploit these to cause a
    denial of service via application crash, or potentially execute code
    with the privileges of the user invoking Firefox. (CVE-2012-3971)
    
    Nicolas Gregoire discovered an out-of-bounds read in the
    format-number feature of XSLT. This could potentially cause inaccurate
    formatting of numbers and information leakage. (CVE-2012-3972)
    
    Mark Goodwin discovered that under certain circumstances, Firefox's
    developer tools could allow remote debugging even when disabled.
    (CVE-2012-3973)
    
    It was discovered that when the DOMParser is used to parse text/html
    data in a Firefox extension, linked resources within this HTML data
    will be loaded. If the data being parsed in the extension is
    untrusted, it could lead to information leakage and potentially be
    combined with other attacks to become exploitable. (CVE-2012-3975)
    
    Mark Poticha discovered that under certain circumstances incorrect SSL
    certificate information can be displayed on the addressbar, showing
    the SSL data for a previous site while another has been loaded. This
    could potentially be used for phishing attacks. (CVE-2012-3976)
    
    It was discovered that, in some instances, certain security checks in
    the location object could be bypassed. This could allow for the
    loading of restricted content and can potentially be combined with
    other issues to become exploitable. (CVE-2012-3978)
    
    Colby Russell discovered that eval in the web console can execute
    injected code with chrome privileges, leading to the running of
    malicious code in a privileged context. If the user were tricked into
    opening a specially crafted page, an attacker could exploit this to
    cause a denial of service via application crash, or potentially
    execute code with the privileges of the user invoking Firefox.
    (CVE-2012-3980).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1548-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"firefox", pkgver:"15.0+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"firefox", pkgver:"15.0+build1-0ubuntu0.11.04.2")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"firefox", pkgver:"15.0+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"firefox", pkgver:"15.0+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1548-2.NASL
    descriptionUSN-1548-1 fixed vulnerabilities in Firefox. The new package caused a regression in Private Browsing which could leak sites visited to the browser cache. This update fixes the problem. Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971) Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964) Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain. (CVE-2012-1956) Mariusz Mlynski discovered an escalation of privilege vulnerability through about:newtab. This could possibly lead to potentially code execution with the privileges of the user invoking Firefox. (CVE-2012-3965) Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3966) It was discovered that Firefox
    last seen2020-06-01
    modified2020-06-02
    plugin id62062
    published2012-09-12
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62062
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox regression (USN-1548-2)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1548-2. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62062);
      script_version("1.9");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3980");
      script_xref(name:"USN", value:"1548-2");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox regression (USN-1548-2)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "USN-1548-1 fixed vulnerabilities in Firefox. The new package caused a
    regression in Private Browsing which could leak sites visited to the
    browser cache. This update fixes the problem.
    
    Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary,
    Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and
    Daniel Holbert discovered memory safety issues affecting Firefox. If
    the user were tricked into opening a specially crafted page, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971)
    
    Abhishek Arya discovered multiple use-after-free
    vulnerabilities. If the user were tricked into opening a
    specially crafted page, an attacker could exploit these to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2012-1972, CVE-2012-1973,
    CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
    CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
    CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
    
    Mariusz Mlynsk discovered that it is possible to shadow the
    location object using Object.defineProperty. This could
    potentially result in a cross-site scripting (XSS) attack
    against plugins. With cross-site scripting vulnerabilities,
    if a user were tricked into viewing a specially crafted
    page, a remote attacker could exploit this to modify the
    contents or steal confidential data within the same domain.
    (CVE-2012-1956)
    
    Mariusz Mlynski discovered an escalation of privilege
    vulnerability through about:newtab. This could possibly lead
    to potentially code execution with the privileges of the
    user invoking Firefox. (CVE-2012-3965)
    
    Frederic Hoguin discovered that bitmap format images with
    a negative height could potentially result in memory
    corruption. If the user were tricked into opening a
    specially crafted image, an attacker could exploit this to
    cause a denial of service via application crash, or
    potentially execute code with the privileges of the user
    invoking Firefox. (CVE-2012-3966)
    
    It was discovered that Firefox's WebGL implementation was
    vulnerable to multiple memory safety issues. If the user
    were tricked into opening a specially crafted page, an
    attacker could exploit these to cause a denial of service
    via application crash, or potentially execute code with the
    privileges of the user invoking Firefox. (CVE-2012-3967,
    CVE-2012-3968)
    
    Arthur Gerkis discovered multiple memory safety issues in
    Firefox's Scalable Vector Graphics (SVG) implementation. If
    the user were tricked into opening a specially crafted
    image, an attacker could exploit these to cause a denial of
    service via application crash, or potentially execute code
    with the privileges of the user invoking Firefox.
    (CVE-2012-3969, CVE-2012-3970)
    
    Christoph Diehl discovered multiple memory safety issues in
    the bundled Graphite 2 library. If the user were tricked
    into opening a specially crafted page, an attacker could
    exploit these to cause a denial of service via application
    crash, or potentially execute code with the privileges of
    the user invoking Firefox. (CVE-2012-3971)
    
    Nicolas Gregoire discovered an out-of-bounds read in the
    format-number feature of XSLT. This could potentially cause
    inaccurate formatting of numbers and information leakage.
    (CVE-2012-3972)
    
    Mark Goodwin discovered that under certain circumstances,
    Firefox's developer tools could allow remote debugging even
    when disabled. (CVE-2012-3973)
    
    It was discovered that when the DOMParser is used to parse
    text/html data in a Firefox extension, linked resources
    within this HTML data will be loaded. If the data being
    parsed in the extension is untrusted, it could lead to
    information leakage and potentially be combined with other
    attacks to become exploitable. (CVE-2012-3975)
    
    Mark Poticha discovered that under certain circumstances
    incorrect SSL certificate information can be displayed on
    the addressbar, showing the SSL data for a previous site
    while another has been loaded. This could potentially be
    used for phishing attacks. (CVE-2012-3976)
    
    It was discovered that, in some instances, certain security
    checks in the location object could be bypassed. This could
    allow for the loading of restricted content and can
    potentially be combined with other issues to become
    exploitable. (CVE-2012-3978)
    
    Colby Russell discovered that eval in the web console can
    execute injected code with chrome privileges, leading to the
    running of malicious code in a privileged context. If the
    user were tricked into opening a specially crafted page, an
    attacker could exploit this to cause a denial of service via
    application crash, or potentially execute code with the
    privileges of the user invoking Firefox. (CVE-2012-3980).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1548-2/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected firefox package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"firefox", pkgver:"15.0.1+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"firefox", pkgver:"15.0.1+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"firefox", pkgver:"15.0.1+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"firefox", pkgver:"15.0.1+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_2B8CAD90F28911E1A21514DAE9EBCF89.NASL
    descriptionThe Mozilla Project reports : MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7) MFSA 2012-58 Use-after-free issues found using Address Sanitizer MFSA 2012-59 Location object can be shadowed using Object.defineProperty MFSA 2012-60 Escalation of privilege through about:newtab MFSA 2012-61 Memory corruption with bitmap format images with negative height MFSA 2012-62 WebGL use-after-free and memory corruption MFSA 2012-63 SVG buffer overflow and use-after-free issues MFSA 2012-64 Graphite 2 memory corruption MFSA 2012-65 Out-of-bounds read in format-number in XSLT MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation MFSA 2012-67 Installer will launch incorrect executable following new installation MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html MFSA 2012-69 Incorrect site SSL certificate data display MFSA 2012-70 Location object security checks bypassed by chrome code MFSA 2012-71 Insecure use of __android_log_print MFSA 2012-72 Web console eval capable of executing chrome-privileged code
    last seen2020-06-01
    modified2020-06-02
    plugin id61741
    published2012-08-31
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61741
    titleFreeBSD : mozilla -- multiple vulnerabilities (2b8cad90-f289-11e1-a215-14dae9ebcf89)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2019 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61741);
      script_version("1.9");
      script_cvs_date("Date: 2019/07/10 16:04:13");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3974", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3979", "CVE-2012-3980");
    
      script_name(english:"FreeBSD : mozilla -- multiple vulnerabilities (2b8cad90-f289-11e1-a215-14dae9ebcf89)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The Mozilla Project reports :
    
    MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)
    
    MFSA 2012-58 Use-after-free issues found using Address Sanitizer
    
    MFSA 2012-59 Location object can be shadowed using
    Object.defineProperty
    
    MFSA 2012-60 Escalation of privilege through about:newtab
    
    MFSA 2012-61 Memory corruption with bitmap format images with negative
    height
    
    MFSA 2012-62 WebGL use-after-free and memory corruption
    
    MFSA 2012-63 SVG buffer overflow and use-after-free issues
    
    MFSA 2012-64 Graphite 2 memory corruption
    
    MFSA 2012-65 Out-of-bounds read in format-number in XSLT
    
    MFSA 2012-66 HTTPMonitor extension allows for remote debugging without
    explicit activation
    
    MFSA 2012-67 Installer will launch incorrect executable following new
    installation
    
    MFSA 2012-68 DOMParser loads linked resources in extensions when
    parsing text/html
    
    MFSA 2012-69 Incorrect site SSL certificate data display
    
    MFSA 2012-70 Location object security checks bypassed by chrome code
    
    MFSA 2012-71 Insecure use of __android_log_print
    
    MFSA 2012-72 Web console eval capable of executing chrome-privileged
    code"
      );
      # http://www.mozilla.org/security/known-vulnerabilities/
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/known-vulnerabilities/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-57.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-57/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-58.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-58/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-59.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-59/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-60.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-60/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-61.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-61/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-62.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-62/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-63.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-63/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-64.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-64/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-65.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-65/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-66.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-66/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-67.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-67/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-68.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-68/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-69.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-69/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-70.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-70/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-71.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-71/"
      );
      # http://www.mozilla.org/security/announce/2012/mfsa2012-72.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-72/"
      );
      # https://vuxml.freebsd.org/freebsd/2b8cad90-f289-11e1-a215-14dae9ebcf89.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?266b99d3"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libxul");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"firefox>11.0,1<15.0,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"firefox<10.0.7,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-firefox<10.0.7,1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-seamonkey<2.12")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-thunderbird<10.0.7")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"seamonkey<2.12")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"thunderbird>11.0<15.0")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"thunderbird<10.0.7")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"libxul>1.9.2.*<10.0.7")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201208-120831.NASL
    descriptionMozilla Firefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems. The following security issues have been addressed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-57) In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. - Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, and Jason Smith reported memory safety problems and crashes that affect Firefox 14. (CVE-2012-1971) - Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic and Daniel Holbert reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 14. (CVE-2012-1970) - Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. (MFSA 2012-58) - Heap-use-after-free in nsHTMLEditor::CollapseAdjacentTextNodes. (CVE-2012-1972) - Heap-use-after-free in nsObjectLoadingContent::LoadObject. (CVE-2012-1973) - Heap-use-after-free in gfxTextRun::CanBreakLineBefore. (CVE-2012-1974) - Heap-use-after-free in PresShell::CompleteMove. (CVE-2012-1975) - Heap-use-after-free in nsHTMLSelectElement::SubmitNamesValues. (CVE-2012-1976) - Heap-use-after-free in MediaStreamGraphThreadRunnable::Run(). (CVE-2012-3956) - Heap-buffer-overflow in nsBlockFrame::MarkLineDirty. (CVE-2012-3957) - Heap-use-after-free in nsHTMLEditRules::DeleteNonTableElements. (CVE-2012-3958) - Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode. (CVE-2012-3959) - Heap-use-after-free in mozSpellChecker::SetCurrentDictionary. (CVE-2012-3960) - Heap-use-after-free in RangeData::~RangeData. (CVE-2012-3961) - Bad iterator in text runs. (CVE-2012-3962) - use after free in js::gc::MapAllocToTraceKind. (CVE-2012-3963) - Heap-use-after-free READ 8 in gfxTextRun::GetUserData. (CVE-2012-3964) - Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks. (MFSA 2012-59 / CVE-2012-1956) - Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack. (MFSA 2012-60 / CVE-2012-3965) - Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative
    last seen2020-06-05
    modified2013-01-25
    plugin id64132
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64132
    titleSuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 6763)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64132);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3974", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3979", "CVE-2012-3980");
    
      script_name(english:"SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 6763)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox was updated to 10.0.7ESR release, fixing a lot of bugs
    and security problems.
    
    The following security issues have been addressed :
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-57)
    
        In general these flaws cannot be exploited through email
        in the Thunderbird and SeaMonkey products because
        scripting is disabled, but are potentially a risk in
        browser or browser-like contexts in those products.
    
      - Gary Kwong, Christian Holler, Jesse Ruderman, Steve
        Fink, Bob Clary, Andrew Sutherland, and Jason Smith
        reported memory safety problems and crashes that affect
        Firefox 14. (CVE-2012-1971)
    
      - Gary Kwong, Christian Holler, Jesse Ruderman, John
        Schoenick, Vladimir Vukicevic and Daniel Holbert
        reported memory safety problems and crashes that affect
        Firefox ESR 10 and Firefox 14. (CVE-2012-1970)
    
      - Security researcher Abhishek Arya (Inferno) of Google
        Chrome Security Team discovered a series of
        use-after-free issues using the Address Sanitizer tool.
        Many of these issues are potentially exploitable,
        allowing for remote code execution. (MFSA 2012-58)
    
      - Heap-use-after-free in
        nsHTMLEditor::CollapseAdjacentTextNodes. (CVE-2012-1972)
    
      - Heap-use-after-free in
        nsObjectLoadingContent::LoadObject. (CVE-2012-1973)
    
      - Heap-use-after-free in gfxTextRun::CanBreakLineBefore.
        (CVE-2012-1974)
    
      - Heap-use-after-free in PresShell::CompleteMove.
        (CVE-2012-1975)
    
      - Heap-use-after-free in
        nsHTMLSelectElement::SubmitNamesValues. (CVE-2012-1976)
    
      - Heap-use-after-free in
        MediaStreamGraphThreadRunnable::Run(). (CVE-2012-3956)
    
      - Heap-buffer-overflow in nsBlockFrame::MarkLineDirty.
        (CVE-2012-3957)
    
      - Heap-use-after-free in
        nsHTMLEditRules::DeleteNonTableElements. (CVE-2012-3958)
    
      - Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode.
        (CVE-2012-3959)
    
      - Heap-use-after-free in
        mozSpellChecker::SetCurrentDictionary. (CVE-2012-3960)
    
      - Heap-use-after-free in RangeData::~RangeData.
        (CVE-2012-3961)
    
      - Bad iterator in text runs. (CVE-2012-3962)
    
      - use after free in js::gc::MapAllocToTraceKind.
        (CVE-2012-3963)
    
      - Heap-use-after-free READ 8 in gfxTextRun::GetUserData.
        (CVE-2012-3964)
    
      - Security researcher Mariusz Mlynski reported that it is
        possible to shadow the location object using
        Object.defineProperty. This could be used to confuse the
        current location to plugins, allowing for possible
        cross-site scripting (XSS) attacks. (MFSA 2012-59 /
        CVE-2012-1956)
    
      - Security researcher Mariusz Mlynski reported that when a
        page opens a new tab, a subsequent window can then be
        opened that can be navigated to about:newtab, a chrome
        privileged page. Once about:newtab is loaded, the
        special context can potentially be used to escalate
        privilege, allowing for arbitrary code execution on the
        local system in a maliciously crafted attack. (MFSA
        2012-60 / CVE-2012-3965)
    
      - Security researcher Frederic Hoguin reported two related
        issues with the decoding of bitmap (.BMP) format images
        embedded in icon (.ICO) format files. When processing a
        negative 'height' header value for the bitmap image, a
        memory corruption can be induced, allowing an attacker
        to write random memory and cause a crash. This crash may
        be potentially exploitable. (MFSA 2012-61 /
        CVE-2012-3966)
    
      - Security researcher miaubiz used the Address Sanitizer
        tool to discover two WebGL issues. The first issue is a
        use-after-free when WebGL shaders are called after being
        destroyed. The second issue exposes a problem with Mesa
        drivers on Linux, leading to a potentially exploitable
        crash. (MFSA 2012-62)
    
      - use after free, webgl fragment shader deleted by
        accessor. (CVE-2012-3968)
    
      - stack scribbling with 4-byte values choosable among a
        few values, when using more than 16 sampler uniforms, on
        Mesa, with all drivers CVE-2012-3967
    
      - Security researcher Arthur Gerkis used the Address
        Sanitizer tool to find two issues involving Scalable
        Vector Graphics (SVG) files. The first issue is a buffer
        overflow in Gecko's SVG filter code when the sum of two
        values is too large to be stored as a signed 32-bit
        integer, causing the function to write past the end of
        an array. The second issue is a use-after-free when an
        element with a 'requiredFeatures' attribute is moved
        between documents. In that situation, the internal
        representation of the 'requiredFeatures' value could be
        freed prematurely. Both issues are potentially
        exploitable. (MFSA 2012-63)
    
      - Heap-buffer-overflow in
        nsSVGFEMorphologyElement::Filter. (CVE-2012-3969)
    
      - Heap-use-after-free in nsTArray_base::Length().
        (CVE-2012-3970)
    
      - Using the Address Sanitizer tool, Mozilla security
        researcher Christoph Diehl discovered two memory
        corruption issues involving the Graphite 2 library used
        in Mozilla products. Both of these issues can cause a
        potentially exploitable crash. These problems were fixed
        in the Graphite 2 library, which has been updated for
        Mozilla products. (MFSA 2012-64 / CVE-2012-3971)
    
      - Security research Nicolas Gregoire used the Address
        Sanitizer tool to discover an out-of-bounds read in the
        format-number feature of XSLT, which can cause
        inaccurate formatting of numbers and information
        leakage. This is not directly exploitable. (MFSA 2012-65
        / CVE-2012-3972)
    
      - Mozilla security researcher Mark Goodwin discovered an
        issue with the Firefox developer tools' debugger. If
        remote debugging is disabled, but the experimental
        HTTPMonitor extension has been installed and enabled, a
        remote user can connect to and use the remote debugging
        service through the port used by HTTPMonitor. A
        remote-enabled flag has been added to resolve this
        problem and close the port unless debugging is
        explicitly enabled. (MFSA 2012-66 / CVE-2012-3973)
    
      - Security researcher Masato Kinugawa reported that if a
        crafted executable is placed in the root partition on a
        Windows file system, the Firefox and Thunderbird
        installer will launch this program after a standard
        installation instead of Firefox or Thunderbird, running
        this program with the user's privileges. (MFSA 2012-67 /
        CVE-2012-3974)
    
      - Security researcher vsemozhetbyt reported that when the
        DOMParser is used to parse text/html data in a Firefox
        extension, linked resources within this HTML data will
        be loaded. If the data being parsed in the extension is
        untrusted, it could lead to information leakage and can
        potentially be combined with other attacks to become
        exploitable. (MFSA 2012-68 / CVE-2012-3975)
    
      - Security researcher Mark Poticha reported an issue where
        incorrect SSL certificate information can be displayed
        on the addressbar, showing the SSL data for a previous
        site while another has been loaded. This is caused by
        two onLocationChange events being fired out of the
        expected order, leading to the displayed certificate
        data to not be updated. This can be used for phishing
        attacks by allowing the user to input form or other data
        on a newer, attacking, site while the credentials of an
        older site appear on the addressbar. (MFSA 2012-69 /
        CVE-2012-3976)
    
      - Mozilla security researcher moz_bug_r_a4 reported that
        certain security checks in the location object can be
        bypassed if chrome code is called content in a specific
        manner. This allowed for the loading of restricted
        content. This can be combined with other issues to
        become potentially exploitable. (MFSA 2012-70 /
        CVE-2012-3978)
    
      - Mozilla developer Blake Kaplan reported that
        __android_log_print is called insecurely in places. If a
        malicious web page used a dump() statement with a
        specially crafted string, it can trigger a potentially
        exploitable crash. (MFSA 2012-71 / CVE-2012-3979)
    
        This vulnerability only affects Firefox for Android.
    
      - Security researcher Colby Russell discovered that eval
        in the web console can execute injected code with chrome
        privileges, leading to the running of malicious code in
        a privileged context. This allows for arbitrary code
        execution through a malicious web page if the web
        console is invoked by the user. (MFSA 2012-72 /
        CVE-2012-3980)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-57.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-58.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-59.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-60.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-61.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-62.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-63.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-64.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-65.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-66.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-67.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-68.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-69.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-70.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-71.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-72.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=777588"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1956.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1970.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1971.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1972.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1973.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1974.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1975.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1976.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3956.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3957.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3958.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3959.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3960.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3961.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3962.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3963.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3964.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3965.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3966.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3967.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3968.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3969.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3970.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3971.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3972.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3973.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3974.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3975.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3976.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3978.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3979.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3980.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6763.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-branding-SLED");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nspr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nspr-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 2) audit(AUDIT_OS_NOT, "SuSE 11.2");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"MozillaFirefox-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"MozillaFirefox-branding-SLED-7-0.6.7.80")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"MozillaFirefox-translations-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"libfreebl3-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"mozilla-nspr-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"mozilla-nss-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"i586", reference:"mozilla-nss-tools-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"MozillaFirefox-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"MozillaFirefox-branding-SLED-7-0.6.7.80")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"MozillaFirefox-translations-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"libfreebl3-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"mozilla-nspr-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"mozilla-nspr-32bit-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"mozilla-nss-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLED11", sp:2, cpu:"x86_64", reference:"mozilla-nss-tools-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"MozillaFirefox-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"MozillaFirefox-branding-SLED-7-0.6.7.80")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"MozillaFirefox-translations-10.0.7-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"libfreebl3-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"mozilla-nspr-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"mozilla-nss-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"mozilla-nss-tools-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"s390x", reference:"libfreebl3-32bit-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"s390x", reference:"mozilla-nspr-32bit-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"s390x", reference:"mozilla-nss-32bit-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"x86_64", reference:"libfreebl3-32bit-3.13.6-0.5.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"x86_64", reference:"mozilla-nspr-32bit-4.9.2-0.6.1")) flag++;
    if (rpm_check(release:"SLES11", sp:2, cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.6-0.5.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201301-01.
    #
    # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63402);
      script_version("1.27");
      script_cvs_date("Date: 2020/02/12");
    
      script_cve_id("CVE-2007-1861", "CVE-2007-2437", "CVE-2007-2671", "CVE-2007-3073", "CVE-2008-0016", "CVE-2008-0017", "CVE-2008-0367", "CVE-2008-3835", "CVE-2008-3836", "CVE-2008-3837", "CVE-2008-4058", "CVE-2008-4059", "CVE-2008-4060", "CVE-2008-4061", "CVE-2008-4062", "CVE-2008-4063", "CVE-2008-4064", "CVE-2008-4065", "CVE-2008-4066", "CVE-2008-4067", "CVE-2008-4068", "CVE-2008-4069", "CVE-2008-4070", "CVE-2008-4582", "CVE-2008-5012", "CVE-2008-5013", "CVE-2008-5014", "CVE-2008-5015", "CVE-2008-5016", "CVE-2008-5017", "CVE-2008-5018", "CVE-2008-5019", "CVE-2008-5021", "CVE-2008-5022", "CVE-2008-5023", "CVE-2008-5024", "CVE-2008-5052", "CVE-2008-5500", "CVE-2008-5501", "CVE-2008-5502", "CVE-2008-5503", "CVE-2008-5504", "CVE-2008-5505", "CVE-2008-5506", "CVE-2008-5507", "CVE-2008-5508", "CVE-2008-5510", "CVE-2008-5511", "CVE-2008-5512", "CVE-2008-5513", "CVE-2008-5822", "CVE-2008-5913", "CVE-2008-6961", "CVE-2009-0071", "CVE-2009-0352", "CVE-2009-0353", "CVE-2009-0354", "CVE-2009-0355", "CVE-2009-0356", "CVE-2009-0357", "CVE-2009-0358", "CVE-2009-0652", "CVE-2009-0689", "CVE-2009-0771", "CVE-2009-0772", "CVE-2009-0773", "CVE-2009-0774", "CVE-2009-0775", "CVE-2009-0776", "CVE-2009-0777", "CVE-2009-1044", "CVE-2009-1169", "CVE-2009-1302", "CVE-2009-1303", "CVE-2009-1304", "CVE-2009-1305", "CVE-2009-1306", "CVE-2009-1307", "CVE-2009-1308", "CVE-2009-1309", "CVE-2009-1310", "CVE-2009-1311", "CVE-2009-1312", "CVE-2009-1313", "CVE-2009-1392", "CVE-2009-1571", "CVE-2009-1828", "CVE-2009-1832", "CVE-2009-1833", "CVE-2009-1834", "CVE-2009-1835", "CVE-2009-1836", "CVE-2009-1837", "CVE-2009-1838", "CVE-2009-1839", "CVE-2009-1840", "CVE-2009-1841", "CVE-2009-2043", "CVE-2009-2044", "CVE-2009-2061", "CVE-2009-2065", "CVE-2009-2210", "CVE-2009-2404", "CVE-2009-2408", "CVE-2009-2462", "CVE-2009-2463", "CVE-2009-2464", "CVE-2009-2465", "CVE-2009-2466", "CVE-2009-2467", "CVE-2009-2469", "CVE-2009-2470", "CVE-2009-2471", "CVE-2009-2472", "CVE-2009-2477", "CVE-2009-2478", "CVE-2009-2479", "CVE-2009-2535", "CVE-2009-2654", "CVE-2009-2662", "CVE-2009-2664", "CVE-2009-2665", "CVE-2009-3069", "CVE-2009-3070", "CVE-2009-3071", "CVE-2009-3072", "CVE-2009-3074", "CVE-2009-3075", "CVE-2009-3076", "CVE-2009-3077", "CVE-2009-3078", "CVE-2009-3079", "CVE-2009-3274", "CVE-2009-3371", "CVE-2009-3372", "CVE-2009-3373", "CVE-2009-3374", "CVE-2009-3375", "CVE-2009-3376", "CVE-2009-3377", "CVE-2009-3378", "CVE-2009-3379", "CVE-2009-3380", "CVE-2009-3381", "CVE-2009-3382", "CVE-2009-3383", "CVE-2009-3388", "CVE-2009-3389", "CVE-2009-3555", "CVE-2009-3978", "CVE-2009-3979", "CVE-2009-3980", "CVE-2009-3981", "CVE-2009-3982", "CVE-2009-3983", "CVE-2009-3984", "CVE-2009-3985", "CVE-2009-3986", "CVE-2009-3987", "CVE-2009-3988", "CVE-2010-0159", "CVE-2010-0160", "CVE-2010-0162", "CVE-2010-0163", "CVE-2010-0164", "CVE-2010-0165", "CVE-2010-0166", "CVE-2010-0167", "CVE-2010-0168", "CVE-2010-0169", "CVE-2010-0170", "CVE-2010-0171", "CVE-2010-0172", "CVE-2010-0173", "CVE-2010-0174", "CVE-2010-0175", "CVE-2010-0176", "CVE-2010-0177", "CVE-2010-0178", "CVE-2010-0179", "CVE-2010-0181", "CVE-2010-0182", "CVE-2010-0183", "CVE-2010-0220", "CVE-2010-0648", "CVE-2010-0654", "CVE-2010-1028", "CVE-2010-1121", "CVE-2010-1125", "CVE-2010-1196", "CVE-2010-1197", "CVE-2010-1198", "CVE-2010-1199", "CVE-2010-1200", "CVE-2010-1201", "CVE-2010-1202", "CVE-2010-1203", "CVE-2010-1205", "CVE-2010-1206", "CVE-2010-1207", "CVE-2010-1208", "CVE-2010-1209", "CVE-2010-1210", "CVE-2010-1211", "CVE-2010-1212", "CVE-2010-1213", "CVE-2010-1214", "CVE-2010-1215", "CVE-2010-1585", "CVE-2010-2751", "CVE-2010-2752", "CVE-2010-2753", "CVE-2010-2754", "CVE-2010-2755", "CVE-2010-2760", "CVE-2010-2762", "CVE-2010-2763", "CVE-2010-2764", "CVE-2010-2765", "CVE-2010-2766", "CVE-2010-2767", "CVE-2010-2768", "CVE-2010-2769", "CVE-2010-2770", "CVE-2010-3131", "CVE-2010-3166", "CVE-2010-3167", "CVE-2010-3168", "CVE-2010-3169", "CVE-2010-3170", "CVE-2010-3171", "CVE-2010-3173", "CVE-2010-3174", "CVE-2010-3175", "CVE-2010-3176", "CVE-2010-3177", "CVE-2010-3178", "CVE-2010-3179", "CVE-2010-3180", "CVE-2010-3182", "CVE-2010-3183", "CVE-2010-3399", "CVE-2010-3400", "CVE-2010-3765", "CVE-2010-3766", "CVE-2010-3767", "CVE-2010-3768", "CVE-2010-3769", "CVE-2010-3770", "CVE-2010-3771", "CVE-2010-3772", "CVE-2010-3773", "CVE-2010-3774", "CVE-2010-3775", "CVE-2010-3776", "CVE-2010-3777", "CVE-2010-3778", "CVE-2010-4508", "CVE-2010-5074", "CVE-2011-0051", "CVE-2011-0053", "CVE-2011-0054", "CVE-2011-0055", "CVE-2011-0056", "CVE-2011-0057", "CVE-2011-0058", "CVE-2011-0059", "CVE-2011-0061", "CVE-2011-0062", "CVE-2011-0065", "CVE-2011-0066", "CVE-2011-0067", "CVE-2011-0068", "CVE-2011-0069", "CVE-2011-0070", "CVE-2011-0071", "CVE-2011-0072", "CVE-2011-0073", "CVE-2011-0074", "CVE-2011-0075", "CVE-2011-0076", "CVE-2011-0077", "CVE-2011-0078", "CVE-2011-0079", "CVE-2011-0080", "CVE-2011-0081", "CVE-2011-0082", "CVE-2011-0083", "CVE-2011-0084", "CVE-2011-0085", "CVE-2011-1187", "CVE-2011-1202", "CVE-2011-1712", "CVE-2011-2362", "CVE-2011-2363", "CVE-2011-2364", "CVE-2011-2365", "CVE-2011-2369", "CVE-2011-2370", "CVE-2011-2371", "CVE-2011-2372", "CVE-2011-2373", "CVE-2011-2374", "CVE-2011-2375", "CVE-2011-2376", "CVE-2011-2377", "CVE-2011-2378", "CVE-2011-2605", "CVE-2011-2980", "CVE-2011-2981", "CVE-2011-2982", "CVE-2011-2983", "CVE-2011-2984", "CVE-2011-2985", "CVE-2011-2986", "CVE-2011-2987", "CVE-2011-2988", "CVE-2011-2989", "CVE-2011-2990", "CVE-2011-2991", "CVE-2011-2993", "CVE-2011-2995", "CVE-2011-2996", "CVE-2011-2997", "CVE-2011-2998", "CVE-2011-2999", "CVE-2011-3000", "CVE-2011-3001", "CVE-2011-3002", "CVE-2011-3003", "CVE-2011-3004", "CVE-2011-3005", "CVE-2011-3026", "CVE-2011-3062", "CVE-2011-3101", "CVE-2011-3232", "CVE-2011-3389", "CVE-2011-3640", "CVE-2011-3647", "CVE-2011-3648", "CVE-2011-3649", "CVE-2011-3650", "CVE-2011-3651", "CVE-2011-3652", "CVE-2011-3653", "CVE-2011-3654", "CVE-2011-3655", "CVE-2011-3658", "CVE-2011-3659", "CVE-2011-3660", "CVE-2011-3661", "CVE-2011-3663", "CVE-2011-3665", "CVE-2011-3670", "CVE-2011-3866", "CVE-2011-4688", "CVE-2012-0441", "CVE-2012-0442", "CVE-2012-0443", "CVE-2012-0444", "CVE-2012-0445", "CVE-2012-0446", "CVE-2012-0447", "CVE-2012-0449", "CVE-2012-0450", "CVE-2012-0451", "CVE-2012-0452", "CVE-2012-0455", "CVE-2012-0456", "CVE-2012-0457", "CVE-2012-0458", "CVE-2012-0459", "CVE-2012-0460", "CVE-2012-0461", "CVE-2012-0462", "CVE-2012-0463", "CVE-2012-0464", "CVE-2012-0467", "CVE-2012-0468", "CVE-2012-0469", "CVE-2012-0470", "CVE-2012-0471", "CVE-2012-0473", "CVE-2012-0474", "CVE-2012-0475", "CVE-2012-0477", "CVE-2012-0478", "CVE-2012-0479", "CVE-2012-1937", "CVE-2012-1938", "CVE-2012-1939", "CVE-2012-1940", "CVE-2012-1941", "CVE-2012-1945", "CVE-2012-1946", "CVE-2012-1947", "CVE-2012-1948", "CVE-2012-1949", "CVE-2012-1950", "CVE-2012-1951", "CVE-2012-1952", "CVE-2012-1953", "CVE-2012-1954", "CVE-2012-1955", "CVE-2012-1956", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1960", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1965", "CVE-2012-1966", "CVE-2012-1967", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-1994", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3980", "CVE-2012-3982", "CVE-2012-3984", "CVE-2012-3985", "CVE-2012-3986", "CVE-2012-3988", "CVE-2012-3989", "CVE-2012-3990", "CVE-2012-3991", "CVE-2012-3992", "CVE-2012-3993", "CVE-2012-3994", "CVE-2012-3995", "CVE-2012-4179", "CVE-2012-4180", "CVE-2012-4181", "CVE-2012-4182", "CVE-2012-4183", "CVE-2012-4184", "CVE-2012-4185", "CVE-2012-4186", "CVE-2012-4187", "CVE-2012-4188", "CVE-2012-4190", "CVE-2012-4191", "CVE-2012-4192", "CVE-2012-4193", "CVE-2012-4194", "CVE-2012-4195", "CVE-2012-4196", "CVE-2012-4201", "CVE-2012-4202", "CVE-2012-4204", "CVE-2012-4205", "CVE-2012-4206", "CVE-2012-4207", "CVE-2012-4208", "CVE-2012-4209", "CVE-2012-4210", "CVE-2012-4212", "CVE-2012-4215", "CVE-2012-4216", "CVE-2012-4930", "CVE-2012-5354", "CVE-2012-5829", "CVE-2012-5830", "CVE-2012-5833", "CVE-2012-5835", "CVE-2012-5836", "CVE-2012-5838", "CVE-2012-5839", "CVE-2012-5840", "CVE-2012-5841", "CVE-2012-5842", "CVE-2012-5843");
      script_bugtraq_id(51752, 51753, 51754, 51756, 51757, 51765, 51787, 51975, 52456, 52457, 52458, 52459, 52460, 52461, 52463, 52464, 52465, 52466, 52467, 53219, 53220, 53221, 53223, 53224, 53225, 53227, 53228, 53229, 53230, 53231, 53315, 53791, 53792, 53793, 53794, 53796, 53797, 53798, 53799, 53800, 54572, 54573, 54574, 54575, 54576, 54577, 54578, 54579, 54580, 54581, 54582, 54583, 54584, 54585, 54586, 55257, 55260, 55264, 55266, 55274, 55276, 55277, 55278, 55292, 55304, 55306, 55308, 55310, 55311, 55313, 55314, 55316, 55317, 55318, 55319, 55320, 55321, 55322, 55323, 55324, 55325, 55340, 55342, 55857, 55922, 55924, 55926, 55927, 55930, 55931, 55932, 56118, 56119, 56120, 56121, 56123, 56125, 56126, 56127, 56128, 56129, 56130, 56131, 56135, 56136, 56140, 56151, 56153, 56154, 56155, 56301, 56302, 56306, 56611, 56612, 56613, 56614, 56616, 56618, 56621, 56625, 56627, 56629, 56630, 56631, 56632, 56633, 56634, 56635, 56636, 56637, 56641, 56642, 56643, 56644, 56646);
      script_xref(name:"GLSA", value:"201301-01");
    
      script_name(english:"GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201301-01
    (Mozilla Products: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Mozilla Firefox,
          Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the
          CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could entice a user to view a specially crafted web
          page or email, possibly resulting in execution of arbitrary code or a
          Denial of Service condition. Furthermore, a remote attacker may be able
          to perform Man-in-the-Middle attacks, obtain sensitive information,
          bypass restrictions and protection mechanisms, force file downloads,
          conduct XML injection attacks, conduct XSS attacks, bypass the Same
          Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical
          scroll, spoof the location bar, spoof an SSL indicator, modify the
          browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified
          impact.
        A local attacker could gain escalated privileges, obtain sensitive
          information, or replace an arbitrary downloaded file.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      # https://blog.mozilla.org/security/2011/03/22/firefox-blocking-fraudulent-certificates/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a9b416a4"
      );
      # https://www.mozilla.org/security/announce/2011/mfsa2011-11.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2011-11/"
      );
      # https://www.mozilla.org/security/announce/2011/mfsa2011-34.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/advisories/mfsa2011-34/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201301-01"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Mozilla Firefox users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/firefox-10.0.11'
        All users of the Mozilla Firefox binary package should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/firefox-bin-10.0.11'
        All Mozilla Thunderbird users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=mail-client/thunderbird-10.0.11'
        All users of the Mozilla Thunderbird binary package should upgrade to
          the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=mail-client/thunderbird-bin-10.0.11'
        All Mozilla SeaMonkey users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/seamonkey-2.14-r1'
        All users of the Mozilla SeaMonkey binary package should upgrade to the
          latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-client/seamonkey-bin-2.14'
        All NSS users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-libs/nss-3.14'
        The &ldquo;www-client/mozilla-firefox&rdquo; package has been merged into the
          &ldquo;www-client/firefox&rdquo; package. To upgrade, please unmerge
          &ldquo;www-client/mozilla-firefox&rdquo; and then emerge the latest
          &ldquo;www-client/firefox&rdquo; package:
          # emerge --sync
          # emerge --unmerge 'www-client/mozilla-firefox'
          # emerge --ask --oneshot --verbose '>=www-client/firefox-10.0.11'
        The &ldquo;www-client/mozilla-firefox-bin&rdquo; package has been merged into
          the &ldquo;www-client/firefox-bin&rdquo; package. To upgrade, please unmerge
          &ldquo;www-client/mozilla-firefox-bin&rdquo; and then emerge the latest
          &ldquo;www-client/firefox-bin&rdquo; package:
          # emerge --sync
          # emerge --unmerge 'www-client/mozilla-firefox-bin'
          # emerge --ask --oneshot --verbose '>=www-client/firefox-bin-10.0.11'
        The &ldquo;mail-client/mozilla-thunderbird&rdquo; package has been merged into
          the &ldquo;mail-client/thunderbird&rdquo; package. To upgrade, please unmerge
          &ldquo;mail-client/mozilla-thunderbird&rdquo; and then emerge the latest
          &ldquo;mail-client/thunderbird&rdquo; package:
          # emerge --sync
          # emerge --unmerge 'mail-client/mozilla-thunderbird'
          # emerge --ask --oneshot --verbose '>=mail-client/thunderbird-10.0.11'
        The &ldquo;mail-client/mozilla-thunderbird-bin&rdquo; package has been merged
          into the &ldquo;mail-client/thunderbird-bin&rdquo; package. To upgrade, please
          unmerge &ldquo;mail-client/mozilla-thunderbird-bin&rdquo; and then emerge the
          latest &ldquo;mail-client/thunderbird-bin&rdquo; package:
          # emerge --sync
          # emerge --unmerge 'mail-client/mozilla-thunderbird-bin'
          # emerge --ask --oneshot --verbose
          '>=mail-client/thunderbird-bin-10.0.11'
        Gentoo discontinued support for GNU IceCat. We recommend that users
          unmerge GNU IceCat:
          # emerge --unmerge 'www-client/icecat'
        Gentoo discontinued support for XULRunner. We recommend that users
          unmerge XULRunner:
          # emerge --unmerge 'net-libs/xulrunner'
        Gentoo discontinued support for the XULRunner binary package. We
          recommend that users unmerge XULRunner:
          # emerge --unmerge 'net-libs/xulrunner-bin'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploithub_sku", value:"EH-11-772");
      script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'White_Phosphorus');
      script_cwe_id(16, 20, 22, 59, 79, 94, 119, 189, 200, 264, 287, 310, 362, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:firefox-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:icecat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-firefox-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-thunderbird-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:seamonkey-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:thunderbird-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xulrunner-bin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/05/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/01/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/08");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"net-libs/xulrunner-bin", unaffected:make_list(), vulnerable:make_list("le 1.8.1.19"))) flag++;
    if (qpkg_check(package:"mail-client/thunderbird-bin", unaffected:make_list("ge 10.0.11"), vulnerable:make_list("lt 10.0.11"))) flag++;
    if (qpkg_check(package:"www-client/firefox", unaffected:make_list("ge 10.0.11"), vulnerable:make_list("lt 10.0.11"))) flag++;
    if (qpkg_check(package:"mail-client/thunderbird", unaffected:make_list("ge 10.0.11"), vulnerable:make_list("lt 10.0.11"))) flag++;
    if (qpkg_check(package:"mail-client/mozilla-thunderbird-bin", unaffected:make_list(), vulnerable:make_list("le 3.0"))) flag++;
    if (qpkg_check(package:"mail-client/mozilla-thunderbird", unaffected:make_list(), vulnerable:make_list("le 3.0.4-r1"))) flag++;
    if (qpkg_check(package:"dev-libs/nss", unaffected:make_list("ge 3.14"), vulnerable:make_list("lt 3.14"))) flag++;
    if (qpkg_check(package:"www-client/firefox-bin", unaffected:make_list("ge 10.0.11"), vulnerable:make_list("lt 10.0.11"))) flag++;
    if (qpkg_check(package:"net-libs/xulrunner", unaffected:make_list(), vulnerable:make_list("le 2.0-r1"))) flag++;
    if (qpkg_check(package:"www-client/mozilla-firefox-bin", unaffected:make_list(), vulnerable:make_list("le 3.5.6"))) flag++;
    if (qpkg_check(package:"www-client/seamonkey", unaffected:make_list("ge 2.14-r1"), vulnerable:make_list("lt 2.14-r1"))) flag++;
    if (qpkg_check(package:"www-client/icecat", unaffected:make_list(), vulnerable:make_list("le 10.0-r1"))) flag++;
    if (qpkg_check(package:"www-client/seamonkey-bin", unaffected:make_list("ge 2.14"), vulnerable:make_list("lt 2.14"))) flag++;
    if (qpkg_check(package:"www-client/mozilla-firefox", unaffected:make_list(), vulnerable:make_list("le 3.6.8"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Mozilla Products");
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1551-1.NASL
    descriptionGary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted E-Mail, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1970, CVE-2012-1971) Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted E-Mail, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964) Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted E-Mail, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain. (CVE-2012-1956) Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-3966) It was discovered that Thunderbird
    last seen2020-06-01
    modified2020-06-02
    plugin id61745
    published2012-08-31
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61745
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1551-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-1551-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61745);
      script_version("1.11");
      script_cvs_date("Date: 2019/09/19 12:54:28");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1971", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3975", "CVE-2012-3978", "CVE-2012-3980");
      script_xref(name:"USN", value:"1551-1");
    
      script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1551-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary,
    Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and
    Daniel Holbert discovered memory safety issues affecting Thunderbird.
    If the user were tricked into opening a specially crafted E-Mail, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Thunderbird. (CVE-2012-1970, CVE-2012-1971)
    
    Abhishek Arya discovered multiple use-after-free vulnerabilities. If
    the user were tricked into opening a specially crafted E-Mail, an
    attacker could exploit these to cause a denial of service via
    application crash, or potentially execute code with the privileges of
    the user invoking Thunderbird. (CVE-2012-1972, CVE-2012-1973,
    CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956,
    CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
    CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)
    
    Mariusz Mlynsk discovered that it is possible to shadow the location
    object using Object.defineProperty. This could potentially result in a
    cross-site scripting (XSS) attack against plugins. With cross-site
    scripting vulnerabilities, if a user were tricked into viewing a
    specially crafted E-Mail, a remote attacker could exploit this to
    modify the contents or steal confidential data within the same domain.
    (CVE-2012-1956)
    
    Frederic Hoguin discovered that bitmap format images with a negative
    height could potentially result in memory corruption. If the user were
    tricked into opening a specially crafted image, an attacker could
    exploit this to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Thunderbird. (CVE-2012-3966)
    
    It was discovered that Thunderbird's WebGL implementation was
    vulnerable to multiple memory safety issues. If the user were tricked
    into opening a specially crafted E-Mail, an attacker could exploit
    these to cause a denial of service via application crash, or
    potentially execute code with the privileges of the user invoking
    Thunderbird. (CVE-2012-3967, CVE-2012-3968)
    
    Arthur Gerkis discovered multiple memory safety issues in
    Thunderbird's Scalable Vector Graphics (SVG) implementation. If the
    user were tricked into opening a specially crafted image, an attacker
    could exploit these to cause a denial of service via application
    crash, or potentially execute code with the privileges of the user
    invoking Thunderbird. (CVE-2012-3969, CVE-2012-3970)
    
    Christoph Diehl discovered multiple memory safety issues in the
    bundled Graphite 2 library. If the user were tricked into opening a
    specially crafted E-Mail, an attacker could exploit these to cause a
    denial of service via application crash, or potentially execute code
    with the privileges of the user invoking Thunderbird. (CVE-2012-3971)
    
    Nicolas Gregoire discovered an out-of-bounds read in the
    format-number feature of XSLT. This could potentially cause inaccurate
    formatting of numbers and information leakage. (CVE-2012-3972)
    
    It was discovered that when the DOMParser is used to parse text/html
    data in a Thunderbird extension, linked resources within this HTML
    data will be loaded. If the data being parsed in the extension is
    untrusted, it could lead to information leakage and potentially be
    combined with other attacks to become exploitable. (CVE-2012-3975)
    
    It was discovered that, in some instances, certain security checks in
    the location object could be bypassed. This could allow for the
    loading of restricted content and can potentially be combined with
    other issues to become exploitable. (CVE-2012-3978)
    
    Colby Russell discovered that eval in the web console can execute
    injected code with chrome privileges, leading to the running of
    malicious code in a privileged context. If the user were tricked into
    opening a specially crafted E-Mail, an attacker could exploit this to
    cause a denial of service via application crash, or potentially
    execute code with the privileges of the user invoking Thunderbird.
    (CVE-2012-3980).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/1551-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected thunderbird package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"10.04", pkgname:"thunderbird", pkgver:"15.0+build1-0ubuntu0.10.04.1")) flag++;
    if (ubuntu_check(osver:"11.04", pkgname:"thunderbird", pkgver:"15.0+build1-0ubuntu0.11.04.1")) flag++;
    if (ubuntu_check(osver:"11.10", pkgname:"thunderbird", pkgver:"15.0+build1-0ubuntu0.11.10.1")) flag++;
    if (ubuntu_check(osver:"12.04", pkgname:"thunderbird", pkgver:"15.0+build1-0ubuntu0.12.04.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-538.NASL
    descriptionMozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update (bnc#777588) - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards - MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20 12-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/ CVE-2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/ CVE-2012-3964 Use-after-free issues found using Address Sanitizer - MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty - MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of privilege through about:newtab - MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height - MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption - MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues - MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption - MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT - MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor extension allows for remote debugging without explicit activation - MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html - MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site SSL certificate data display - MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code - MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - fix HTML5 video crash with GStreamer enabled (bmo#761030) - GStreamer is only used for MP4 (no WebM, OGG) - updated filelist - moved browser specific preferences to correct location
    last seen2020-06-05
    modified2014-06-13
    plugin id74729
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74729
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1065-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-538.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74729);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1956", "CVE-2012-1970", "CVE-2012-1972", "CVE-2012-1973", "CVE-2012-1974", "CVE-2012-1975", "CVE-2012-1976", "CVE-2012-3956", "CVE-2012-3957", "CVE-2012-3958", "CVE-2012-3959", "CVE-2012-3960", "CVE-2012-3961", "CVE-2012-3962", "CVE-2012-3963", "CVE-2012-3964", "CVE-2012-3965", "CVE-2012-3966", "CVE-2012-3967", "CVE-2012-3968", "CVE-2012-3969", "CVE-2012-3970", "CVE-2012-3971", "CVE-2012-3972", "CVE-2012-3973", "CVE-2012-3975", "CVE-2012-3976", "CVE-2012-3978", "CVE-2012-3980");
    
      script_name(english:"openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1065-1)");
      script_summary(english:"Check for the openSUSE-2012-538 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update
    (bnc#777588)
    
      - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety
        hazards
    
      - MFSA
        2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20
        12-1975
        CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/
        CVE-2012-3959
        CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/
        CVE-2012-3964 Use-after-free issues found using Address
        Sanitizer
    
      - MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object
        can be shadowed using Object.defineProperty
    
      - MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of
        privilege through about:newtab
    
      - MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793)
        Memory corruption with bitmap format images with
        negative height
    
      - MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL
        use-after-free and memory corruption
    
      - MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer
        overflow and use-after-free issues
    
      - MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption
    
      - MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds
        read in format-number in XSLT
    
      - MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor
        extension allows for remote debugging without explicit
        activation
    
      - MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads
        linked resources in extensions when parsing text/html
    
      - MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site
        SSL certificate data display
    
      - MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object
        security checks bypassed by chrome code
    
      - MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval
        capable of executing chrome-privileged code
    
      - fix HTML5 video crash with GStreamer enabled
        (bmo#761030)
    
      - GStreamer is only used for MP4 (no WebM, OGG)
    
      - updated filelist
    
      - moved browser specific preferences to correct location"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=777588"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-08/msg00045.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected MozillaFirefox packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:MozillaThunderbird-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:enigmail-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libfreebl3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsoftokn3-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-js-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-certs-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-sysinit-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:mozilla-nss-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-translations-other");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:seamonkey-venkman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-buildsymbols");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xulrunner-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-branding-upstream-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-buildsymbols-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-debuginfo-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-debugsource-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-devel-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-translations-common-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaFirefox-translations-other-15.0-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-buildsymbols-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-debuginfo-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-debugsource-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-devel-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-devel-debuginfo-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-translations-common-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"MozillaThunderbird-translations-other-15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"enigmail-1.4.4+15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"enigmail-debuginfo-1.4.4+15.0-49.9.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libfreebl3-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libfreebl3-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libsoftokn3-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libsoftokn3-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-js-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-js-debuginfo-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-certs-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-certs-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-debugsource-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-devel-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-sysinit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-sysinit-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-tools-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"mozilla-nss-tools-debuginfo-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-debuginfo-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-debugsource-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-dom-inspector-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-irc-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-translations-common-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-translations-other-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"seamonkey-venkman-2.12-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-buildsymbols-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-debuginfo-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-debugsource-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-devel-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"xulrunner-devel-debuginfo-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libfreebl3-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libfreebl3-debuginfo-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libsoftokn3-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libsoftokn3-debuginfo-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-js-32bit-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-js-debuginfo-32bit-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-certs-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-certs-debuginfo-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-debuginfo-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-sysinit-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"mozilla-nss-sysinit-debuginfo-32bit-3.13.6-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"xulrunner-32bit-15.0-2.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"xulrunner-debuginfo-32bit-15.0-2.8.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MozillaFirefox");
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-145.NASL
    descriptionSecurity issues were identified and fixed in mozilla firefox : Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1971). Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964). Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks (CVE-2012-1956). Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack (CVE-2012-3965). Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative height header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable (CVE-2012-3966). Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash (CVE-2012-3968, CVE-2012-3967). Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko
    last seen2020-06-01
    modified2020-06-02
    plugin id61989
    published2012-09-06
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61989
    titleMandriva Linux Security Advisory : firefox (MDVSA-2012:145)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-534.NASL
    descriptionMozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update (bnc#777588) - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards - MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20 12-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/ CVE-2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/ CVE-2012-3964 Use-after-free issues found using Address Sanitizer - MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty - MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of privilege through about:newtab - MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height - MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption - MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues - MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption - MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT - MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor extension allows for remote debugging without explicit activation - MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html - MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site SSL certificate data display - MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code - MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - fix HTML5 video crash with GStreamer enabled (bmo#761030) - GStreamer is only used for MP4 (no WebM, OGG) - updated filelist - moved browser specific preferences to correct location
    last seen2020-06-05
    modified2014-06-13
    plugin id74725
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74725
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1064-1)

Oval

accepted2014-10-06T04:01:48.319-04:00
classvulnerability
contributors
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
descriptionSummer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::readClassMap and (2) Pass::readPass functions.
familywindows
idoval:org.mitre.oval:def:16062
statusaccepted
submitted2013-05-13T10:26:26.748+04:00
titleSummer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::readClassMap and (2) Pass::readPass functions.
version35