Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Firefox vulnerabilities
Informations
Name USN-1509-1 First vendor Publication 2012-07-17
Vendor Ubuntu Last vendor Modification 2012-07-17
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Firefox.

Software Description: - firefox: Mozilla Open Source web browser

Details:

Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949)

Mario Gomes discovered that the address bar may be incorrectly updated. Drag-and-drop events in the address bar may cause the address of the previous site to be displayed while a new page is loaded. An attacker could exploit this to conduct phishing attacks. (CVE-2012-1950)

Abhishek Arya discovered four memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954)

Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks. (CVE-2012-1955)

Mario Heiderich discovered that HTML tags were not filtered out of the HTML of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via javascript execution in the HTML feed view. (CVE-2012-1957)

Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1958)

Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1959)

Tony Payne discovered an out-of-bounds memory read in Mozilla's color management library (QCMS). If the user were tricked into opening a specially crafted color profile, an attacker could possibly exploit this to cause a denial of service via application crash. (CVE-2012-1960)

Frédéric Buclin discovered that the X-Frame-Options header was ignored when its value was specified multiple times. An attacker could exploit this to conduct clickjacking attacks. (CVE-2012-1961)

Bill Keese discovered a memory corruption vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1962)

Karthikeyan Bhargavan discovered an information leakage vulnerability in the Content Security Policy (CSP) 1.0 implementation. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to access a user's OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

Matt McCutchen discovered a clickjacking vulnerability in the certificate warning page. A remote attacker could trick a user into accepting a malicious certificate via a crafted certificate warning page. (CVE-2012-1964)

Mario Gomes and Soroush Dalili discovered that javascript was not filtered out of feed URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1965)

A vulnerability was discovered in the context menu of data: URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1966)

It was discovered that the execution of javascript: URLs was not properly handled in some cases. A remote attacker could exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1967)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
firefox 14.0.1+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
firefox 14.0.1+build1-0ubuntu0.11.10.1

Ubuntu 11.04:
firefox 14.0.1+build1-0ubuntu0.11.04.1

Ubuntu 10.04 LTS:
firefox 14.0.1+build1-0ubuntu0.10.04.1

When upgrading, users should be aware of the following:

- In Ubuntu 11.04, unity-2d users may lose the ability to view drop-down menus, context menus, and perform drag-and-drop operations in Firefox. This is a known issue being tracked in https://launchpad.net/bugs/1020198 and may be fixed in a later update.

After a standard system update you need to restart Firefox to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1509-1
CVE-2012-1948, CVE-2012-1949, CVE-2012-1950, CVE-2012-1951,
CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1955,
CVE-2012-1957, CVE-2012-1958, CVE-2012-1959, CVE-2012-1960,
CVE-2012-1961, CVE-2012-1962, CVE-2012-1963, CVE-2012-1964,
CVE-2012-1965, CVE-2012-1966, CVE-2012-1967, https://launchpad.net/bugs/1020198,
https://launchpad.net/bugs/1024562

Package Information:
https://launchpad.net/ubuntu/+source/firefox/14.0.1+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/14.0.1+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/14.0.1+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/firefox/14.0.1+build1-0ubuntu0.10.04.1

Original Source

Url : http://www.ubuntu.com/usn/USN-1509-1

CWE : Common Weakness Enumeration

% Id Name
38 % CWE-399 Resource Management Errors
23 % CWE-264 Permissions, Privileges, and Access Controls
15 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
8 % CWE-200 Information Exposure
8 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
8 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:16077
 
Oval ID: oval:org.mitre.oval:def:16077
Title: Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code by interacting with objects used for SMIL Timing.
Description: Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code by interacting with objects used for SMIL Timing.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1951
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16434
 
Oval ID: oval:org.mitre.oval:def:16434
Title: Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 might allow remote attackers to execute arbitrary code via vectors related to focused content.
Description: Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 might allow remote attackers to execute arbitrary code via vectors related to focused content.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1958
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16729
 
Oval ID: oval:org.mitre.oval:def:16729
Title: Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via vectors involving strings with multiple dependencies.
Description: Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via vectors involving strings with multiple dependencies.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1962
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16735
 
Oval ID: oval:org.mitre.oval:def:16735
Title: The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile that triggers an out-of-bounds read operation.
Description: The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile that triggers an out-of-bounds read operation.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1960
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16744
 
Oval ID: oval:org.mitre.oval:def:16744
Title: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1948
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16783
 
Oval ID: oval:org.mitre.oval:def:16783
Title: The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
Description: The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1964
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16844
 
Oval ID: oval:org.mitre.oval:def:16844
Title: An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed.
Description: An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1957
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16894
 
Oval ID: oval:org.mitre.oval:def:16894
Title: The ElementAnimations::EnsureStyleRuleFor function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (buffer over-read, incorrect pointer dereference, and heap-based buffer overflow) or possibly execute arbitrary code via a crafted web site.
Description: The ElementAnimations::EnsureStyleRuleFor function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (buffer over-read, incorrect pointer dereference, and heap-based buffer overflow) or possibly execute arbitrary code via a crafted web site.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1953
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16920
 
Oval ID: oval:org.mitre.oval:def:16920
Title: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1959
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16942
 
Oval ID: oval:org.mitre.oval:def:16942
Title: The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of mixed row-group and column-group frames, which might allow remote attackers to execute arbitrary code via a crafted web site.
Description: The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of mixed row-group and column-group frames, which might allow remote attackers to execute arbitrary code via a crafted web site.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1952
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16970
 
Oval ID: oval:org.mitre.oval:def:16970
Title: The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
Description: The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1950
Version: 8
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Product(s): Mozilla Firefox
Mozilla Firefox ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16984
 
Oval ID: oval:org.mitre.oval:def:16984
Title: Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.
Description: Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1954
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16993
 
Oval ID: oval:org.mitre.oval:def:16993
Title: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values.
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1961
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17001
 
Oval ID: oval:org.mitre.oval:def:17001
Title: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feedhanisms via a feed:javascript: URL.
Description: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1965
Version: 9
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Product(s): Mozilla Firefox
Mozilla Firefox ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17004
 
Oval ID: oval:org.mitre.oval:def:17004
Title: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to spoof the address bar via vectors involving history.forward and history.back calls.
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to spoof the address bar via vectors involving history.forward and history.back calls.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1955
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17025
 
Oval ID: oval:org.mitre.oval:def:17025
Title: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1967
Version: 22
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17027
 
Oval ID: oval:org.mitre.oval:def:17027
Title: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1949
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17037
 
Oval ID: oval:org.mitre.oval:def:17037
Title: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for dataattacks via a crafted URL.
Description: Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1966
Version: 9
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Product(s): Mozilla Firefox
Mozilla Firefox ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17056
 
Oval ID: oval:org.mitre.oval:def:17056
Title: The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.
Description: The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.
Family: windows Class: vulnerability
Reference(s): CVE-2012-1963
Version: 21
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17819
 
Oval ID: oval:org.mitre.oval:def:17819
Title: USN-1509-2 -- ubufox update
Description: This update provides compatible ubufox packages for the latest Firefox.
Family: unix Class: patch
Reference(s): USN-1509-2
CVE-2012-1948
CVE-2012-1949
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1960
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Product(s): ubufox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17874
 
Oval ID: oval:org.mitre.oval:def:17874
Title: USN-1509-1 -- firefox vulnerabilities
Description: Several security issues were fixed in Firefox.
Family: unix Class: patch
Reference(s): USN-1509-1
CVE-2012-1948
CVE-2012-1949
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1960
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Product(s): firefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18018
 
Oval ID: oval:org.mitre.oval:def:18018
Title: USN-1510-1 -- thunderbird vulnerabilities
Description: Several security issues were fixed in Thunderbird.
Family: unix Class: patch
Reference(s): USN-1510-1
CVE-2012-1948
CVE-2012-1949
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1960
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1967
Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18528
 
Oval ID: oval:org.mitre.oval:def:18528
Title: DSA-2513-1 iceape - several vulnerabilities
Description: Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of Seamonkey.
Family: unix Class: patch
Reference(s): DSA-2513-1
CVE-2012-1948
CVE-2012-1954
CVE-2012-1967
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): iceape
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18598
 
Oval ID: oval:org.mitre.oval:def:18598
Title: DSA-2528-1 icedove - several
Description: Several vulnerabilities were discovered in Icedove, Debian's version of the Mozilla Thunderbird mail and news client.
Family: unix Class: patch
Reference(s): DSA-2528-1
CVE-2012-1948
CVE-2012-1950
CVE-2012-1954
CVE-2012-1967
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): icedove
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19963
 
Oval ID: oval:org.mitre.oval:def:19963
Title: DSA-2514-1 iceweasel - several vulnerabilities
Description: Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian.
Family: unix Class: patch
Reference(s): DSA-2514-1
CVE-2012-1948
CVE-2012-1950
CVE-2012-1954
CVE-2012-1966
CVE-2012-1967
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): iceweasel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21282
 
Oval ID: oval:org.mitre.oval:def:21282
Title: RHSA-2012:1089: thunderbird security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): RHSA-2012:1089-01
CESA-2012:1089
CVE-2012-1948
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1967
Version: 185
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21520
 
Oval ID: oval:org.mitre.oval:def:21520
Title: RHSA-2012:1088: firefox security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): RHSA-2012:1088-01
CESA-2012:1088
CVE-2012-1948
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 224
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22890
 
Oval ID: oval:org.mitre.oval:def:22890
Title: DEPRECATED: ELSA-2012:1089: thunderbird security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): ELSA-2012:1089-01
CVE-2012-1948
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1967
Version: 62
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23142
 
Oval ID: oval:org.mitre.oval:def:23142
Title: DEPRECATED: ELSA-2012:1088: firefox security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): ELSA-2012:1088-01
CVE-2012-1948
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 74
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23757
 
Oval ID: oval:org.mitre.oval:def:23757
Title: ELSA-2012:1089: thunderbird security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): ELSA-2012:1089-01
CVE-2012-1948
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1967
Version: 61
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23937
 
Oval ID: oval:org.mitre.oval:def:23937
Title: ELSA-2012:1088: firefox security update (Critical)
Description: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
Family: unix Class: patch
Reference(s): ELSA-2012:1088-01
CVE-2012-1948
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 73
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27116
 
Oval ID: oval:org.mitre.oval:def:27116
Title: DEPRECATED: ELSA-2012-1089 -- thunderbird security update (critical)
Description: [10.0.6-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replace clean.gif in tarball [10.0.6-1] - Update to 10.0.6 ESR
Family: unix Class: patch
Reference(s): ELSA-2012-1089
CVE-2012-1948
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1967
Version: 4
Platform(s): Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27863
 
Oval ID: oval:org.mitre.oval:def:27863
Title: DEPRECATED: ELSA-2012-1088 -- firefox security update (critical)
Description: firefox [10.0.6-1.0.1.el6_3] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.6-1] - Update to 10.0.6 ESR [10.0.5-3] - Enabled WebM [10.0.5-2] - Added fix for mozbz#703633, rhbz#818341 xulrunner [10.0.6-1.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.6-1] - Update to 10.0.6 ESR [10.0.5-3] - Added fix for rhbz#808136 (mozbz#762301) [10.0.5-2] - Enabled WebM (rhbz#798880)
Family: unix Class: patch
Reference(s): ELSA-2012-1088
CVE-2012-1948
CVE-2012-1950
CVE-2012-1951
CVE-2012-1952
CVE-2012-1953
CVE-2012-1954
CVE-2012-1955
CVE-2012-1957
CVE-2012-1958
CVE-2012-1959
CVE-2012-1961
CVE-2012-1962
CVE-2012-1963
CVE-2012-1964
CVE-2012-1965
CVE-2012-1966
CVE-2012-1967
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 29
Application 6
Application 130
Application 17
Application 6

OpenVAS Exploits

Date Description
2013-09-18 Name : Debian Security Advisory DSA 2513-1 (iceape - several vulnerabilities)
File : nvt/deb_2513_1.nasl
2012-12-13 Name : SuSE Update for seamonkey openSUSE-SU-2012:0935-1 (seamonkey)
File : nvt/gb_suse_2012_0935_1.nasl
2012-12-13 Name : SuSE Update for xulrunner openSUSE-SU-2012:0924-1 (xulrunner)
File : nvt/gb_suse_2012_0924_1.nasl
2012-12-13 Name : SuSE Update for MozillaThunderbird openSUSE-SU-2012:0917-1 (MozillaThunderbird)
File : nvt/gb_suse_2012_0917_1.nasl
2012-12-13 Name : SuSE Update for MozillaFirefox openSUSE-SU-2012:0899-1 (MozillaFirefox)
File : nvt/gb_suse_2012_0899_1.nasl
2012-08-30 Name : Debian Security Advisory DSA 2528-1 (icedove)
File : nvt/deb_2528_1.nasl
2012-08-10 Name : Debian Security Advisory DSA 2514-1 (iceweasel)
File : nvt/deb_2514_1.nasl
2012-08-10 Name : FreeBSD Ports: firefox
File : nvt/freebsd_firefox67.nasl
2012-08-03 Name : Mandriva Update for mozilla MDVSA-2012:110-1 (mozilla)
File : nvt/gb_mandriva_MDVSA_2012_110_1.nasl
2012-07-30 Name : CentOS Update for firefox CESA-2012:1088 centos5
File : nvt/gb_CESA-2012_1088_firefox_centos5.nasl
2012-07-30 Name : CentOS Update for firefox CESA-2012:1088 centos6
File : nvt/gb_CESA-2012_1088_firefox_centos6.nasl
2012-07-30 Name : CentOS Update for thunderbird CESA-2012:1089 centos5
File : nvt/gb_CESA-2012_1089_thunderbird_centos5.nasl
2012-07-30 Name : CentOS Update for thunderbird CESA-2012:1089 centos6
File : nvt/gb_CESA-2012_1089_thunderbird_centos6.nasl
2012-07-26 Name : Mandriva Update for mozilla MDVSA-2012:110 (mozilla)
File : nvt/gb_mandriva_MDVSA_2012_110.nasl
2012-07-24 Name : Mozilla Products Memory Corruption Vulnerabilities - July12 (Windows)
File : nvt/gb_mozilla_prdts_mem_corr_vuln_jul12_win.nasl
2012-07-24 Name : Mozilla Products Memory Corruption Vulnerabilities - July12 (Mac OS X)
File : nvt/gb_mozilla_prdts_mem_corr_vuln_jul12_macosx.nasl
2012-07-23 Name : Mozilla Products Certificate Page Clickjacking Vulnerability (Windows)
File : nvt/gb_mozilla_prdts_clickjacking_vuln_win.nasl
2012-07-23 Name : Mozilla Products Multiple Vulnerabilities - July12 (Mac OS X)
File : nvt/gb_mozilla_prdts_mult_vuln_jul12_macosx.nasl
2012-07-23 Name : Mozilla Products Multiple Vulnerabilities - July12 (Windows)
File : nvt/gb_mozilla_prdts_mult_vuln_jul12_win.nasl
2012-07-23 Name : Mozilla Products Certificate Page Clickjacking Vulnerability (Mac OS X)
File : nvt/gb_mozilla_prdts_clickjacking_vuln_macosx.nasl
2012-07-23 Name : Mozilla Firefox Multiple Vulnerabilities - July12 (Windows)
File : nvt/gb_mozilla_firefox_mult_vuln_jul12_win.nasl
2012-07-23 Name : Mozilla Firefox Multiple Vulnerabilities - July12 (Mac OS X)
File : nvt/gb_mozilla_firefox_mult_vuln_jul12_macosx.nasl
2012-07-19 Name : RedHat Update for thunderbird RHSA-2012:1089-01
File : nvt/gb_RHSA-2012_1089-01_thunderbird.nasl
2012-07-19 Name : Ubuntu Update for firefox USN-1509-1
File : nvt/gb_ubuntu_USN_1509_1.nasl
2012-07-19 Name : Ubuntu Update for ubufox USN-1509-2
File : nvt/gb_ubuntu_USN_1509_2.nasl
2012-07-19 Name : Ubuntu Update for thunderbird USN-1510-1
File : nvt/gb_ubuntu_USN_1510_1.nasl
2012-07-19 Name : RedHat Update for firefox RHSA-2012:1088-01
File : nvt/gb_RHSA-2012_1088-01_firefox.nasl

Snort® IPS/IDS

Date Description
2014-01-10 Mozilla Multiple Products table frames memory corruption attempt
RuleID : 23790 - Revision : 8 - Type : BROWSER-FIREFOX
2014-01-10 Mozilla Multiple Products table frames memory corruption attempt
RuleID : 23789 - Revision : 11 - Type : BROWSER-FIREFOX

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_thunderbird_20130129.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_firefox_20130129.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-410.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-443.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-465.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-473.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2012-1089.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1088.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_firefox-201207-120719.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-09-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-110.nasl - Type : ACT_GATHER_INFO
2012-08-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2528.nasl - Type : ACT_GATHER_INFO
2012-08-03 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_dbf338d0dce511e1b65514dae9ebcf89.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120717_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120717_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-07-23 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_firefox-201207-8226.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Windows host contains a mail client that is potentially affected b...
File : mozilla_thunderbird_140.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : seamonkey_211.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Windows host contains a mail client that is potentially affected b...
File : mozilla_thunderbird_1006.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_140.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_10_0_6.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_14_0.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_1006.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Mac OS X host contains a mail client that is potentially affected ...
File : macosx_thunderbird_14_0.nasl - Type : ACT_GATHER_INFO
2012-07-19 Name : The remote Mac OS X host contains a mail client that is potentially affected ...
File : macosx_thunderbird_10_0_6.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1088.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2012-1089.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2513.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2514.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1510-1.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1509-2.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1509-1.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1089.nasl - Type : ACT_GATHER_INFO
2012-07-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1088.nasl - Type : ACT_GATHER_INFO
2012-06-07 Name : The remote Mac OS X host contains a mail client that is potentially affected ...
File : macosx_thunderbird_13_0.nasl - Type : ACT_GATHER_INFO
2012-06-07 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_130.nasl - Type : ACT_GATHER_INFO
2012-06-07 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_13_0.nasl - Type : ACT_GATHER_INFO
2012-06-07 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : seamonkey_210.nasl - Type : ACT_GATHER_INFO
2012-06-07 Name : The remote Windows host contains a mail client that is potentially affected b...
File : mozilla_thunderbird_130.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:00:26
  • Multiple Updates