Executive Summary

Summary
Title iceweasel security update
Informations
Name DSA-2565 First vendor Publication 2012-10-23
Vendor Debian Last vendor Modification 2012-10-23
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities have been discovered in Iceweasel, Debian's version of the Mozilla Firefox web browser. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2012-3982 Multiple unspecified vulnerabilities in the browser engine allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2012-3986 Iceweasel does not properly restrict calls to DOMWindowUtils methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.

CVE-2012-3990 A Use-after-free vulnerability in the IME State Manager implementation allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.

CVE-2012-3991 Iceweasel does not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.

CVE-2012-4179 A use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVE-2012-4180 A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2012-4182 A use-after-free vulnerability in the nsTextEditRules::WillInsert function allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVE-2012-4186 A heap-based buffer overflow in the nsWav-eReader::DecodeAudioData function allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2012-4188 A heap-based buffer overflow in the Convolve3x3 function allows remote attackers to execute arbitrary code via unspecified vectors.

For the stable distribution (squeeze), these problems have been fixed in version 3.5.16-19.

For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 10.0.8esr-1.

We recommend that you upgrade your iceweasel packages.

Original Source

Url : http://www.debian.org/security/2012/dsa-2565

CWE : Common Weakness Enumeration

% Id Name
38 % CWE-416 Use After Free
38 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
12 % CWE-264 Permissions, Privileges, and Access Controls
12 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:16191
 
Oval ID: oval:org.mitre.oval:def:16191
Title: Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Description: Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-4182
Version: 19
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16193
 
Oval ID: oval:org.mitre.oval:def:16193
Title: Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Description: Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-4186
Version: 19
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16428
 
Oval ID: oval:org.mitre.oval:def:16428
Title: Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Description: Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-4180
Version: 19
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16612
 
Oval ID: oval:org.mitre.oval:def:16612
Title: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-3982
Version: 18
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16642
 
Oval ID: oval:org.mitre.oval:def:16642
Title: Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
Description: Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
Family: windows Class: vulnerability
Reference(s): CVE-2012-3990
Version: 19
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16646
 
Oval ID: oval:org.mitre.oval:def:16646
Title: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.
Family: windows Class: vulnerability
Reference(s): CVE-2012-3991
Version: 18
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16834
 
Oval ID: oval:org.mitre.oval:def:16834
Title: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
Description: Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
Family: windows Class: vulnerability
Reference(s): CVE-2012-3986
Version: 18
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16882
 
Oval ID: oval:org.mitre.oval:def:16882
Title: Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Description: Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-4179
Version: 19
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:16964
 
Oval ID: oval:org.mitre.oval:def:16964
Title: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2012-4188
Version: 18
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 8
Microsoft Windows Server 2012
Product(s): Mozilla Firefox
Mozilla Thunderbird
Mozilla SeaMonkey
Mozilla Firefox ESR
Mozilla Thunderbird ESR
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18099
 
Oval ID: oval:org.mitre.oval:def:18099
Title: DSA-2569-1 icedove - several
Description: Multiple vulnerabilities have been discovered in Icedove, Debian's version of the Mozilla Thunderbird mail client.
Family: unix Class: patch
Reference(s): DSA-2569-1
CVE-2012-3982
CVE-2012-3986
CVE-2012-3990
CVE-2012-3991
CVE-2012-4179
CVE-2012-4180
CVE-2012-4182
CVE-2012-4186
CVE-2012-4188
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): icedove
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18202
 
Oval ID: oval:org.mitre.oval:def:18202
Title: USN-1600-1 -- firefox vulnerabilities
Description: Multiple security issues were fixed in Firefox.
Family: unix Class: patch
Reference(s): USN-1600-1
CVE-2012-3982
CVE-2012-3983
CVE-2012-3988
CVE-2012-3989
CVE-2012-3984
CVE-2012-3985
CVE-2012-3986
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-4184
CVE-2012-3990
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Product(s): firefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18498
 
Oval ID: oval:org.mitre.oval:def:18498
Title: DSA-2565-1 iceweasel - several
Description: Multiple vulnerabilities have been discovered in Iceweasel, Debian's version of the Mozilla Firefox web browser.
Family: unix Class: patch
Reference(s): DSA-2565-1
CVE-2012-3982
CVE-2012-3986
CVE-2012-3990
CVE-2012-3991
CVE-2012-4179
CVE-2012-4180
CVE-2012-4182
CVE-2012-4186
CVE-2012-4188
Version: 7
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): iceweasel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21310
 
Oval ID: oval:org.mitre.oval:def:21310
Title: RHSA-2012:1351: thunderbird security update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): RHSA-2012:1351-01
CESA-2012:1351
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 263
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21541
 
Oval ID: oval:org.mitre.oval:def:21541
Title: RHSA-2012:1350: firefox security and bug fix update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): RHSA-2012:1350-01
CESA-2012:1350
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 263
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23162
 
Oval ID: oval:org.mitre.oval:def:23162
Title: DEPRECATED: ELSA-2012:1350: firefox security and bug fix update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): ELSA-2012:1350-01
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 86
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23279
 
Oval ID: oval:org.mitre.oval:def:23279
Title: DEPRECATED: ELSA-2012:1351: thunderbird security update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): ELSA-2012:1351-01
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 86
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23317
 
Oval ID: oval:org.mitre.oval:def:23317
Title: ELSA-2012:1350: firefox security and bug fix update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): ELSA-2012:1350-01
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 85
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23475
 
Oval ID: oval:org.mitre.oval:def:23475
Title: ELSA-2012:1351: thunderbird security update (Critical)
Description: Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Family: unix Class: patch
Reference(s): ELSA-2012:1351-01
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 85
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27459
 
Oval ID: oval:org.mitre.oval:def:27459
Title: DEPRECATED: ELSA-2012-1351 -- thunderbird security update (critical)
Description: [10.0.8-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replace clean.gif in tarball [10.0.8-1] - Update to 10.0.8 ESR
Family: unix Class: patch
Reference(s): ELSA-2012-1351
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27697
 
Oval ID: oval:org.mitre.oval:def:27697
Title: DEPRECATED: ELSA-2012-1350 -- firefox security and bug fix update (critical)
Description: firefox [10.0.8-1.0.2.el6_3] - Updated firefox-oracle-default-prefs.js based on latest firefox-redhat-default-prefs.js [10.0.8-1.0.1.el6_3] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.8-1] - Update to 10.0.8 ESR xulrunner [10.0.8-1.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.8-1] - Update to 10.0.8 ESR
Family: unix Class: patch
Reference(s): ELSA-2012-1350
CVE-2012-1956
CVE-2012-3982
CVE-2012-3986
CVE-2012-3988
CVE-2012-3990
CVE-2012-3991
CVE-2012-3992
CVE-2012-3993
CVE-2012-3994
CVE-2012-3995
CVE-2012-4179
CVE-2012-4180
CVE-2012-4181
CVE-2012-4182
CVE-2012-4183
CVE-2012-4184
CVE-2012-4185
CVE-2012-4186
CVE-2012-4187
CVE-2012-4188
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): firefox
xulrunner
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 310
Application 11
Application 146
Application 209
Application 9
Os 4
Os 1
Os 1
Os 2
Os 1
Os 2
Os 2
Os 2
Os 1
Os 2

OpenVAS Exploits

Date Description
2012-12-13 Name : SuSE Update for MozillaFirefox openSUSE-SU-2012:1345-1 (MozillaFirefox)
File : nvt/gb_suse_2012_1345_1.nasl
2012-11-16 Name : Debian Security Advisory DSA 2569-1 (icedove)
File : nvt/deb_2569_1.nasl
2012-11-16 Name : Debian Security Advisory DSA 2572-1 (iceape)
File : nvt/deb_2572_1.nasl
2012-10-29 Name : Debian Security Advisory DSA 2565-1 (iceweasel)
File : nvt/deb_2565_1.nasl
2012-10-16 Name : Ubuntu Update for thunderbird USN-1611-1
File : nvt/gb_ubuntu_USN_1611_1.nasl
2012-10-15 Name : Mozilla Firefox Multiple Vulnerabilities-01 (Mac OS X)
File : nvt/gb_mozilla_prdts_mult_vuln01_oct12_macosx.nasl
2012-10-15 Name : Mozilla Firefox Multiple Vulnerabilities-01 (Windows)
File : nvt/gb_mozilla_prdts_mult_vuln01_oct12_win.nasl
2012-10-13 Name : FreeBSD Ports: firefox
File : nvt/freebsd_firefox70.nasl
2012-10-11 Name : CentOS Update for firefox CESA-2012:1350 centos5
File : nvt/gb_CESA-2012_1350_firefox_centos5.nasl
2012-10-11 Name : CentOS Update for firefox CESA-2012:1350 centos6
File : nvt/gb_CESA-2012_1350_firefox_centos6.nasl
2012-10-11 Name : CentOS Update for thunderbird CESA-2012:1351 centos5
File : nvt/gb_CESA-2012_1351_thunderbird_centos5.nasl
2012-10-11 Name : CentOS Update for thunderbird CESA-2012:1351 centos6
File : nvt/gb_CESA-2012_1351_thunderbird_centos6.nasl
2012-10-11 Name : RedHat Update for firefox RHSA-2012:1350-01
File : nvt/gb_RHSA-2012_1350-01_firefox.nasl
2012-10-11 Name : RedHat Update for thunderbird RHSA-2012:1351-01
File : nvt/gb_RHSA-2012_1351-01_thunderbird.nasl
2012-10-11 Name : Ubuntu Update for firefox USN-1600-1
File : nvt/gb_ubuntu_USN_1600_1.nasl

Snort® IPS/IDS

Date Description
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29546 - Revision : 4 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29545 - Revision : 4 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29544 - Revision : 4 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29543 - Revision : 4 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29542 - Revision : 3 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29541 - Revision : 3 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29540 - Revision : 3 - Type : FILE-MULTIMEDIA
2014-03-06 WAV processing buffer overflow attempt
RuleID : 29539 - Revision : 3 - Type : FILE-MULTIMEDIA

Nessus® Vulnerability Scanner

Date Description
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2012-1351-1.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-709.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2012-1351.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1350.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_firefox-201210-121015.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-11-05 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2572.nasl - Type : ACT_GATHER_INFO
2012-10-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2569.nasl - Type : ACT_GATHER_INFO
2012-10-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2565.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_160.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_firefox-201210-8327.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : A web browser on the remote host is affected by multiple flaws.
File : seamonkey_213.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_1008.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_160.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_1008.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Mac OS X host contains a mail client that is affected by multiple ...
File : macosx_thunderbird_16_0.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Mac OS X host contains a mail client that is affected by multiple ...
File : macosx_thunderbird_10_0_8.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_16_0.nasl - Type : ACT_GATHER_INFO
2012-10-17 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_10_0_8.nasl - Type : ACT_GATHER_INFO
2012-10-15 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1611-1.nasl - Type : ACT_GATHER_INFO
2012-10-11 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1350.nasl - Type : ACT_GATHER_INFO
2012-10-11 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20121009_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-10-11 Name : The remote Scientific Linux host is missing a security update.
File : sl_20121009_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-10-11 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_6e5a9afd12d311e2b47dc8600054b392.nasl - Type : ACT_GATHER_INFO
2012-10-11 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2012-1351.nasl - Type : ACT_GATHER_INFO
2012-10-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1350.nasl - Type : ACT_GATHER_INFO
2012-10-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1351.nasl - Type : ACT_GATHER_INFO
2012-10-10 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1600-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:31:25
  • Multiple Updates