Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.

The remote Solaris system is missing necessary patches to address security updates :

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 4.x through 13.0, Firefox ESR     10.x before 10.0.6, Thunderbird 5.0 through 13.0,     Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before     2.11 allow remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
    (CVE-2012-1948)

  - The drag-and-drop implementation in Mozilla Firefox 4.x     through 13.0 and Firefox ESR 10.x before 10.0.6 allows     remote attackers to spoof the address bar by canceling a     page load. (CVE-2012-1950)

  - Use-after-free vulnerability in the     nsSMILTimeValueSpec::IsEventBased function in Mozilla     Firefox 4.x through 13.0, Firefox ESR 10.x before     10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR     10.x before 10.0.6, and SeaMonkey before 2.11 allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly execute arbitrary code by     interacting with objects used for SMIL Timing.
    (CVE-2012-1951)

  - The nsTableFrame::InsertFrames function in Mozilla     Firefox 4.x through 13.0, Firefox ESR 10.x before     10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR     10.x before 10.0.6, and SeaMonkey before 2.11 does not     properly perform a cast of a frame variable during     processing of mixed row-group and column-group frames,     which might allow remote attackers to execute arbitrary     code via a crafted web site. (CVE-2012-1952)

  - The ElementAnimations::EnsureStyleRuleFor function in     Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows     remote attackers to cause a denial of service (buffer     over-read, incorrect pointer dereference, and heap-based     buffer overflow) or possibly execute arbitrary code via     a crafted web site. (CVE-2012-1953)

  - Use-after-free vulnerability in the     nsDocument::AdoptNode function in Mozilla Firefox 4.x     through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 allows remote     attackers to cause a denial of service (heap memory     corruption) or possibly execute arbitrary code via     vectors involving multiple adoptions and empty     documents. (CVE-2012-1954)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow     remote attackers to spoof the address bar via vectors     involving history.forward and history.back calls.
    (CVE-2012-1955)

  - An unspecified parser-utility class in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 does not     properly handle EMBED elements within description     elements in RSS feeds, which allows remote attackers to     conduct cross-site scripting (XSS) attacks via a feed.
    (CVE-2012-1957)

  - Use-after-free vulnerability in the     nsGlobalWindow::PageHidden function in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 might allow     remote attackers to execute arbitrary code via vectors     related to focused content. (CVE-2012-1958)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     consider the presence of same-compartment security     wrappers (SCSW) during the cross-compartment wrapping of     objects, which allows remote attackers to bypass     intended XBL access restrictions via crafted content.
    (CVE-2012-1959)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     properly handle duplicate values in X-Frame-Options     headers, which makes it easier for remote attackers to     conduct clickjacking attacks via a FRAME element     referencing a web site that produces these duplicate     values. (CVE-2012-1961)

  - Use-after-free vulnerability in the     JSDependentString::undepend function in Mozilla Firefox     4.x through 13.0, Firefox ESR 10.x before 10.0.6,     Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x     before 10.0.6, and SeaMonkey before 2.11 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via     vectors involving strings with multiple dependencies.
    (CVE-2012-1962)

  - The Content Security Policy (CSP) functionality in     Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does     not properly restrict the strings placed into the     blocked-uri parameter of a violation report, which     allows remote web servers to capture OpenID credentials     and OAuth 2.0 access tokens by triggering a violation.
    (CVE-2012-1963)

  - The certificate-warning functionality in     browser/components/certerror/content/     aboutCertError.xhtml in Mozilla Firefox 4.x through     12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0     through 12.0, Thunderbird ESR 10.x before 10.0.6, and     SeaMonkey before 2.10 does not properly handle attempted     clickjacking of the about:certerror page, which allows     man-in-the-middle attackers to trick users into adding     an unintended exception via an IFRAME element.
    (CVE-2012-1964)

  - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x     before 10.0.6 do not properly establish the security     context of a feed: URL, which allows remote attackers to     bypass unspecified cross-site scripting (XSS) protection     mechanisms via a feed:javascript: URL. (CVE-2012-1965)

  - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x     before 10.0.6 do not have the same context-menu     restrictions for data: URLs as for javascript: URLs,     which allows remote attackers to conduct cross-site     scripting (XSS) attacks via a crafted URL.
    (CVE-2012-1966)

  - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x     before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird     ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not     properly implement the JavaScript sandbox utility, which     allows remote attackers to execute arbitrary JavaScript     code with improper privileges via a javascript: URL.
    (CVE-2012-1967)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 15.0, Firefox ESR 10.x     before 10.0.7, Thunderbird before 15.0, Thunderbird ESR     10.x before 10.0.7, and SeaMonkey before 2.12 allow     remote attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (CVE-2012-1970)

  - Use-after-free vulnerability in the     nsObjectLoadingContent::LoadObject function in Mozilla     Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before     10.0.7, and SeaMonkey before 2.12 allows remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via unspecified     vectors. (CVE-2012-1973)

  - Mozilla Firefox before 15.0, Firefox ESR 10.x before     10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allow remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a negative height value     in a BMP image within a .ICO file, related to (1)     improper handling of the transparency bitmask by the     nsICODecoder component and (2) improper processing of     the alpha channel by the nsBMPDecoder component.
    (CVE-2012-3966)

Mozilla XULRunner was updated to 14.0.1, fixing bugs and security issues :

Following security issues were fixed: MFSA 2012-42: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

CVE-2012-1949: Brian Smith, Gary Kwong, Christian Holler, Jesse Ruderman, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey reported memory safety problems and crashes that affect Firefox 13.

CVE-2012-1948: Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13.

MFSA 2012-43 / CVE-2012-1950: Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page.
This could lead to potential phishing attacks on users.

MFSA 2012-44

Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix.

All four of these issues are potentially exploitable. CVE-2012-1951:
Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames

MFSA 2012-45 / CVE-2012-1955: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. 

MFSA 2012-46 / CVE-2012-1966: Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality ('View Image', 'Show only this frame', and 'View background image') are disallowed in a javascript: URL but allowed in a data: URL, allowing for XSS. This can lead to arbitrary code execution.

MFSA 2012-47 / CVE-2012-1957: Security researcher Mario Heiderich reported that JavaScript could be executed in the HTML feed-view using tag within the RSS . This problem is due to tags not being filtered out during parsing and can lead to a potential cross-site scripting (XSS) attack. The flaw existed in a parser utility class and could affect other parts of the browser or add-ons which rely on that class to sanitize untrusted input.

MFSA 2012-48 / CVE-2012-1958: Security researcher Arthur Gerkis used the Address Sanitizer tool to find a use-after-free in nsGlobalWindow::PageHidden when mFocusedContent is released and oldFocusedContent is used afterwards. This use-after-free could possibly allow for remote code execution.

MFSA 2012-49 / CVE-2012-1959: Mozilla developer Bobby Holley found that same-compartment security wrappers (SCSW) can be bypassed by passing them to another compartment. Cross-compartment wrappers often do not go through SCSW,

but have a filtering policy built into them. When an object is wrapped cross-compartment, the SCSW is stripped off and, when the object is read read back, it is not known that SCSW was previously present, resulting in a bypassing of SCSW. This could result in untrusted content having access to the XBL that implements browser functionality.

MFSA 2012-50 / CVE-2012-1960: Google developer Tony Payne reported an out of bounds (OOB) read in QCMS, Mozilla&rsquo;s color management library. With a carefully crafted color profile portions of a user's memory could be incorporated into a transformed image and possibly deciphered.

MFSA 2012-51 / CVE-2012-1961: Bugzilla developer Fr&eacute;d&eacute;ric Buclin reported that the 'X-Frame-Options header is ignored when the value is duplicated, for example X-Frame-Options: SAMEORIGIN, SAMEORIGIN. This duplication occurs for unknown reasons on some websites and when it occurs results in Mozilla browsers not being protected against possible clickjacking attacks on those pages.

MFSA 2012-52 / CVE-2012-1962: Security researcher Bill Keese reported a memory corruption. This is caused by JSDependentString::undepend changing a dependent string into a fixed string when there are additional dependent strings relying on the same base. When the undepend occurs during conversion, the base data is freed, leaving other dependent strings with dangling pointers. This can lead to a potentially exploitable crash.

MFSA 2012-53 / CVE-2012-1963: Security researcher Karthikeyan Bhargavan of Prosecco at INRIA reported Content Security Policy (CSP) 1.0 implementation errors. CSP violation reports generated by Firefox and sent to the 'report-uri' location include sensitive data within the 'blocked-uri' parameter. These include fragment components and query strings even if the 'blocked-uri' parameter has a different origin than the protected resource. This can be used to retrieve a user's OAuth 2.0 access tokens and OpenID credentials by malicious sites.

MFSA 2012-54 / CVE-2012-1964: Security Researcher Matt McCutchen reported that a clickjacking attack using the certificate warning page. A man-in-the-middle (MITM) attacker can use an iframe to display its own certificate error warning page (about:certerror) with the 'Add Exception' button of a real warning page from a malicious site. This can mislead users to adding a certificate exception for a different site than the perceived one. This can lead to compromised communications with the user perceived site through the MITM attack once the certificate exception has been added.

MFSA 2012-55 / CVE-2012-1965: Security researchers Mario Gomes and Soroush Dalili reported that since Mozilla allows the pseudo-protocol feed: to prefix any valid URL, it is possible to construct feed:javascript: URLs that will execute scripts in some contexts. On some sites it may be possible to use this to evade output filtering that would otherwise strip javascript: URLs and thus contribute to cross-site scripting (XSS) problems on these sites.

MFSA 2012-56 / CVE-2012-1967: Mozilla security researcher moz_bug_r_a4 reported a arbitrary code execution attack using a javascript: URL.
The Gecko engine features a JavaScript sandbox utility that allows the browser or add-ons to safely execute script in the context of a web page. In certain cases, javascript: URLs are executed in such a sandbox with insufficient context that can allow those scripts to escape from the sandbox and run with elevated privilege. This can lead to arbitrary code execution.

MozillaFirefox was updated to 14.0.1 to fix various bugs and security issues.

Following security issues were fixed: MFSA 2012-42: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

CVE-2012-1949: Brian Smith, Gary Kwong, Christian Holler, Jesse Ruderman, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey reported memory safety problems and crashes that affect Firefox 13.

CVE-2012-1948: Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13.

MFSA 2012-43 / CVE-2012-1950: Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page.
This could lead to potential phishing attacks on users. 

MFSA 2012-44 Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix.

All four of these issues are potentially exploitable. CVE-2012-1951:
Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames

MFSA 2012-45 / CVE-2012-1955: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. 

MFSA 2012-46 / CVE-2012-1966: Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality ('View Image', 'Show only this frame', and 'View background image') are disallowed in a javascript: URL but allowed in a data: URL, allowing for XSS. This can lead to arbitrary code execution.

MFSA 2012-47 / CVE-2012-1957: Security researcher Mario Heiderich reported that JavaScript could be executed in the HTML feed-view using <embed> tag within the RSS <description>. This problem is due to <embed> tags not being filtered out during parsing and can lead to a potential cross-site scripting (XSS) attack. The flaw existed in a parser utility class and could affect other parts of the browser or add-ons which rely on that class to sanitize untrusted input.

MFSA 2012-48 / CVE-2012-1958: Security researcher Arthur Gerkis used the Address Sanitizer tool to find a use-after-free in nsGlobalWindow::PageHidden when mFocusedContent is released and oldFocusedContent is used afterwards. This use-after-free could possibly allow for remote code execution.

MFSA 2012-49 / CVE-2012-1959: Mozilla developer Bobby Holley found that same-compartment security wrappers (SCSW) can be bypassed by passing them to another compartment. Cross-compartment wrappers often do not go through SCSW, but have a filtering policy built into them.
When an object is wrapped cross-compartment, the SCSW is stripped off and, when the object is read read back, it is not known that SCSW was previously present, resulting in a bypassing of SCSW. This could result in untrusted content having access to the XBL that implements browser functionality.

MFSA 2012-50 / CVE-2012-1960: Google developer Tony Payne reported an out of bounds (OOB) read in QCMS, Mozilla&rsquo;s color management library. With a carefully crafted color profile portions of a user's memory could be incorporated into a transformed image and possibly deciphered.

MFSA 2012-51 / CVE-2012-1961: Bugzilla developer Fr&eacute;d&eacute;ric Buclin reported that the 'X-Frame-Options header is ignored when the value is duplicated, for example X-Frame-Options: SAMEORIGIN, SAMEORIGIN. This duplication occurs for unknown reasons on some websites and when it occurs results in Mozilla browsers not being protected against possible clickjacking attacks on those pages.

MFSA 2012-52 / CVE-2012-1962: Security researcher Bill Keese reported a memory corruption. This is caused by JSDependentString::undepend changing a dependent string into a fixed string when there are additional dependent strings relying on the same base. When the undepend occurs during conversion, the base data is freed, leaving other dependent strings with dangling pointers. This can lead to a potentially exploitable crash.

MFSA 2012-53 / CVE-2012-1963: Security researcher Karthikeyan Bhargavan of Prosecco at INRIA reported Content Security Policy (CSP) 1.0 implementation errors. CSP violation reports generated by Firefox and sent to the 'report-uri' location include sensitive data within the 'blocked-uri' parameter. These include fragment components and query strings even if the 'blocked-uri' parameter has a different origin than the protected resource. This can be used to retrieve a user's OAuth 2.0 access tokens and OpenID credentials by malicious sites.

MFSA 2012-54 / CVE-2012-1964: Security Researcher Matt McCutchen reported that a clickjacking attack using the certificate warning page. A man-in-the-middle (MITM) attacker can use an iframe to display its own certificate error warning page (about:certerror) with the 'Add Exception' button of a real warning page from a malicious site. This can mislead users to adding a certificate exception for a different site than the perceived one. This can lead to compromised communications with the user perceived site through the MITM attack once the certificate exception has been added.

MFSA 2012-55 / CVE-2012-1965: Security researchers Mario Gomes and Soroush Dalili reported that since Mozilla allows the pseudo-protocol feed: to prefix any valid URL, it is possible to construct feed:javascript: URLs that will execute scripts in some contexts. On some sites it may be possible to use this to evade output filtering that would otherwise strip javascript: URLs and thus contribute to cross-site scripting (XSS) problems on these sites.

MFSA 2012-56 / CVE-2012-1967: Mozilla security researcher moz_bug_r_a4 reported a arbitrary code execution attack using a javascript: URL.
The Gecko engine features a JavaScript sandbox utility that allows the browser or add-ons to safely execute script in the context of a web page. In certain cases, javascript: URLs are executed in such a sandbox with insufficient context that can allow those scripts to escape from the sandbox and run with elevated privilege. This can lead to arbitrary code execution.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1088 advisory.

    firefox     [10.0.6-1.0.1.el6_3]
    - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js

    [10.0.6-1]
    - Update to 10.0.6 ESR

    [10.0.5-3]
    - Enabled WebM

    [10.0.5-2]
    - Added fix for mozbz#703633, rhbz#818341

    xulrunner     [10.0.6-1.0.1.el6_3]
    - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js

    [10.0.6-1]
    - Update to 10.0.6 ESR

    [10.0.5-3]
    - Added fix for rhbz#808136 (mozbz#762301)

    [10.0.5-2]
    - Enabled WebM (rhbz#798880)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox has been updated to the 10.0.6ESR security release fixing various bugs and several security issues, some critical.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-42)

  - Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill     McCloskey reported memory safety problems and crashes     that affect Firefox ESR 10 and Firefox 13.
    (CVE-2012-1948)

  - Security researcher Mario Gomes andresearch firm Code     Audit Labs reported a mechanism to short-circuit page     loads through drag and drop to the addressbar by     canceling the page load. This causes the address of the     previously site entered to be displayed in the     addressbar instead of the currently loaded page. This     could lead to potential phishing attacks on users. (MFSA     2012-43 / CVE-2012-1950)

  - Google security researcher Abhishek Arya used the     Address Sanitizer tool to uncover four issues: two     use-after-free problems, one out of bounds read bug, and     a bad cast. The first use-afte.r-free problem is caused     when an array of nsSMILTimeValueSpec objects is     destroyed but attempts are made to call into objects in     this array later. The second use-after-free problem is     in nsDocument::AdoptNode when it adopts into an empty     document and then adopts into another document, emptying     the first one. The heap buffer overflow is in     ElementAnimations when data is read off of end of an     array and then pointers are dereferenced. The bad cast     happens when nsTableFrame::InsertFrames is called with     frames in aFrameList that are a mix of row group frames     and column group frames. AppendFrames is not able to     handle this mix. (MFSA 2012-44)

    All four of these issues are potentially exploitable.

  - Heap-use-after-free in     nsSMILTimeValueSpec::IsEventBased. (CVE-2012-1951)

  - Heap-use-after-free in nsDocument::AdoptNode.
    (CVE-2012-1954)

  - Out of bounds read in     ElementAnimations::EnsureStyleRuleFor. (CVE-2012-1953)

  - Bad cast in nsTableFrame::InsertFrames. (CVE-2012-1952)

  - Security researcher Mariusz Mlynski reported an issue     with spoofing of the location property. In this issue,     calls to history.forward and history.back are used to     navigate to a site while displaying the previous site in     the addressbar but changing the baseURI to the newer     site. This can be used for phishing by allowing the user     input form or other data on the newer, attacking, site     while appearing to be on the older, displayed site.
    (MFSA 2012-45 / CVE-2012-1955)

  - Mozilla security researcher moz_bug_r_a4 reported a     cross-site scripting (XSS) attack through the context     menu using a data: URL. In this issue, context menu     functionality ('View Image', 'Show only this frame', and     'View background image') are disallowed in a javascript:
    URL but allowed in a data: URL, allowing for XSS. This     can lead to arbitrary code execution. (MFSA 2012-46 /     CVE-2012-1966)

  - Security researcher Mario Heiderich reported that     JavaScript could be executed in the HTML feed-view using     tag within the RSS . This problem is due to tags not     being filtered out during parsing and can lead to a     potential cross-site scripting (XSS) attack. The flaw     existed in a parser utility class and could affect other     parts of the browser or add-ons which rely on that class     to sanitize untrusted input. (MFSA 2012-47 /     CVE-2012-1957)

  - Security researcher Arthur Gerkis used the Address     Sanitizer tool to find a use-after-free in     nsGlobalWindow::PageHidden when mFocusedContent is     released and oldFocusedContent is used afterwards. This     use-after-free could possibly allow for remote code     execution. (MFSA 2012-48 / CVE-2012-1958)

  - Mozilla developer Bobby Holley found that     same-compartment security wrappers (SCSW) can be     bypassed by passing them to another compartment.
    Cross-compartment wrappers often do not go through SCSW,     but have a filtering policy built into them. When an     object is wrapped cross-compartment, the SCSW is     stripped off and, when the object is read read back, it     is not known that SCSW was previously present, resulting     in a bypassing of SCSW. This could result in untrusted     content having access to the XBL that implements browser     functionality. (MFSA 2012-49 / CVE-2012-1959)

  - Google developer Tony Payne reported an out of bounds     (OOB) read in QCMS, Mozilla's color management library.
    With a carefully crafted color profile portions of a     user's memory could be incorporated into a transformed     image and possibly deciphered. (MFSA 2012-50 /     CVE-2012-1960)

  - Bugzilla developer Frederic Buclin reported that the     'X-Frame-Options header is ignored when the value is     duplicated, for example X-Frame-Options: SAMEORIGIN,     SAMEORIGIN. This duplication occurs for unknown reasons     on some websites and when it occurs results in Mozilla     browsers not being protected against possible     clickjacking attacks on those pages. (MFSA 2012-51 /     CVE-2012-1961)

  - Security researcher Bill Keese reported a memory     corruption. This is caused by     JSDependentString::undepend changing a dependent string     into a fixed string when there are additional dependent     strings relying on the same base. When the undepend     occurs during conversion, the base data is freed,     leaving other dependent strings with dangling pointers.
    This can lead to a potentially exploitable crash. (MFSA     2012-52 / CVE-2012-1962)

  - Security researcher Karthikeyan Bhargavan of Prosecco at     INRIA reported Content Security Policy (CSP) 1.0     implementation errors. CSP violation reports generated     by Firefox and sent to the 'report-uri' location include     sensitive data within the 'blocked-uri' parameter. These     include fragment components and query strings even if     the 'blocked-uri' parameter has a different origin than     the protected resource. This can be used to retrieve a     user's OAuth 2.0 access tokens and OpenID credentials by     malicious sites. (MFSA 2012-53 / CVE-2012-1963)

  - Security Researcher Matt McCutchen reported that a     clickjacking attack using the certificate warning page.
    A man-in-the-middle (MITM) attacker can use an iframe to     display its own certificate error warning page     (about:certerror) with the 'Add Exception' button of a     real warning page from a malicious site. This can     mislead users to adding a certificate exception for a     different site than the perceived one. This can lead to     compromised communications with the user perceived site     through the MITM attack once the certificate exception     has been added. (MFSA 2012-54 / CVE-2012-1964)

  - Security researchers Mario Gomes and Soroush Dalili     reported that since Mozilla allows the pseudo-protocol     feed: to prefix any valid URL, it is possible to     construct feed:javascript: URLs that will execute     scripts in some contexts. On some sites it may be     possible to use this to evade output filtering that     would otherwise strip javascript: URLs and thus     contribute to cross-site scripting (XSS) problems on     these sites. (MFSA 2012-55 / CVE-2012-1965)

  - Mozilla security researcher moz_bug_r_a4 reported a     arbitrary code execution attack using a javascript: URL.
    The Gecko engine features a JavaScript sandbox utility     that allows the browser or add-ons to safely execute     script in the context of a web page. In certain cases,     javascript: URLs are executed in such a sandbox with     insufficient context that can allow those scripts to     escape from the sandbox and run with elevated privilege.
    This can lead to arbitrary code execution. (MFSA 2012-56     / CVE-2012-1967)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Security issues were identified and fixed in mozilla firefox and thunderbird :

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1949, CVE-2012-1948).

Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users (CVE-2012-1950).

Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. All four of these issues are potentially exploitable (CVE-2012-1951, CVE-2012-1954, CVE-2012-1953, CVE-2012-1952).

Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site (CVE-2012-1955).

Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (View Image, Show only this frame, and View background image) are disallowed in a javascript: URL but allowed in a data: URL, allowing for XSS. This can lead to arbitrary code execution (CVE-2012-1966).

Security researcher Mario Heiderich reported that JavaScript could be executed in the HTML feed-view using <embed> tag within the RSS <description>. This problem is due to <embed> tags not being filtered out during parsing and can lead to a potential cross-site scripting (XSS) attack. The flaw existed in a parser utility class and could affect other parts of the browser or add-ons which rely on that class to sanitize untrusted input (CVE-2012-1957).

Security researcher Arthur Gerkis used the Address Sanitizer tool to find a use-after-free in nsGlobalWindow::PageHidden when mFocusedContent is released and oldFocusedContent is used afterwards.
This use-after-free could possibly allow for remote code execution (CVE-2012-1958).

Mozilla developer Bobby Holley found that same-compartment security wrappers (SCSW) can be bypassed by passing them to another compartment. Cross-compartment wrappers often do not go through SCSW, but have a filtering policy built into them. When an object is wrapped cross-compartment, the SCSW is stripped off and, when the object is read read back, it is not known that SCSW was previously present, resulting in a bypassing of SCSW. This could result in untrusted content having access to the XBL that implements browser functionality (CVE-2012-1959).

Google developer Tony Payne reported an out of bounds (OOB) read in QCMS, Mozillas color management library. With a carefully crafted color profile portions of a user's memory could be incorporated into a transformed image and possibly deciphered (CVE-2012-1960).

Bugzilla developer Fredric Buclin reported that the X-Frame-Options header is ignored when the value is duplicated, for example X-Frame-Options: SAMEORIGIN, SAMEORIGIN. This duplication occurs for unknown reasons on some websites and when it occurs results in Mozilla browsers not being protected against possible clickjacking attacks on those pages (CVE-2012-1961).

Security researcher Bill Keese reported a memory corruption. This is caused by JSDependentString::undepend changing a dependent string into a fixed string when there are additional dependent strings relying on the same base. When the undepend occurs during conversion, the base data is freed, leaving other dependent strings with dangling pointers.
This can lead to a potentially exploitable crash (CVE-2012-1962).

Security researcher Karthikeyan Bhargavan of Prosecco at INRIA reported Content Security Policy (CSP) 1.0 implementation errors. CSP violation reports generated by Firefox and sent to the report-uri location include sensitive data within the blocked-uri parameter.
These include fragment components and query strings even if the blocked-uri parameter has a different origin than the protected resource. This can be used to retrieve a user's OAuth 2.0 access tokens and OpenID credentials by malicious sites (CVE-2012-1963).

Security Researcher Matt McCutchen reported that a clickjacking attack using the certificate warning page. A man-in-the-middle (MITM) attacker can use an iframe to display its own certificate error warning page (about:certerror) with the Add Exception button of a real warning page from a malicious site. This can mislead users to adding a certificate exception for a different site than the perceived one.
This can lead to compromised communications with the user perceived site through the MITM attack once the certificate exception has been added (CVE-2012-1964).

Security researchers Mario Gomes and Soroush Dalili reported that since Mozilla allows the pseudo-protocol feed: to prefix any valid URL, it is possible to construct feed:javascript: URLs that will execute scripts in some contexts. On some sites it may be possible to use this to evade output filtering that would otherwise strip javascript: URLs and thus contribute to cross-site scripting (XSS) problems on these sites (CVE-2012-1965).

Mozilla security researcher moz_bug_r_a4 reported a arbitrary code execution attack using a javascript: URL. The Gecko engine features a JavaScript sandbox utility that allows the browser or add-ons to safely execute script in the context of a web page. In certain cases, javascript: URLs are executed in such a sandbox with insufficient context that can allow those scripts to escape from the sandbox and run with elevated privilege. This can lead to arbitrary code execution (CVE-2012-1967).

The mozilla firefox and thunderbird packages has been upgraded to the latest respective versions which is unaffected by these security flaws.

Additionally the rootcerts packages has been upgraded to the latest version which brings updated root CA data.

Update :

Localization packages for firefox was missing with the MDVSA-2012:110 advisory and is being provided with this advisory.

The Mozilla Project reports :

MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ rv:10.0.6)

MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop

MFSA 2012-44 Gecko memory corruption

MFSA 2012-45 Spoofing issue with location

MFSA 2012-46 XSS through data: URLs

MFSA 2012-47 Improper filtering of JavaScript in HTML feed-view

MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden

MFSA 2012-49 Same-compartment Security Wrappers can be bypassed

MFSA 2012-50 Out of bounds read in QCMS

MFSA 2012-51 X-Frame-Options header ignored when duplicated

MFSA 2012-52 JSDependentString::undepend string conversion results in memory corruption

MFSA 2012-53 Content Security Policy 1.0 implementation errors cause data leakage

MFSA 2012-54 Clickjacking of certificate warning page

MFSA 2012-55 feed: URLs with an innerURI inherit security context of page

MFSA 2012-56 Code execution through javascript: URLs

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967)

A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges.
(CVE-2012-1959)

A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966)

A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack.
(CVE-2012-1950)

A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955)

A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957)

A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961)

A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim's OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

A flaw in the way Firefox handled certificate warnings could allow a man-in-the-middle attacker to create a crafted warning, possibly tricking a user into accepting an arbitrary certificate as trusted.
(CVE-2012-1964)

A flaw in the way Firefox handled feed:javascript URLs could allow output filtering to be bypassed, possibly leading to a cross-site scripting attack. (CVE-2012-1965)

The a previous nss update introduced a mitigation for the CVE-2011-3389 flaw. For compatibility reasons, it remains disabled by default in the nss packages. This update makes Firefox enable the mitigation by default. It can be disabled by setting the NSS_SSL_CBC_RANDOM_IV environment variable to 0 before launching Firefox.

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.6 ESR.

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.6 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Versions of Firefox 13.x  are potentially affected by the following security issues :

  - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949)

  - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950)

  - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954)

  - An error related to JavaScript functions 'history.forward' and 'history.back' can allow incorrect URLs to be displayed. (CVE-2012-1955)

  - Cross-site scripting attacks are possible due to an error related to the '&lt;embed&gt;' tag within an RSS '&lt;description&gt;' element. (CVE-2012-1957)

  - A use-after-free error exists related to the method 'nsGlobalWindow::PageHidden'. (CVE-2012-1958)

  - An error exists that can allow 'same-compartment security wrappers' (SCSW) to be bypassed. (CVE-2012-1959)

  - An out-of-bounds read error exists related to the color management library (QCMS). (CVE-2012-1960)

  - The 'X-Frames-Options' header is ignored if it is duplicated. (CVE-2012-1961)

  - A memory corruption error exists related to the method 'JSDependentString::undepend'. (CVE-2012-1962)

  - An error related to the 'Content Security Policy' (CSP) implementation can allow the disclosure of OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

  - An error exists related to the 'feed:' URL that can allow cross-site scripting attacks. (CVE-2012-1965)

  - Cross-site scripting attacks are possible due to an error related to the 'data:' URL and context menus. (CVE-2012-1966)

  - An error exists related to the 'javascript:' URL that can allow scripts to run at elevated privileges outside the sandbox. (CVE-2012-1967)

Versions of Firefox prior to 14.0 are potentially affected by the following security issues :

 - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949)
 - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950)
 - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954)
 - An error related to JavaScript functions 'history.forward' and 'history.back' can allow incorrect URLs to be displayed. (CVE-2012-1955)
 - Cross-site scripting attacks are possible due to an error related to the '<embed>' tag within an RSS '<description>' element. (CVE-2012-1957)
 - A use-after-free error exists related to the method 'nsGlobalWindow::PageHidden'. (CVE-2012-1958)
 - An error exists that can allow 'same-compartment security wrappers' (SCSW) to be bypassed. (CVE-2012-1959)
 - An out-of-bounds read error exists related to the color management library (QCMS). (CVE-2012-1960)
 - The 'X-Frames-Options' header is ignored if it is duplicated. (CVE-2012-1961)
 - A memory corruption error exists related to the method 'JSDependentString::undepend'. (CVE-2012-1962)
 - An error related to the 'Content Security Policy' (CSP) implementation can allow the disclosure of OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)
 - An error exists related to the 'feed:' URL that can allow cross-site scripting attacks. (CVE-2012-1965)
 - Cross-site scripting attacks are possible due to an error related to the 'data:' URL and context menus. (CVE-2012-1966)
 - An error exists related to the 'javascript:' URL that can allow scripts to run at elevated privileges outside the sandbox. (CVE-2012-1967)

MozillaFirefox have been updated to the 10.0.6ESR security release fixing various bugs and several security issues, some critical.

The ollowing security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-42)

  - Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill     McCloskey reported memory safety problems and crashes     that affect Firefox ESR 10 and Firefox 13.
    (CVE-2012-1948)

  - Security researcher Mario Gomes andresearch firm Code     Audit Labs reported a mechanism to short-circuit page     loads through drag and drop to the addressbar by     canceling the page load. This causes the address of the     previously site entered to be displayed in the     addressbar instead of the currently loaded page. This     could lead to potential phishing attacks on users. (MFSA     2012-43 / CVE-2012-1950)

  - Google security researcher Abhishek Arya used the     Address Sanitizer tool to uncover four issues: two     use-after-free problems, one out of bounds read bug, and     a bad cast. The first use-afte.r-free problem is caused     when an array of nsSMILTimeValueSpec objects is     destroyed but attempts are made to call into objects in     this array later. The second use-after-free problem is     in nsDocument::AdoptNode when it adopts into an empty     document and then adopts into another document, emptying     the first one. The heap buffer overflow is in     ElementAnimations when data is read off of end of an     array and then pointers are dereferenced. The bad cast     happens when nsTableFrame::InsertFrames is called with     frames in aFrameList that are a mix of row group frames     and column group frames. AppendFrames is not able to     handle this mix. (MFSA 2012-44)

    All four of these issues are potentially exploitable.

o CVE-2012-1951: Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased o CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode o CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor o CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames

  - Security researcher Mariusz Mlynski reported an issue     with spoofing of the location property. In this issue,     calls to history.forward and history.back are used to     navigate to a site while displaying the previous site in     the addressbar but changing the baseURI to the newer     site. This can be used for phishing by allowing the user     input form or other data on the newer, attacking, site     while appearing to be on the older, displayed site.
    (MFSA 2012-45 / CVE-2012-1955)

  - Mozilla security researcher moz_bug_r_a4 reported a     cross-site scripting (XSS) attack through the context     menu using a data: URL. In this issue, context menu     functionality ('View Image', 'Show only this frame', and     'View background image') are disallowed in a javascript:
    URL but allowed in a data: URL, allowing for XSS. This     can lead to arbitrary code execution. (MFSA 2012-46 /     CVE-2012-1966)

  - Security researcher Mario Heiderich reported that     JavaScript could be executed in the HTML feed-view using     tag within the RSS . This problem is due to tags not     being filtered out during parsing and can lead to a     potential cross-site scripting (XSS) attack. The flaw     existed in a parser utility class and could affect other     parts of the browser or add-ons which rely on that class     to sanitize untrusted input. (MFSA 2012-47 /     CVE-2012-1957)

  - Security researcher Arthur Gerkis used the Address     Sanitizer tool to find a use-after-free in     nsGlobalWindow::PageHidden when mFocusedContent is     released and oldFocusedContent is used afterwards. This     use-after-free could possibly allow for remote code     execution. (MFSA 2012-48 / CVE-2012-1958)

  - Mozilla developer Bobby Holley found that     same-compartment security wrappers (SCSW) can be     bypassed by passing them to another compartment.
    Cross-compartment wrappers often do not go through SCSW,     but have a filtering policy built into them. When an     object is wrapped cross-compartment, the SCSW is     stripped off and, when the object is read read back, it     is not known that SCSW was previously present, resulting     in a bypassing of SCSW. This could result in untrusted     content having access to the XBL that implements browser     functionality. (MFSA 2012-49 / CVE-2012-1959)

  - Google developer Tony Payne reported an out of bounds     (OOB) read in QCMS, Mozilla's color management library.
    With a carefully crafted color profile portions of a     user's memory could be incorporated into a transformed     image and possibly deciphered. (MFSA 2012-50 /     CVE-2012-1960)

  - Bugzilla developer Frederic Buclin reported that the     'X-Frame-Options header is ignored when the value is     duplicated, for example X-Frame-Options: SAMEORIGIN,     SAMEORIGIN. This duplication occurs for unknown reasons     on some websites and when it occurs results in Mozilla     browsers not being protected against possible     clickjacking attacks on those pages. (MFSA 2012-51 /     CVE-2012-1961)

  - Security researcher Bill Keese reported a memory     corruption. This is caused by     JSDependentString::undepend changing a dependent string     into a fixed string when there are additional dependent     strings relying on the same base. When the undepend     occurs during conversion, the base data is freed,     leaving other dependent strings with dangling pointers.
    This can lead to a potentially exploitable crash. (MFSA     2012-52 / CVE-2012-1962)

  - Security researcher Karthikeyan Bhargavan of Prosecco at     INRIA reported Content Security Policy (CSP) 1.0     implementation errors. CSP violation reports generated     by Firefox and sent to the 'report-uri' location include     sensitive data within the 'blocked-uri' parameter. These     include fragment components and query strings even if     the 'blocked-uri' parameter has a different origin than     the protected resource. This can be used to retrieve a     user's OAuth 2.0 access tokens and OpenID credentials by     malicious sites. (MFSA 2012-53 / CVE-2012-1963)

  - Security Researcher Matt McCutchen reported that a     clickjacking attack using the certificate warning page.
    A man-in-the-middle (MITM) attacker can use an iframe to     display its own certificate error warning page     (about:certerror) with the 'Add Exception' button of a     real warning page from a malicious site. This can     mislead users to adding a certificate exception for a     different site than the perceived one. This can lead to     compromised communications with the user perceived site     through the MITM attack once the certificate exception     has been added. (MFSA 2012-54 / CVE-2012-1964)

  - Security researchers Mario Gomes and Soroush Dalili     reported that since Mozilla allows the pseudo-protocol     feed: to prefix any valid URL, it is possible to     construct feed:javascript: URLs that will execute     scripts in some contexts. On some sites it may be     possible to use this to evade output filtering that     would otherwise strip javascript: URLs and thus     contribute to cross-site scripting (XSS) problems on     these sites. (MFSA 2012-55 / CVE-2012-1965)

  - Mozilla security researcher moz_bug_r_a4 reported a     arbitrary code execution attack using a javascript: URL.
    The Gecko engine features a JavaScript sandbox utility     that allows the browser or add-ons to safely execute     script in the context of a web page. In certain cases,     javascript: URLs are executed in such a sandbox with     insufficient context that can allow those scripts to     escape from the sandbox and run with elevated privilege.
    This can lead to arbitrary code execution. (MFSA 2012-56     / CVE-2012-1967)

The installed version of Firefox is earlier than 14.0 and thus, is potentially affected by the following security issues :

  - Several memory safety issues exist, some of which could     potentially allow arbitrary code execution.
    (CVE-2012-1948, CVE-2012-1949)

  - An error related to drag and drop can allow incorrect     URLs to be displayed. (CVE-2012-1950)

  - Several memory safety issues exist related to the Gecko     layout engine. (CVE-2012-1951, CVE-2012-1952,     CVE-2012-1953, CVE-2012-1954)

  - An error related to JavaScript functions     'history.forward' and 'history.back' can allow     incorrect URLs to be displayed. (CVE-2012-1955)

  - Cross-site scripting attacks are possible due to an     error related to the '<embed>' tag within an RSS     '<description>' element. (CVE-2012-1957)

  - A use-after-free error exists related to the method     'nsGlobalWindow::PageHidden'. (CVE-2012-1958)

  - An error exists that can allow 'same-compartment     security wrappers' (SCSW) to be bypassed.
    (CVE-2012-1959)

  - An out-of-bounds read error exists related to the color     management library (QCMS). (CVE-2012-1960)   
  - The 'X-Frames-Options' header is ignored if it is     duplicated. (CVE-2012-1961)

  - A memory corruption error exists related to the method     'JSDependentString::undepend'. (CVE-2012-1962)

  - An error related to the 'Content Security Policy' (CSP)     implementation can allow the disclosure of OAuth 2.0     access tokens and OpenID credentials. (CVE-2012-1963)

  - An error exists related to the 'feed:' URL that can     allow cross-site scripting attacks. (CVE-2012-1965)

  - Cross-site scripting attacks are possible due to an     error related to the 'data:' URL and context menus.
    (CVE-2012-1966)

  - An error exists related to the 'javascript:' URL that     can allow scripts to run at elevated privileges outside     the sandbox. (CVE-2012-1967)

The installed version of Firefox 10.0.x is potentially affected by the following security issues :

  - Several memory safety issues exist, some of which could     potentially allow arbitrary code execution.
    (CVE-2012-1948)

  - An error related to drag and drop can allow incorrect     URLs to be displayed. (CVE-2012-1950)

  - Several memory safety issues exist related to the Gecko     layout engine. (CVE-2012-1951, CVE-2012-1952,     CVE-2012-1953, CVE-2012-1954)

  - An error related to JavaScript functions     'history.forward' and 'history.back' can allow     incorrect URLs to be displayed. (CVE-2012-1955)

  - Cross-site scripting attacks are possible due to an     error related to the '<embed>' tag within an RSS     '<description>' element. (CVE-2012-1957)

  - A use-after-free error exists related to the method     'nsGlobalWindow::PageHidden'. (CVE-2012-1958)

  - An error exists that can allow 'same-compartment     security wrappers' (SCSW) to be bypassed.
    (CVE-2012-1959)   
  - The 'X-Frames-Options' header is ignored if it is     duplicated. (CVE-2012-1961)

  - A memory corruption error exists related to the method     'JSDependentString::undepend'. (CVE-2012-1962)

  - An error related to the 'Content Security Policy' (CSP)     implementation can allow the disclosure of OAuth 2.0     access tokens and OpenID credentials. (CVE-2012-1963)

  - An error exists related to the certificate warning page     that can allow 'clickjacking' thereby tricking a user     into accepting unintended certificates. (CVE-2012-1964)

  - An error exists related to the 'feed:' URL that can     allow cross-site scripting attacks. (CVE-2012-1965)

  - Cross-site scripting attacks are possible due to an     error related to the 'data:' URL and context menus.
    (CVE-2012-1966)

  - An error exists related to the 'javascript:' URL that     can allow scripts to run at elevated privileges outside     the sandbox. (CVE-2012-1967)

The installed version of Firefox is earlier than 10.0.6 and thus, is potentially affected by the following security issues :

  - Several memory safety issues exist, some of which could     potentially allow arbitrary code execution.
    (CVE-2012-1948)

  - An error related to drag and drop can allow incorrect     URLs to be displayed. (CVE-2012-1950)

  - Several memory safety issues exist related to the Gecko     layout engine. (CVE-2012-1951, CVE-2012-1952,     CVE-2012-1953, CVE-2012-1954)

  - An error related to JavaScript functions     'history.forward' and 'history.back' can allow     incorrect URLs to be displayed. (CVE-2012-1955)

  - Cross-site scripting attacks are possible due to an     error related to the '<embed>' tag within an RSS     '<description>' element. (CVE-2012-1957)

  - A use-after-free error exists related to the method     'nsGlobalWindow::PageHidden'. (CVE-2012-1958)

  - An error exists that can allow 'same-compartment     security wrappers' (SCSW) to be bypassed.
    (CVE-2012-1959)   
  - The 'X-Frames-Options' header is ignored if it is     duplicated. (CVE-2012-1961)

  - A memory corruption error exists related to the method     'JSDependentString::undepend'. (CVE-2012-1962)

  - An error related to the 'Content Security Policy' (CSP)     implementation can allow the disclosure of OAuth 2.0     access tokens and OpenID credentials. (CVE-2012-1963)

  - An error exists related to the certificate warning page     that can allow 'clickjacking' thereby tricking a user     into accepting unintended certificates. (CVE-2012-1964)

  - An error exists related to the 'feed:' URL that can     allow cross-site scripting attacks. (CVE-2012-1965)

  - Cross-site scripting attacks are possible due to an     error related to the 'data:' URL and context menus.
    (CVE-2012-1966)

  - An error exists related to the 'javascript:' URL that     can allow scripts to run at elevated privileges outside     the sandbox. (CVE-2012-1967)

USN-1509-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the lastest Firefox.

Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949)

Mario Gomes discovered that the address bar may be incorrectly updated. Drag-and-drop events in the address bar may cause the address of the previous site to be displayed while a new page is loaded. An attacker could exploit this to conduct phishing attacks. (CVE-2012-1950)

Abhishek Arya discovered four memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954)

Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks.
(CVE-2012-1955)

Mario Heiderich discovered that HTML <embed> tags were not filtered out of the HTML <description> of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution in the HTML feed view. (CVE-2012-1957)

Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-1958)

Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1959)

Tony Payne discovered an out-of-bounds memory read in Mozilla's color management library (QCMS). If the user were tricked into opening a specially crafted color profile, an attacker could possibly exploit this to cause a denial of service via application crash. (CVE-2012-1960)

Frederic Buclin discovered that the X-Frame-Options header was ignored when its value was specified multiple times. An attacker could exploit this to conduct clickjacking attacks.
(CVE-2012-1961)

Bill Keese discovered a memory corruption vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-1962)

Karthikeyan Bhargavan discovered an information leakage vulnerability in the Content Security Policy (CSP) 1.0 implementation. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to access a user's OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

Matt McCutchen discovered a clickjacking vulnerability in the certificate warning page. A remote attacker could trick a user into accepting a malicious certificate via a crafted certificate warning page. (CVE-2012-1964)

Mario Gomes and Soroush Dalili discovered that JavaScript was not filtered out of feed URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1965)

A vulnerability was discovered in the context menu of data:
URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1966)

It was discovered that the execution of javascript: URLs was not properly handled in some cases. A remote attacker could exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1967).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949)

Mario Gomes discovered that the address bar may be incorrectly updated. Drag-and-drop events in the address bar may cause the address of the previous site to be displayed while a new page is loaded. An attacker could exploit this to conduct phishing attacks.
(CVE-2012-1950)

Abhishek Arya discovered four memory safety issues affecting Firefox.
If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954)

Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks. (CVE-2012-1955)

Mario Heiderich discovered that HTML <embed> tags were not filtered out of the HTML <description> of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution in the HTML feed view. (CVE-2012-1957)

Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1958)

Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Firefox.
(CVE-2012-1959)

Tony Payne discovered an out-of-bounds memory read in Mozilla's color management library (QCMS). If the user were tricked into opening a specially crafted color profile, an attacker could possibly exploit this to cause a denial of service via application crash.
(CVE-2012-1960)

Frederic Buclin discovered that the X-Frame-Options header was ignored when its value was specified multiple times. An attacker could exploit this to conduct clickjacking attacks. (CVE-2012-1961)

Bill Keese discovered a memory corruption vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1962)

Karthikeyan Bhargavan discovered an information leakage vulnerability in the Content Security Policy (CSP) 1.0 implementation. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to access a user's OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

Matt McCutchen discovered a clickjacking vulnerability in the certificate warning page. A remote attacker could trick a user into accepting a malicious certificate via a crafted certificate warning page. (CVE-2012-1964)

Mario Gomes and Soroush Dalili discovered that JavaScript was not filtered out of feed URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1965)

A vulnerability was discovered in the context menu of data: URLs. If the user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2012-1966)

It was discovered that the execution of javascript: URLs was not properly handled in some cases. A remote attacker could exploit this to execute code with the privileges of the user invoking Firefox.
(CVE-2012-1967).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1088 advisory.

    Mozilla Firefox is an open source web browser. XULRunner provides the XUL     Runtime environment for Mozilla Firefox.

    A web page containing malicious content could cause Firefox to crash or,     potentially, execute arbitrary code with the privileges of the user running     Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953,     CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967)

    A malicious web page could bypass same-compartment security wrappers (SCSW)     and execute arbitrary code with chrome privileges. (CVE-2012-1959)

    A flaw in the context menu functionality in Firefox could allow a malicious     website to bypass intended restrictions and allow a cross-site scripting     attack. (CVE-2012-1966)

    A page different to that in the address bar could be displayed when     dragging and dropping to the address bar, possibly making it easier for a     malicious site or user to perform a phishing attack. (CVE-2012-1950)

    A flaw in the way Firefox called history.forward and history.back could     allow an attacker to conceal a malicious URL, possibly tricking a user     into believing they are viewing a trusted site. (CVE-2012-1955)

    A flaw in a parser utility class used by Firefox to parse feeds (such as     RSS) could allow an attacker to execute arbitrary JavaScript with the     privileges of the user running Firefox. This issue could have affected     other browser components or add-ons that assume the class returns     sanitized input. (CVE-2012-1957)

    A flaw in the way Firefox handled X-Frame-Options headers could allow a     malicious website to perform a clickjacking attack. (CVE-2012-1961)

    A flaw in the way Content Security Policy (CSP) reports were generated by     Firefox could allow a malicious web page to steal a victim's OAuth 2.0     access tokens and OpenID credentials. (CVE-2012-1963)

    A flaw in the way Firefox handled certificate warnings could allow a     man-in-the-middle attacker to create a crafted warning, possibly tricking     a user into accepting an arbitrary certificate as trusted. (CVE-2012-1964)

    A flaw in the way Firefox handled feed:javascript URLs could allow output     filtering to be bypassed, possibly leading to a cross-site scripting     attack. (CVE-2012-1965)

    The nss update RHBA-2012:0337 for Red Hat Enterprise Linux 5 and 6     introduced a mitigation for the CVE-2011-3389 flaw. For compatibility     reasons, it remains disabled by default in the nss packages. This update     makes Firefox enable the mitigation by default. It can be disabled by     setting the NSS_SSL_CBC_RANDOM_IV environment variable to 0 before     launching Firefox. (BZ#838879)

    For technical details regarding these flaws, refer to the Mozilla security     advisories for Firefox 10.0.6 ESR. You can find a link to the Mozilla     advisories in the References section of this erratum.

    Red Hat would like to thank the Mozilla project for reporting these issues.
    Upstream acknowledges Benoit Jacob, Jesse Ruderman, Christian Holler, Bill     McCloskey, Abhishek Arya, Arthur Gerkis, Bill Keese, moz_bug_r_a4, Bobby     Holley, Code Audit Labs, Mariusz Mlynski, Mario Heiderich, Frdric Buclin,     Karthikeyan Bhargavan, Matt McCutchen, Mario Gomes, and Soroush Dalili as     the original reporters of these issues.

    All Firefox users should upgrade to these updated packages, which contain     Firefox version 10.0.6 ESR, which corrects these issues. After installing     the update, Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967)

A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges.
(CVE-2012-1959)

A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966)

A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack.
(CVE-2012-1950)

A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955)

A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957)

A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961)

A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim's OAuth 2.0 access tokens and OpenID credentials. (CVE-2012-1963)

A flaw in the way Firefox handled certificate warnings could allow a man-in-the-middle attacker to create a crafted warning, possibly tricking a user into accepting an arbitrary certificate as trusted.
(CVE-2012-1964)

A flaw in the way Firefox handled feed:javascript URLs could allow output filtering to be bypassed, possibly leading to a cross-site scripting attack. (CVE-2012-1965)

The nss update RHBA-2012:0337 for Red Hat Enterprise Linux 5 and 6 introduced a mitigation for the CVE-2011-3389 flaw. For compatibility reasons, it remains disabled by default in the nss packages. This update makes Firefox enable the mitigation by default. It can be disabled by setting the NSS_SSL_CBC_RANDOM_IV environment variable to 0 before launching Firefox. (BZ#838879)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.6 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Abhishek Arya, Arthur Gerkis, Bill Keese, moz_bug_r_a4, Bobby Holley, Code Audit Labs, Mariusz Mlynski, Mario Heiderich, Frederic Buclin, Karthikeyan Bhargavan, Matt McCutchen, Mario Gomes, and Soroush Dalili as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.6 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
80787	Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird7)	Nessus	Solaris Local Security Checks	critical
74693	openSUSE Security Update : xulrunner (openSUSE-SU-2012:0924-1)	Nessus	SuSE Local Security Checks	critical
74687	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:0899-1)	Nessus	SuSE Local Security Checks	critical
68578	Oracle Linux 5 / 6 : firefox (ELSA-2012-1088)	Nessus	Oracle Linux Local Security Checks	medium
64131	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6574)	Nessus	SuSE Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
61963	Mandriva Linux Security Advisory : mozilla (MDVSA-2012:110-1)	Nessus	Mandriva Local Security Checks	critical
61402	FreeBSD : mozilla -- multiple vulnerabilities (dbf338d0-dce5-11e1-b655-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	critical
61364	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120717)	Nessus	Scientific Linux Local Security Checks	critical
801282	Mozilla Firefox 13.x < 13 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6519	Mozilla Firefox < 14.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
60092	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8226)	Nessus	SuSE Local Security Checks	critical
60043	Firefox < 14.0 Multiple Vulnerabilities	Nessus	Windows	critical
60042	Firefox 10.0.x < 10.0.6 Multiple Vulnerabilities	Nessus	Windows	critical
60039	Firefox < 14.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
60038	Firefox < 10.0.6 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
60013	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : ubufox update (USN-1509-2)	Nessus	Ubuntu Local Security Checks	critical
60012	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1509-1)	Nessus	Ubuntu Local Security Checks	critical
60008	RHEL 5 / 6 : firefox (RHSA-2012:1088)	Nessus	Red Hat Local Security Checks	medium
59998	CentOS 5 / 6 : firefox (CESA-2012:1088)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2012-1965

medium

Tenable Plugins

critical

critical

critical

medium

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

medium

critical