Detections
Analytics
openSUSE 10 Security Update : epiphany (epiphany-4870)
high Nessus Plugin ID 29915
Synopsis
The remote openSUSE host is missing a security update.Description
This update brings the Mozilla XUL runner engine to security update version 1.8.1.10MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.
MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks.
Solution
Update the affected epiphany packages.Plugin Details
Severity: High
ID: 29915
File Name: suse_epiphany-4870.nasl
Version: 1.10
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 1/10/2008
Updated: 1/14/2021
Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 9.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:epiphany, p-cpe:/a:novell:opensuse:epiphany-devel, p-cpe:/a:novell:opensuse:epiphany-extensions, p-cpe:/a:novell:opensuse:epiphany-extensions-lang, p-cpe:/a:novell:opensuse:epiphany-lang, p-cpe:/a:novell:opensuse:mozilla-xulrunner181, p-cpe:/a:novell:opensuse:mozilla-xulrunner181-32bit, p-cpe:/a:novell:opensuse:mozilla-xulrunner181-devel, p-cpe:/a:novell:opensuse:mozilla-xulrunner181-l10n, cpe:/o:novell:opensuse:10.2, cpe:/o:novell:opensuse:10.3
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Patch Publication Date: 1/7/2008