Detections
Analytics
Firefox 3.6 < 3.6.23 Multiple Vulnerabilities (Mac OS X)
high Nessus Plugin ID 56376
Language:
Synopsis
The remote Mac OS X host contains a web browser that is affected by multiple vulnerabilities.Description
The installed version of Firefox 3.6 is earlier than 3.6.23. Such versions are potentially affected by the following security issues :- An integer underflow exists when handling a large JavaScript 'RegExp' expression that can allow a potentially exploitable crash. (CVE-2011-2998)
- If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and executed. (CVE-2011-2372)
- Unspecified errors exist that can be exploited to corrupt memory. No additional information is available at this time. (CVE-2011-2995, CVE-2011-2996)
- There is an error in the implementation of the 'window.location' JavaScript object when creating named frames. This can be exploited to bypass the same-origin policy and potentially conduct cross-site scripting attacks. (CVE-2011-2999)
- A weakness exists when handling the 'Location' header.
This can lead to response splitting attacks when visiting a vulnerable web server. The same fix has been applied to the headers 'Content-Length' and 'Content-Disposition'. (CVE-2011-3000)
Solution
Upgrade to Firefox 3.6.23 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2011-36/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-37/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-38/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-39/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-40/
Plugin Details
Severity: High
ID: 56376
File Name: macosx_firefox_3_6_23.nasl
Version: 1.8
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 10/3/2011
Updated: 7/14/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Required KB Items: MacOSX/Firefox/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 9/27/2011
Vulnerability Publication Date: 9/27/2011
Reference Information
CVE: CVE-2011-2372, CVE-2011-2995, CVE-2011-2996, CVE-2011-2998, CVE-2011-2999, CVE-2011-3000