Detections
Analytics
Firefox 3.6 < 3.6.24 Multiple Vulnerabilities (Mac OS X)
high Nessus Plugin ID 56755
Language:
Synopsis
The remote Mac OS X host contains a web browser that is potentially affected by multiple vulnerabilities.Description
The installed version of Firefox 3.6 is earlier than 3.6.24. Such versions are potentially affected by the following security issues :- There is an error within the JSSubScriptLoader that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code.
(CVE-2011-3647)
- Certain invalid sequences are not handled properly in 'Shift-JIS' encoding, which can allow cross-site scripting attacks. (CVE-2011-3648)
- Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
Solution
Upgrade to Firefox 3.6.24 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2011-46/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-47/
https://www.mozilla.org/en-US/security/advisories/mfsa2011-49/
Plugin Details
Severity: High
ID: 56755
File Name: macosx_firefox_3_6_24.nasl
Version: 1.10
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 11/9/2011
Updated: 7/14/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Required KB Items: MacOSX/Firefox/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 11/8/2011
Vulnerability Publication Date: 11/8/2011