Detections
Analytics
Mozilla Firefox 3.6.x < 3.6.17 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 5901
Synopsis
The remote host has a web browser installed that is vulnerable to multiple attack vectors.Description
Versions of Firefox 3.6.x earlier than 3.6.17 are potentially affected by multiple vulnerabilities :Multiple memory corruption issues could lead to arbitrary code execution. (MFSA2011-12)
- Multiple dangling pointer vulnerabilities exist. (MFSA2011-13)
- A Java applet could be used to mimic interaction with form autocomplete controls and steal entries from the form history. (MFSA2011-14)
- The Java Embedding Plugin (JEP) shipped with the Mac OS X versions of Firefox could be exploited to obtain elevated access to resources on a user's system. (MFSA2011-15)
- The 'resource: ' protocol could be exploited to allow directory traversal on Windows and the potential loading of resources from non-permitted locations. (MFSA2011-16)
- The XSLT 'generate-id()' function returned a string that revealed a specific valid address of an object on the memory heap. (MFSA2011-18)
Solution
Upgrade to Firefox 3.6.17 or later.See Also
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.17
http://www.mozilla.org/security/announce/2011/mfsa2011-12.html
http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
http://www.mozilla.org/security/announce/2011/mfsa2011-14.html
http://www.mozilla.org/security/announce/2011/mfsa2011-15.html
http://www.mozilla.org/security/announce/2011/mfsa2011-16.html
http://www.mozilla.org/security/announce/2011/mfsa2011-18.html
Plugin Details
Severity: High
ID: 5901
Family: Web Clients
Published: 4/29/2011
Updated: 3/6/2019
Nessus ID: 53594
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Patch Publication Date: 4/28/2011
Vulnerability Publication Date: 4/28/2011
Exploitable With
CANVAS (White_Phosphorus)
Metasploit (Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability)
Reference Information
CVE: CVE-2011-0065, CVE-2011-0066, CVE-2011-0067, CVE-2011-0069, CVE-2011-0070, CVE-2011-0071, CVE-2011-0072, CVE-2011-0073, CVE-2011-0074, CVE-2011-0075, CVE-2011-0076, CVE-2011-0077, CVE-2011-0078, CVE-2011-0080, CVE-2011-0081, CVE-2011-1202
BID: 47635, 47641, 47646, 47647, 47648, 47651, 47653, 47654, 47655, 47656, 47657, 47659, 47660, 47662, 47663, 47667, 47668