Detections
Analytics
Mozilla Firefox < 3.6.24 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 9377
Synopsis
The remote host has a web browser installed that is vulnerable to multiple attack vectors.Description
Versions of Firefox earlier than 3.6.24 are potentially affected by multiple vulnerabilities :- A flaw exists within the 'JSSubScriptLoader' that incorrectly unwraps 'XPCNativeWrappers'. By tricking a user into installing a malicious plug-in, an attacker could exploit this issue to execute arbitrary code. (CVE-2011-3647)
- Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting (XSS) attacks. (CVE-2011-3648)
- Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
Solution
Upgrade to Firefox 3.6.24 or later.See Also
https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.6/#firefox3.6.24
http://www.mozilla.org/security/announce/2011/mfsa2011-46.html
http://www.mozilla.org/security/announce/2011/mfsa2011-47.html
http://www.mozilla.org/security/announce/2011/mfsa2011-49.html
Plugin Details
Severity: High
ID: 9377
Family: Web Clients
Published: 6/24/2016
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Patch Publication Date: 11/8/2011
Vulnerability Publication Date: 11/8/2011