Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0174     Jesse Ruderman and Ehsan Akhgari discovered crashes in     the layout engine, which might allow the execution of     arbitrary code.

  - CVE-2010-0175     It was discovered that incorrect memory handling in the     XUL event handler might allow the execution of arbitrary     code.

  - CVE-2010-0176     It was discovered that incorrect memory handling in the     XUL event handler might allow the execution of arbitrary     code.

  - CVE-2010-0177     It was discovered that incorrect memory handling in the     plugin code might allow the execution of arbitrary code.

  - CVE-2010-0178     Paul Stone discovered that forced drag-and-drop events     could lead to Chrome privilege escalation.

  - CVE-2010-0179     It was discovered that a programming error in the     XMLHttpRequestSpy module could lead to the execution of     arbitrary code.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mozilla Firefox earlier than 3.0.19.  Such versions are potentially affected by multiple security issues : 

 - Multiple crashes can result in arbitrary code execution. (MFSA 2010-16)
 - A select event handler for XUL tree items can be called after the item is deleted. (MFSA 2010-17)
 - An error exists in the way '<option>' elements are inserted into a XUL tree '<optgroup>'. (MFSA 2010-18)
 - An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA 2010-19)
 - A browser applet can be used to turn a simple mouse click into a drag-and-drop action, potentially resulting in the unintended loading of resources in a user's browser. (MFSA 2010-20)
 - The XMLHttpRequestSpy module in the Firebug add-on exposes an underlying chrome privilege escalation vulnerability. (MFSA 2010-21)

The remote host is running a version of Mozilla Firefox earlier than 3.0.19.  Such versions are potentially affected by multiple security issues : 

  - Multiple crashes can result in arbitrary code execution. (MFSA 2010-16)

  - A select event handler for XUL tree items can be called after the item is deleted. (MFSA 2010-17)

  - An error exists in the way '&lt;option&gt;' elements are inserted into a XUL tree '&lt;optgroup&gt;'. (MFSA 2010-18)

  - An error exists in the implementation of the 'windows.navigator.plugins' object. (MFSA 2010-19)

  - A browser applet can be used to turn a simple mouse click into a drag-and-drop action, potentially resulting in the unintended loading of resources in a user's browser. (MFSA 2010-20)

  - The XMLHttpRequestSpy module in the Firebug add-on exposes an underlying chrome privilege escalation vulnerability. (MFSA 2010-21)

ID	Name	Product	Family	Published	Updated	Severity
45412	Debian DSA-2027-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	4/5/2010	1/4/2021	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	12/5/2022	critical
5493	Mozilla Firefox < 3.0.19 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/31/2010	3/6/2019	medium
801260	Mozilla Firefox < 3.0.19 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	3/31/2010		high

Detections

Analytics

Plugins Search

critical

critical

medium

high