Mozilla Firefox and Thunderbird were updated to version 8.0 which fixes several security vulnerabilities :

  - MFSA 2011-52 - Code execution via NoWaiverWrapper     (CVE-2011-3655)

  - MFSA 2011-51 - Cross-origin image theft on Mac with     integrated Intel GPU (CVE-2011-3653)

  - MFSA 2011-50 - Cross-origin data theft using canvas and     Windows D2D (CVE-2011-3649)

  - MFSA 2011-49 - Memory corruption while profiling using     Firebug (CVE-2011-3650)

  - MFSA 2011-48 - Miscellaneous memory safety hazards     (rv:8.0) (CVE-2011-3651, CVE-2011-3652, CVE-2011-3654)

  - MFSA 2011-47 - Potential XSS against sites using     Shift-JIS (CVE-2011-3648)

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

The Mozilla Project reports :

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)

MFSA 2011-47 Potential XSS against sites using Shift-JIS

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

MFSA 2011-49 Memory corruption while profiling using Firebug

MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D

MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU

MFSA 2011-52 Code execution via NoWaiverWrapper

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

This update to version 3.13.1 of mozilla-nss fixes the following issues :

  - Explicitly distrust DigiCert Sdn. Bhd (bmo#698753)

  - Better SHA-224 support (bmo#647706)

  - Fix a regression (causing hangs in some situations)     introduced in 3.13 (bmo#693228)

  - SSL 2.0 is disabled by default

  - A defense against the SSL 3.0 and TLS 1.0 CBC chosen     plaintext attack demonstrated by Rizzo and Duong     (CVE-2011-3389) has been enabled by default. Set the     SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.

  - Support SHA-224

  - Add PORT_ErrorToString and PORT_ErrorToName to return     the error message and symbolic name of an NSS error code

  - Add NSS_GetVersion to return the NSS version string

  - Add experimental support of RSA-PSS to the softoken only

  - NSS_NoDB_Init does not try to open /pkcs11.txt and     /secmod.db anymore (bmo#641052)

The installed version of Thunderbird is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

Mozilla Firefox has been updated to version 1.9.2.24 (bnc#728520) to fix the following security issues :

  - (bmo#680880) loadSubScript unwraps XPCNativeWrapper     scope parameter. (MFSA 2011-46 / CVE-2011-3647)

  - (bmo#690225) Potential XSS against sites using     Shift-JIS. (MFSA 2011-47 / CVE-2011-3648)

  - (bmo#674776) Memory corruption while profiling using     Firebug. (MFSA 2011-49 / CVE-2011-3650)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox prior to 8.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

Versions of Mozilla Thunderbird prior to 8.0 are affected by the following security issues :

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)
 - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)
 - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)
 - Multiple memory safety issues exist. (CVE-2011-3651)
 - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)
 - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)
 - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)
 - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Versions of Firefox 7.0 are potentially affected by the following security issues : 

 - Certain invalid sequences are not handled properly in 'Shift-JIS' encoding and can allow cross-site scripting attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-introduced a cross-origin information disclosure issue previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause the application to crash. It may be possible to trigger this behavior even when the debugging APIs are not being used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a non-SVG element and can result in potentially exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow web content to obtain elevated privileges. (CVE-2011-3655)

ID	Name	Product	Family	Published	Updated	Severity
74542	openSUSE Security Update : firefox / thunderbird (openSUSE-2011-9)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
75743	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
56762	FreeBSD : mozilla -- multiple vulnerabilities (6c8ad3e8-0a30-11e1-9580-4061862b8c22)	Nessus	FreeBSD Local Security Checks	11/10/2011	1/6/2021	critical
76024	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
57226	SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)	Nessus	SuSE Local Security Checks	12/13/2011	12/5/2022	critical
56753	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus	Windows	11/9/2011	7/16/2018	high
57084	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5429)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	critical
56751	Firefox < 8.0 Multiple Vulnerabilities	Nessus	Windows	11/9/2011	7/16/2018	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	1/8/2013	12/5/2022	critical
6788	Mozilla Firefox < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/6/2013	3/6/2019	high
6789	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	5/6/2013	3/6/2019	high
801281	Mozilla Thunderbird 7.0 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	5/6/2013		high
801321	Mozilla Firefox 7.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	5/6/2013		high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high

critical

high

critical

high

high

high

high