{"id": "SECURITYVULNS:DOC:22198", "bulletinFamily": "software", "title": "Mozilla Foundation Security Advisory 2009-35", "description": "Mozilla Foundation Security Advisory 2009-35\r\n\r\nTitle: Crash and remote code execution during Flash player unloading\r\nImpact: Critical\r\nAnnounced: July 21, 2009\r\nReporter: Attila Suszter\r\nProducts: Firefox\r\n\r\nFixed in: Firefox 3.5.1\r\n Firefox 3.0.12\r\nDescription\r\n\r\nSecurity researcher Attila Suszter reported that when a page contains a Flash object which presents a slow script dialog, and the page is navigated while the dialog is still visible to the user, the Flash plugin is unloaded resulting in a crash due to a call to the deleted object. This crash could potentially be used by an attacker to run arbitrary code on a victim's computer.\r\nReferences\r\n\r\n * https://bugzilla.mozilla.org/show_bug.cgi?id=493601\r\n * CVE-2009-2467\r\n", "published": "2009-07-22T00:00:00", "modified": "2009-07-22T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:22198", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2009-2467"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:31", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "a5f56eb7fe1c21546b8b8c6417105424"}, {"key": "cvss", "hash": "2bdabeb49c44761f9565717ab0e38165"}, {"key": "description", "hash": "4ffe3cf72d589c07aa7ce3a208d15f13"}, {"key": "href", "hash": "110a41e68c6fbd314a92b4922ac2edf5"}, {"key": "modified", "hash": "26ee9e7aa37043260b80bfb44b4cd25a"}, {"key": "published", "hash": "26ee9e7aa37043260b80bfb44b4cd25a"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "12035fb2341285fd2ddfb0b78519ff94"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "7b3c8bce9fb8651d31154b48d8a8d7b8885b68635e47e99df0a635aaa23013cf", "viewCount": 0, "enchantments": {"score": {"value": 7.9, "vector": "NONE", "modified": "2018-08-31T11:10:31"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-2467"]}, {"type": "openvas", "idList": ["OPENVAS:900399", "OPENVAS:900398", "OPENVAS:1361412562310900399", "OPENVAS:1361412562310900398", "OPENVAS:1361412562310880740", "OPENVAS:64487", "OPENVAS:64450", "OPENVAS:136141256231064479", "OPENVAS:136141256231064494", "OPENVAS:64479"]}, {"type": "nessus", "idList": ["MOZILLA_FIREFOX_351.NASL", "MANDRIVA_MDVSA-2009-182.NASL", "UBUNTU_USN-798-1.NASL", "SL_20090722_FIREFOX_ON_SL4_X.NASL", "DEBIAN_DSA-1840.NASL", "SL_20090723_FIREFOX_ON_SL4_X.NASL", "SL_20090723_FIREFOX_ON_SL5_X.NASL", "FEDORA_2009-7961.NASL", "SUSE_MOZILLAFIREFOX-6379.NASL", "ORACLELINUX_ELSA-2009-1162.NASL"]}, {"type": "redhat", "idList": ["RHSA-2009:1162"]}, {"type": "ubuntu", "idList": ["USN-798-1"]}, {"type": "debian", "idList": ["DEBIAN:DSA-1840-1:5A2AB"]}, {"type": "centos", "idList": ["CESA-2009:1162"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:10089"]}, {"type": "suse", "idList": ["SUSE-SA:2009:039", "SUSE-SA:2009:042"]}, {"type": "seebug", "idList": ["SSV:11869"]}, {"type": "oraclelinux", "idList": ["ELSA-2009-1162"]}, {"type": "gentoo", "idList": ["GLSA-201301-01"]}], "modified": "2018-08-31T11:10:31"}, "vulnersScore": 7.9}, "objectVersion": "1.3", "affectedSoftware": []}

{"cve": [{"lastseen": "2019-05-29T18:09:59", "bulletinFamily": "NVD", "description": "Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object.", "modified": "2017-09-19T01:29:00", "id": "CVE-2009-2467", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2467", "published": "2009-07-22T18:30:00", "title": "CVE-2009-2467", "type": "cve", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2017-07-02T21:13:57", "bulletinFamily": "scanner", "description": "The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.", "modified": "2017-01-20T00:00:00", "published": "2009-07-23T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=900398", "id": "OPENVAS:900398", "title": "Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_firefox_code_exec_vuln_jul09_win.nasl 5055 2017-01-20 14:08:39Z teissa $\n#\n# Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation could allow remote attacker to execute arbitrary code\n and results in Denial of Service condition.\n Impact Level:System/Application\";\ntag_affected = \"Mozilla Firefox version prior to 3.0.12 and 3.5.1 on Windows.\";\ntag_insight = \"Error exists when a page contains a Flash object which presents a slow script\n dialog, and the page is navigated while the dialog is still visible to the\n user, the Flash plugin is unloaded resulting in a crash due to a call to the\n deleted object.\";\ntag_solution = \"Upgrade to Firefox version 3.0.12 or 3.5.1 or later\n http://www.mozilla.com/en-US/firefox/all.html\";\ntag_summary = \"The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.\";\n\nif(description)\n{\n script_id(900398);\n script_version(\"$Revision: 5055 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-01-20 15:08:39 +0100 (Fri, 20 Jan 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-23 21:05:26 +0200 (Thu, 23 Jul 2009)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2009-2467\");\n script_bugtraq_id(35767);\n script_name(\"Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/35914\");\n script_xref(name : \"URL\" , value : \"http://www.vupen.com/english/advisories/2009/1972\");\n script_xref(name : \"URL\" , value : \"http://www.mozilla.org/security/announce/2009/mfsa2009-35.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 SecPod\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_require_keys(\"Firefox/Win/Ver\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\nffVer = get_kb_item(\"Firefox/Win/Ver\");\nif(!ffVer){\n exit(0);\n}\n\n# Grep for Firefox version < 3.0.12 and < 3.5.1\nif(version_is_less(version:ffVer, test_version:\"3.0.12\") ||\n version_is_equal(version:ffVer, test_version:\"3.5\")){\n security_message(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:14:09", "bulletinFamily": "scanner", "description": "The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.", "modified": "2017-01-20T00:00:00", "published": "2009-07-23T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=900399", "id": "OPENVAS:900399", "title": "Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_firefox_code_exec_vuln_jul09_lin.nasl 5055 2017-01-20 14:08:39Z teissa $\n#\n# Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation could allow remote attacker to execute arbitrary code\n and results in Denial of Service condition.\n Impact Level:System/Application\";\ntag_affected = \"Mozilla Firefox version prior to 3.0.12 and 3.5.1 on Linux.\";\ntag_insight = \"Error exists when a page contains a Flash object which presents a slow script\n dialog, and the page is navigated while the dialog is still visible to the\n user, the Flash plugin is unloaded resulting in a crash due to a call to the\n deleted object.\";\ntag_solution = \"Upgrade to Firefox version 3.0.12 or 3.5.1 or later\n http://www.mozilla.com/en-US/firefox/all.html\";\ntag_summary = \"The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.\";\n\nif(description)\n{\n script_id(900399);\n script_version(\"$Revision: 5055 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-01-20 15:08:39 +0100 (Fri, 20 Jan 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-23 21:05:26 +0200 (Thu, 23 Jul 2009)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2009-2467\");\n script_bugtraq_id(35767);\n script_name(\"Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/35914\");\n script_xref(name : \"URL\" , value : \"http://www.vupen.com/english/advisories/2009/1972\");\n script_xref(name : \"URL\" , value : \"http://www.mozilla.org/security/announce/2009/mfsa2009-35.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 SecPod\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_firefox_detect_lin.nasl\");\n script_require_keys(\"Firefox/Linux/Ver\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"version_func.inc\");\n\nffVer = get_kb_item(\"Firefox/Linux/Ver\");\nif(!ffVer){\n exit(0);\n}\n\n# Grep for Firefox version < 3.0.12 and < 3.5.1\nif(version_is_less(version:ffVer, test_version:\"3.0.12\") ||\n version_is_equal(version:ffVer, test_version:\"3.5\")){\n security_message(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:40:20", "bulletinFamily": "scanner", "description": "The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.", "modified": "2019-04-29T00:00:00", "published": "2009-07-23T00:00:00", "id": "OPENVAS:1361412562310900399", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310900399", "title": "Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.900399\");\n script_version(\"2019-04-29T15:08:03+0000\");\n script_tag(name:\"last_modification\", value:\"2019-04-29 15:08:03 +0000 (Mon, 29 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2009-07-23 21:05:26 +0200 (Thu, 23 Jul 2009)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2009-2467\");\n script_bugtraq_id(35767);\n script_name(\"Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Linux)\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/35914\");\n script_xref(name:\"URL\", value:\"http://www.vupen.com/english/advisories/2009/1972\");\n script_xref(name:\"URL\", value:\"http://www.mozilla.org/security/announce/2009/mfsa2009-35.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 SecPod\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_firefox_detect_lin.nasl\");\n script_mandatory_keys(\"Firefox/Linux/Ver\");\n script_tag(name:\"impact\", value:\"Successful exploitation could allow remote attacker to execute arbitrary code\n and results in Denial of Service condition.\");\n script_tag(name:\"affected\", value:\"Mozilla Firefox version prior to 3.0.12 and 3.5.1 on Linux.\");\n script_tag(name:\"insight\", value:\"Error exists when a page contains a Flash object which presents a slow script\n dialog, and the page is navigated while the dialog is still visible to the\n user, the Flash plugin is unloaded resulting in a crash due to a call to the\n deleted object.\");\n script_tag(name:\"solution\", value:\"Upgrade to Firefox version 3.0.12 or 3.5.1 or later.\");\n script_tag(name:\"summary\", value:\"The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.\");\n script_tag(name:\"qod_type\", value:\"executable_version_unreliable\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nffVer = get_kb_item(\"Firefox/Linux/Ver\");\nif(!ffVer)\n exit(0);\n\nif(version_is_less(version:ffVer, test_version:\"3.0.12\") ||\n version_is_equal(version:ffVer, test_version:\"3.5\")){\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:40:16", "bulletinFamily": "scanner", "description": "The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.", "modified": "2018-12-03T00:00:00", "published": "2009-07-23T00:00:00", "id": "OPENVAS:1361412562310900398", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310900398", "title": "Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_firefox_code_exec_vuln_jul09_win.nasl 12629 2018-12-03 15:19:43Z cfischer $\n#\n# Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.900398\");\n script_version(\"$Revision: 12629 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-12-03 16:19:43 +0100 (Mon, 03 Dec 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-23 21:05:26 +0200 (Thu, 23 Jul 2009)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2009-2467\");\n script_bugtraq_id(35767);\n script_name(\"Mozilla Firefox Remote Code Execution Vulnerabilities July-09 (Windows)\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/35914\");\n script_xref(name:\"URL\", value:\"http://www.vupen.com/english/advisories/2009/1972\");\n script_xref(name:\"URL\", value:\"http://www.mozilla.org/security/announce/2009/mfsa2009-35.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 SecPod\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_firefox_detect_portable_win.nasl\");\n script_mandatory_keys(\"Firefox/Win/Ver\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow remote attacker to execute arbitrary code\n and results in Denial of Service condition.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version prior to 3.0.12 and 3.5.1 on Windows.\");\n\n script_tag(name:\"insight\", value:\"Error exists when a page contains a Flash object which presents a slow script\n dialog, and the page is navigated while the dialog is still visible to the\n user, the Flash plugin is unloaded resulting in a crash due to a call to the\n deleted object.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Firefox version 3.0.12 or 3.5.1 or later.\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Firefox browser and is prone to Remote\n Code Execution vulnerabilities.\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nffVer = get_kb_item(\"Firefox/Win/Ver\");\nif(!ffVer){\n exit(0);\n}\n\nif(version_is_less(version:ffVer, test_version:\"3.0.12\") ||\n version_is_equal(version:ffVer, test_version:\"3.5\")){\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-12-04T11:29:57", "bulletinFamily": "scanner", "description": "The remote host is missing an update to xulrunner-1.9\nannounced via advisory USN-798-1.", "modified": "2017-12-01T00:00:00", "published": "2009-07-29T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64487", "id": "OPENVAS:64487", "title": "Ubuntu USN-798-1 (xulrunner-1.9)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: ubuntu_798_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# $Id: ubuntu_798_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# Description: Auto-generated from advisory USN-798-1 (xulrunner-1.9)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_solution = \"The problem can be corrected by upgrading your system to the\n following package versions:\n\nUbuntu 8.04 LTS:\n firefox-3.0 3.0.12+build1+nobinonly-0ubuntu0.8.04.1\n xulrunner-1.9 1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\n\nUbuntu 8.10:\n abrowser 3.0.12+build1+nobinonly-0ubuntu0.8.10.1\n firefox-3.0 3.0.12+build1+nobinonly-0ubuntu0.8.10.1\n xulrunner-1.9 1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\n\nUbuntu 9.04:\n abrowser 3.0.12+build1+nobinonly-0ubuntu0.9.04.1\n firefox-3.0 3.0.12+build1+nobinonly-0ubuntu0.9.04.1\n xulrunner-1.9 1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\n\nAfter a standard system upgrade you need to restart Firefox and any\napplications that use xulrunner, such as Epiphany, to effect the necessary\nchanges.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=USN-798-1\";\n\ntag_insight = \"Several flaws were discovered in the Firefox browser and JavaScript\nengines. If a user were tricked into viewing a malicious website, a remote\nattacker could cause a denial of service or possibly execute arbitrary code\nwith the privileges of the user invoking the program. (CVE-2009-2462,\nCVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2469)\n\nAttila Suszter discovered a flaw in the way Firefox processed Flash content.\nIf a user were tricked into viewing and navigating within a specially\ncrafted Flash object, a remote attacker could cause a denial of service or\npossibly execute arbitrary code with the privileges of the user invoking\nthe program. (CVE-2009-2467)\n\nIt was discovered that Firefox did not properly handle some SVG content. An\nattacker could exploit this to cause a denial of service or possibly\nexecute arbitrary code with the privileges of the user invoking the\nprogram. (CVE-2009-2469)\n\nA flaw was discovered in the JavaScript engine. If a user were tricked into\nviewing a malicious website, an attacker could exploit this perform\ncross-site scripting attacks. (CVE-2009-2472)\";\ntag_summary = \"The remote host is missing an update to xulrunner-1.9\nannounced via advisory USN-798-1.\";\n\n \n\n\nif(description)\n{\n script_id(64487);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2472\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Ubuntu USN-798-1 (xulrunner-1.9)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-798-1/\");\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"firefox-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-libthai\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dom-inspector\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-venkman\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dev\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-gnome-support\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"abrowser\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-libthai\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dom-inspector\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-venkman\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"abrowser-3.0-branding\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-branding\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dev\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-gnome-support\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-dev\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"abrowser\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-granparadiso\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-libthai\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-dom-inspector\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk-venkman\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-trunk\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dom-inspector\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-venkman\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"abrowser-3.0-branding\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-branding\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-dev\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0-gnome-support\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"firefox-3.0\", ver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-dev\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9-gnome-support\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-1.9\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xulrunner-dev\", ver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\", rls:\"UBUNTU9.04\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-27T10:56:10", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory RHSA-2009:1162.\n\nMozilla Firefox is an open source Web browser. XULRunner provides the XUL\nRuntime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,\nCVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed JavaScript\ncode. A website containing malicious content could launch a cross-site\nscripting (XSS) attack or execute arbitrary JavaScript with the permissions\nof another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla security\nadvisories for Firefox 3.0.12. You can find a link to the Mozilla\nadvisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which contain\nFirefox version 3.0.12, which corrects these issues. After installing the\nupdate, Firefox must be restarted for the changes to take effect.", "modified": "2017-07-12T00:00:00", "published": "2009-07-29T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64450", "id": "OPENVAS:64450", "title": "RedHat Security Advisory RHSA-2009:1162", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: RHSA_2009_1162.nasl 6683 2017-07-12 09:41:57Z cfischer $\n# Description: Auto-generated from advisory RHSA-2009:1162 ()\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates announced in\nadvisory RHSA-2009:1162.\n\nMozilla Firefox is an open source Web browser. XULRunner provides the XUL\nRuntime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,\nCVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed JavaScript\ncode. A website containing malicious content could launch a cross-site\nscripting (XSS) attack or execute arbitrary JavaScript with the permissions\nof another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla security\nadvisories for Firefox 3.0.12. You can find a link to the Mozilla\nadvisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which contain\nFirefox version 3.0.12, which corrects these issues. After installing the\nupdate, Firefox must be restarted for the changes to take effect.\";\n\ntag_solution = \"Please note that this update is available via\nRed Hat Network. To use Red Hat Network, launch the Red\nHat Update Agent with the following command: up2date\";\n\n\n\nif(description)\n{\n script_id(64450);\n script_version(\"$Revision: 6683 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:41:57 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"RedHat Security Advisory RHSA-2009:1162\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"http://rhn.redhat.com/errata/RHSA-2009-1162.html\");\n script_xref(name : \"URL\" , value : \"http://www.redhat.com/security/updates/classification/#critical\");\n script_xref(name : \"URL\" , value : \"http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.12\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"firefox\", rpm:\"firefox~3.0.12~1.el4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"firefox-debuginfo\", rpm:\"firefox-debuginfo~3.0.12~1.el4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"firefox\", rpm:\"firefox~3.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"firefox-debuginfo\", rpm:\"firefox-debuginfo~3.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner\", rpm:\"xulrunner~1.9.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner-debuginfo\", rpm:\"xulrunner-debuginfo~1.9.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner-devel\", rpm:\"xulrunner-devel~1.9.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner-devel-unstable\", rpm:\"xulrunner-devel-unstable~1.9.0.12~1.el5_3\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:35", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2011-08-09T00:00:00", "id": "OPENVAS:1361412562310880740", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310880740", "title": "CentOS Update for firefox CESA-2009:1162 centos5 i386", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for firefox CESA-2009:1162 centos5 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2009-July/016046.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.880740\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"CESA\", value:\"2009:1162\");\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\",\n \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\",\n \"CVE-2009-2472\");\n script_name(\"CentOS Update for firefox CESA-2009:1162 centos5 i386\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'firefox'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n script_tag(name:\"affected\", value:\"firefox on CentOS 5\");\n script_tag(name:\"insight\", value:\"Mozilla Firefox is an open source Web browser. XULRunner provides the XUL\n Runtime environment for Mozilla Firefox.\n\n Several flaws were found in the processing of malformed web content. A web\n page containing malicious content could cause Firefox to crash or,\n potentially, execute arbitrary code as the user running Firefox.\n (CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,\n CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\n Several flaws were found in the way Firefox handles malformed JavaScript\n code. A website containing malicious content could launch a cross-site\n scripting (XSS) attack or execute arbitrary JavaScript with the permissions\n of another website. (CVE-2009-2472)\n\n For technical details regarding these flaws, refer to the Mozilla security\n advisories for Firefox 3.0.12. You can find a link to the Mozilla\n advisories in the References section of this errata.\n\n All Firefox users should upgrade to these updated packages, which contain\n Firefox version 3.0.12, which corrects these issues. After installing the\n update, Firefox must be restarted for the changes to take effect.\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"firefox\", rpm:\"firefox~3.0.12~1.el5.centos\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xulrunner\", rpm:\"xulrunner~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xulrunner-devel\", rpm:\"xulrunner-devel~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xulrunner-devel-unstable\", rpm:\"xulrunner-devel-unstable~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2018-04-06T11:38:45", "bulletinFamily": "scanner", "description": "The remote host is missing an update to blam\nannounced via advisory FEDORA-2009-7961.", "modified": "2018-04-06T00:00:00", "published": "2009-07-29T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064468", "id": "OPENVAS:136141256231064468", "title": "Fedora Core 10 FEDORA-2009-7961 (blam)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_7961.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-7961 (blam)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nUpdate to new upstream Firefox version 3.0.12, fixing multiple security issues\ndetailed in the upstream advisories:\nhttp://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.12\n\nUpdate also includes all packages depending on gecko-libs rebuilt against\nnew version of Firefox / XULRunner.\n\nChangeLog:\n\n* Tue Jul 21 2009 Jan Horak - 1.8.5-12\n- Rebuild against newer gecko\n* Thu Jun 11 2009 Christopher Aillon - 1.8.5-11\n- Rebuild against newer gecko\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update blam' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-7961\";\ntag_summary = \"The remote host is missing an update to blam\nannounced via advisory FEDORA-2009-7961.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64468\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2462\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 10 FEDORA-2009-7961 (blam)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512131\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512133\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512135\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512128\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512136\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512137\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512142\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512146\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512147\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"blam\", rpm:\"blam~1.8.5~12.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"blam-debuginfo\", rpm:\"blam-debuginfo~1.8.5~12.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:56:37", "bulletinFamily": "scanner", "description": "The remote host is missing updates to firefox announced in\nadvisory CESA-2009:1162.", "modified": "2017-07-10T00:00:00", "published": "2009-07-29T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64494", "id": "OPENVAS:64494", "title": "CentOS Security Advisory CESA-2009:1162 (firefox)", "type": "openvas", "sourceData": "#CESA-2009:1162 64494 2\n# $Id: ovcesa2009_1162.nasl 6650 2017-07-10 11:43:12Z cfischer $\n# Description: Auto-generated from advisory CESA-2009:1162 (firefox)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed in this update,\nplease visit the referenced security advisories.\";\ntag_solution = \"Update the appropriate packages on your system.\n\nhttp://www.securityspace.com/smysecure/catid.html?in=CESA-2009:1162\nhttp://www.securityspace.com/smysecure/catid.html?in=RHSA-2009:1162\nhttps://rhn.redhat.com/errata/RHSA-2009-1162.html\";\ntag_summary = \"The remote host is missing updates to firefox announced in\nadvisory CESA-2009:1162.\";\n\n\n\nif(description)\n{\n script_id(64494);\n script_version(\"$Revision: 6650 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:43:12 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"CentOS Security Advisory CESA-2009:1162 (firefox)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"firefox\", rpm:\"firefox~3.0.12~1.el5.centos\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner\", rpm:\"xulrunner~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner-devel\", rpm:\"xulrunner-devel~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"xulrunner-devel-unstable\", rpm:\"xulrunner-devel-unstable~1.9.0.12~1.el5\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:56:35", "bulletinFamily": "scanner", "description": "The remote host is missing an update to blam\nannounced via advisory FEDORA-2009-7961.", "modified": "2017-07-10T00:00:00", "published": "2009-07-29T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=64468", "id": "OPENVAS:64468", "title": "Fedora Core 10 FEDORA-2009-7961 (blam)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_7961.nasl 6624 2017-07-10 06:11:55Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-7961 (blam)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Update Information:\n\nUpdate to new upstream Firefox version 3.0.12, fixing multiple security issues\ndetailed in the upstream advisories:\nhttp://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.12\n\nUpdate also includes all packages depending on gecko-libs rebuilt against\nnew version of Firefox / XULRunner.\n\nChangeLog:\n\n* Tue Jul 21 2009 Jan Horak - 1.8.5-12\n- Rebuild against newer gecko\n* Thu Jun 11 2009 Christopher Aillon - 1.8.5-11\n- Rebuild against newer gecko\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update blam' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-7961\";\ntag_summary = \"The remote host is missing an update to blam\nannounced via advisory FEDORA-2009-7961.\";\n\n\n\nif(description)\n{\n script_id(64468);\n script_version(\"$Revision: 6624 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:11:55 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-29 19:28:37 +0200 (Wed, 29 Jul 2009)\");\n script_cve_id(\"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2462\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 10 FEDORA-2009-7961 (blam)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512131\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512133\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512135\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512128\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512136\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512137\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512142\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512146\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=512147\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"blam\", rpm:\"blam~1.8.5~12.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"blam-debuginfo\", rpm:\"blam-debuginfo~1.8.5~12.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2019-12-13T08:06:17", "bulletinFamily": "scanner", "description": "Firefox 3.5 is installed on the remote host. This version is\npotentially affected by multiple flaws :\n\n - It may be possible to crash the browser or potentially\n execute arbitrary code by using a flash object that\n presents a slow script dialog. (MFSA 2009-35)\n\n - In certain cases after a return from a native function,\n such as escape(), the Just-in-Time (JIT) compiler could\n get into a corrupt state. An attacker who is able to\n trick a user of the affected software into visiting a\n malicious link may be able to leverage this issue to\n run arbitrary code subject to the user", "modified": "2019-12-02T00:00:00", "id": "MOZILLA_FIREFOX_351.NASL", "href": "https://www.tenable.com/plugins/nessus/39853", "published": "2009-07-17T00:00:00", "title": "Firefox 3.5.x < 3.5.1 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(39853);\n script_version(\"1.20\");\n\n script_cve_id(\"CVE-2009-2467\", \"CVE-2009-2477\");\n script_bugtraq_id(35660,35767);\n\n script_name(english:\"Firefox 3.5.x < 3.5.1 Multiple Vulnerabilities\");\n script_summary(english:\"Checks version of Firefox\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains a web browser that is \naffected by multiple flaws.\" );\n\n script_set_attribute(attribute:\"description\", value:\n\"Firefox 3.5 is installed on the remote host. This version is\npotentially affected by multiple flaws :\n\n - It may be possible to crash the browser or potentially\n execute arbitrary code by using a flash object that\n presents a slow script dialog. (MFSA 2009-35)\n\n - In certain cases after a return from a native function,\n such as escape(), the Just-in-Time (JIT) compiler could\n get into a corrupt state. An attacker who is able to\n trick a user of the affected software into visiting a\n malicious link may be able to leverage this issue to\n run arbitrary code subject to the user's privileges.\n (MFSA 2009-41)\");\n\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-35/\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-41/\" );\n script_set_attribute(attribute:\"solution\", value: \"Upgrade to Firefox 3.5.1 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Firefox 3.5 escape() Return Value Memory Corruption');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(94);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/17\");\n\n script_cvs_date(\"Date: 2018/07/16 14:09:14\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Firefox/Version\");\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\nport = get_kb_item_or_exit(\"SMB/transport\"); \n\ninstalls = get_kb_list(\"SMB/Mozilla/Firefox/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Firefox\");\n\nmozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'3.5.1', min:'3.5', severity:SECURITY_HOLE);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T09:13:01", "bulletinFamily": "scanner", "description": "Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)", "modified": "2019-12-02T00:00:00", "id": "SL_20090723_FIREFOX_ON_SL4_X.NASL", "href": "https://www.tenable.com/plugins/nessus/60618", "published": "2012-08-01T00:00:00", "title": "Scientific Linux Security Update : firefox on SL4.x i386/x86_64", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(60618);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2019/10/25 13:36:18\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n\n script_name(english:\"Scientific Linux Security Update : firefox on SL4.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0907&L=scientific-linux-errata&T=0&P=1278\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5dc823c9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL4\", reference:\"firefox-3.0.12-1.el4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T09:13:01", "bulletinFamily": "scanner", "description": "Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)", "modified": "2019-12-02T00:00:00", "id": "SL_20090722_FIREFOX_ON_SL4_X.NASL", "href": "https://www.tenable.com/plugins/nessus/62808", "published": "2012-11-05T00:00:00", "title": "Scientific Linux Security Update : firefox on SL4.x i386/x86_64", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(62808);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/10/25 13:36:18\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n\n script_name(english:\"Scientific Linux Security Update : firefox on SL4.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0907&L=scientific-linux-errata&T=0&P=1278\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5dc823c9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/11/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL4\", reference:\"firefox-3.0.12-1.el4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T07:03:16", "bulletinFamily": "scanner", "description": "Update to new upstream Firefox version 3.0.12, fixing multiple\nsecurity issues detailed in the upstream advisories:\nhttp://www.mozilla.org/security/known-\nvulnerabilities/firefox30.html#firefox3.0.12 Update also includes all\npackages depending on gecko-libs rebuilt against new version of\nFirefox / XULRunner.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-12-02T00:00:00", "id": "FEDORA_2009-7961.NASL", "href": "https://www.tenable.com/plugins/nessus/40358", "published": "2009-07-24T00:00:00", "title": "Fedora 10 : Miro-2.0.5-2.fc10 / blam-1.8.5-12.fc10 / devhelp-0.22-10.fc10 / epiphany-2.24.3-8.fc10 / etc (2009-7961)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-7961.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40358);\n script_version (\"1.20\");\n script_cvs_date(\"Date: 2019/08/02 13:32:30\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_xref(name:\"FEDORA\", value:\"2009-7961\");\n\n script_name(english:\"Fedora 10 : Miro-2.0.5-2.fc10 / blam-1.8.5-12.fc10 / devhelp-0.22-10.fc10 / epiphany-2.24.3-8.fc10 / etc (2009-7961)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to new upstream Firefox version 3.0.12, fixing multiple\nsecurity issues detailed in the upstream advisories:\nhttp://www.mozilla.org/security/known-\nvulnerabilities/firefox30.html#firefox3.0.12 Update also includes all\npackages depending on gecko-libs rebuilt against new version of\nFirefox / XULRunner.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # http://www.mozilla.org/security/known-\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.mozilla.org/en-US/security/known-\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512128\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512131\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512133\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512135\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512136\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512137\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512142\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512146\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=512147\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026940.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a9dd026a\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026941.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4244bed7\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026942.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?81496686\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026943.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9dd95c64\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026944.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?af86fc95\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026945.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6bf4edb3\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026946.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?acc83ba7\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026947.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b2604ba8\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026952.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?70f0f671\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026953.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?40146428\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026954.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8a6cbcfa\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026955.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4cf0b532\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026956.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?78440d72\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026957.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c6c01baf\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026958.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?411702c7\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026959.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b58dabbd\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026961.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3d1a96ef\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-July/026962.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0e609dc6\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:Miro\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:blam\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:devhelp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:epiphany\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:evolution-rss\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:galeon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gecko-sharp2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gnome-python2-extras\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gnome-web-photo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:google-gadgets\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kazehakase\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mozvoikko\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mugshot\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pcmanx-gtk2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:ruby-gnome2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xulrunner\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:yelp\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^10([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 10.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC10\", reference:\"Miro-2.0.5-2.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"blam-1.8.5-12.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"devhelp-0.22-10.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"epiphany-2.24.3-8.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"evolution-rss-0.1.2-8.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"firefox-3.0.12-1.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"galeon-2.0.7-12.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"gecko-sharp2-0.13-10.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"gnome-python2-extras-2.19.1-32.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"gnome-web-photo-0.3-20.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"google-gadgets-0.10.5-8.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"kazehakase-0.5.6-4.fc10.4\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"mozvoikko-0.9.5-12.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"mugshot-1.2.2-11.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"pcmanx-gtk2-0.3.8-11.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"ruby-gnome2-0.19.0-3.fc10.1\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"xulrunner-1.9.0.12-1.fc10\")) flag++;\nif (rpm_check(release:\"FC10\", reference:\"yelp-2.24.0-11.fc10\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Miro / blam / devhelp / epiphany / evolution-rss / firefox / galeon / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T09:13:01", "bulletinFamily": "scanner", "description": "Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)", "modified": "2019-12-02T00:00:00", "id": "SL_20090723_FIREFOX_ON_SL5_X.NASL", "href": "https://www.tenable.com/plugins/nessus/60619", "published": "2012-08-01T00:00:00", "title": "Scientific Linux Security Update : firefox on SL5.x i386/x86_64", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(60619);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2019/10/25 13:36:18\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n\n script_name(english:\"Scientific Linux Security Update : firefox on SL5.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0907&L=scientific-linux-errata&T=0&P=1530\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7cafadec\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL5\", reference:\"firefox-3.0.12-1.el5_3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T06:51:07", "bulletinFamily": "scanner", "description": "Several remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems :\n\n - CVE-2009-2462\n Martijn Wargers, Arno Renevier, Jesse Ruderman, Olli\n Pettay and Blake Kaplan discovered several issues in the\n browser engine that could potentially lead to the\n execution of arbitrary code. (MFSA 2009-34)\n\n - CVE-2009-2463\n monarch2020 reported an integer overflow in a base64\n decoding function. (MFSA 2009-34)\n\n - CVE-2009-2464\n Christophe Charron reported a possibly exploitable crash\n occurring when multiple RDF files were loaded in a XUL\n tree element. (MFSA 2009-34)\n\n - CVE-2009-2465\n Yongqian Li reported that an unsafe memory condition\n could be created by specially crafted document. (MFSA\n 2009-34)\n\n - CVE-2009-2466\n Peter Van der Beken, Mike Shaver, Jesse Ruderman, and\n Carsten Book discovered several issues in the JavaScript\n engine that could possibly lead to the execution of\n arbitrary JavaScript. (MFSA 2009-34)\n\n - CVE-2009-2467\n Attila Suszter discovered an issue related to a\n specially crafted Flash object, which could be used to\n run arbitrary code. (MFSA 2009-35)\n\n - CVE-2009-2469\n PenPal discovered that it is possible to execute\n arbitrary code via a specially crafted SVG element.\n (MFSA 2009-37)\n\n - CVE-2009-2471\n Blake Kaplan discovered a flaw in the JavaScript engine\n that might allow an attacker to execute arbitrary\n JavaScript with chrome privileges. (MFSA 2009-39)\n\n - CVE-2009-2472\n moz_bug_r_a4 discovered an issue in the JavaScript\n engine that could be used to perform cross-site\n scripting attacks. (MFSA 2009-40)", "modified": "2019-12-02T00:00:00", "id": "DEBIAN_DSA-1840.NASL", "href": "https://www.tenable.com/plugins/nessus/44705", "published": "2010-02-24T00:00:00", "title": "Debian DSA-1840-1 : xulrunner - several vulnerabilities", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1840. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44705);\n script_version(\"1.19\");\n script_cvs_date(\"Date: 2019/08/02 13:32:22\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_bugtraq_id(35765, 35766, 35767, 35769, 35770, 35772, 35773, 35775, 35776);\n script_xref(name:\"DSA\", value:\"1840\");\n\n script_name(english:\"Debian DSA-1840-1 : xulrunner - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems :\n\n - CVE-2009-2462\n Martijn Wargers, Arno Renevier, Jesse Ruderman, Olli\n Pettay and Blake Kaplan discovered several issues in the\n browser engine that could potentially lead to the\n execution of arbitrary code. (MFSA 2009-34)\n\n - CVE-2009-2463\n monarch2020 reported an integer overflow in a base64\n decoding function. (MFSA 2009-34)\n\n - CVE-2009-2464\n Christophe Charron reported a possibly exploitable crash\n occurring when multiple RDF files were loaded in a XUL\n tree element. (MFSA 2009-34)\n\n - CVE-2009-2465\n Yongqian Li reported that an unsafe memory condition\n could be created by specially crafted document. (MFSA\n 2009-34)\n\n - CVE-2009-2466\n Peter Van der Beken, Mike Shaver, Jesse Ruderman, and\n Carsten Book discovered several issues in the JavaScript\n engine that could possibly lead to the execution of\n arbitrary JavaScript. (MFSA 2009-34)\n\n - CVE-2009-2467\n Attila Suszter discovered an issue related to a\n specially crafted Flash object, which could be used to\n run arbitrary code. (MFSA 2009-35)\n\n - CVE-2009-2469\n PenPal discovered that it is possible to execute\n arbitrary code via a specially crafted SVG element.\n (MFSA 2009-37)\n\n - CVE-2009-2471\n Blake Kaplan discovered a flaw in the JavaScript engine\n that might allow an attacker to execute arbitrary\n JavaScript with chrome privileges. (MFSA 2009-39)\n\n - CVE-2009-2472\n moz_bug_r_a4 discovered an issue in the JavaScript\n engine that could be used to perform cross-site\n scripting attacks. (MFSA 2009-40)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2464\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2465\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2466\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2467\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2469\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2471\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-2472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1840\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the xulrunner packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.9.0.12-0lenny1.\n\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:xulrunner\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"libmozillainterfaces-java\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmozjs-dev\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmozjs1d\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libmozjs1d-dbg\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"python-xpcom\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"spidermonkey-bin\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"xulrunner-1.9\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"xulrunner-1.9-dbg\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"xulrunner-1.9-gnome-support\", reference:\"1.9.0.12-0lenny1\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"xulrunner-dev\", reference:\"1.9.0.12-0lenny1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T09:57:20", "bulletinFamily": "scanner", "description": "Several flaws were discovered in the Firefox browser and JavaScript\nengines. If a user were tricked into viewing a malicious website, a\nremote attacker could cause a denial of service or possibly execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2469)\n\nAttila Suszter discovered a flaw in the way Firefox processed Flash\ncontent. If a user were tricked into viewing and navigating within a\nspecially crafted Flash object, a remote attacker could cause a denial\nof service or possibly execute arbitrary code with the privileges of\nthe user invoking the program. (CVE-2009-2467)\n\nIt was discovered that Firefox did not properly handle some SVG\ncontent. An attacker could exploit this to cause a denial of service\nor possibly execute arbitrary code with the privileges of the user\ninvoking the program. (CVE-2009-2469)\n\nA flaw was discovered in the JavaScript engine. If a user were tricked\ninto viewing a malicious website, an attacker could exploit this\nperform cross-site scripting attacks. (CVE-2009-2472).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2019-12-02T00:00:00", "id": "UBUNTU_USN-798-1.NASL", "href": "https://www.tenable.com/plugins/nessus/40348", "published": "2009-07-23T00:00:00", "title": "Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-798-1)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-798-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40348);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2019/08/02 13:33:02\");\n\n script_cve_id(\"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2472\");\n script_xref(name:\"USN\", value:\"798-1\");\n\n script_name(english:\"Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-798-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several flaws were discovered in the Firefox browser and JavaScript\nengines. If a user were tricked into viewing a malicious website, a\nremote attacker could cause a denial of service or possibly execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2469)\n\nAttila Suszter discovered a flaw in the way Firefox processed Flash\ncontent. If a user were tricked into viewing and navigating within a\nspecially crafted Flash object, a remote attacker could cause a denial\nof service or possibly execute arbitrary code with the privileges of\nthe user invoking the program. (CVE-2009-2467)\n\nIt was discovered that Firefox did not properly handle some SVG\ncontent. An attacker could exploit this to cause a denial of service\nor possibly execute arbitrary code with the privileges of the user\ninvoking the program. (CVE-2009-2469)\n\nA flaw was discovered in the JavaScript engine. If a user were tricked\ninto viewing a malicious website, an attacker could exploit this\nperform cross-site scripting attacks. (CVE-2009-2472).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/798-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:abrowser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:abrowser-3.0-branding\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-branding\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-dom-inspector\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-gnome-support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-venkman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-dom-inspector\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-gnome-support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso-dom-inspector\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso-gnome-support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-libthai\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-trunk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-dom-inspector\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-gnome-support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-venkman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9-dom-inspector\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9-gnome-support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9-venkman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:xulrunner-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:9.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(8\\.04|8\\.10|9\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 8.04 / 8.10 / 9.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-3.0\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-3.0-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-3.0-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-3.0-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-3.0-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-granparadiso\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-granparadiso-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-granparadiso-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-granparadiso-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-libthai\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-trunk\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-trunk-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-trunk-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-trunk-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"firefox-trunk-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"xulrunner-1.9\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"xulrunner-1.9-dev\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"xulrunner-1.9-dom-inspector\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"xulrunner-1.9-gnome-support\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"xulrunner-1.9-venkman\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"abrowser\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"abrowser-3.0-branding\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0-branding\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-3.0-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-granparadiso\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-granparadiso-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-granparadiso-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-granparadiso-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-libthai\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-trunk\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-trunk-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-trunk-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-trunk-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"firefox-trunk-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.8.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-1.9\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-1.9-dev\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-1.9-dom-inspector\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-1.9-gnome-support\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-1.9-venkman\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"xulrunner-dev\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"abrowser\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"abrowser-3.0-branding\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0-branding\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-3.0-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-granparadiso\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-granparadiso-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-granparadiso-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-granparadiso-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-libthai\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-trunk\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-trunk-dev\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-trunk-dom-inspector\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-trunk-gnome-support\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"firefox-trunk-venkman\", pkgver:\"3.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-1.9\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-1.9-dev\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-1.9-dom-inspector\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-1.9-gnome-support\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-1.9-venkman\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"xulrunner-dev\", pkgver:\"1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"abrowser / abrowser-3.0-branding / firefox / firefox-3.0 / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T08:06:16", "bulletinFamily": "scanner", "description": "The installed version of Firefox is earlier than 3.0.12. Such versions\nare potentially affected by the following security issues :\n\n - Multiple memory corruption vulnerabilities could \n potentially be exploited to execute arbitrary code. \n (MFSA 2009-34)\n\n - It may be possible to crash the browser or potentially\n execute arbitrary code by using a flash object that\n presents a slow script dialog. (MFSA 2009-35) \n\n - Glyph rendering libraries are affected by multiple heap/\n integer overflows. (MFSA 2009-36)\n\n - A vulnerability involving SVG element could be exploited\n to crash the browser or execute arbitrary code on the\n remote system. (MFSA 2009-37)\n\n - A SOCKS5 proxy that replies with a hostname containing\n more than 15 characters can corrupt the subsequent\n data stream. This can lead to a denial of service,\n though there is reportedly no memory corruption.\n (MFSA 2009-38)\n\n - A vulnerability in ", "modified": "2019-12-02T00:00:00", "id": "MOZILLA_FIREFOX_3012.NASL", "href": "https://www.tenable.com/plugins/nessus/40351", "published": "2009-07-22T00:00:00", "title": "Firefox < 3.0.12 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40351);\n script_version(\"1.16\");\n\n script_cve_id(\"CVE-2009-1194\", \"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\",\n \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2468\", \"CVE-2009-2469\", \"CVE-2009-2470\",\n \"CVE-2009-2471\", \"CVE-2009-2472\");\n script_bugtraq_id(35765, 35766, 35767, 35769, 35770, 35772, 35773, 35774, 35775, 35776, 35925);\n script_xref(name:\"Secunia\", value:\"35914\");\n script_xref(name:\"Secunia\", value:\"36001\");\n\n script_name(english:\"Firefox < 3.0.12 Multiple Vulnerabilities\");\n script_summary(english:\"Checks version of Firefox\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains a web browser that is affected by\nmultiple vulnerabilities.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The installed version of Firefox is earlier than 3.0.12. Such versions\nare potentially affected by the following security issues :\n\n - Multiple memory corruption vulnerabilities could \n potentially be exploited to execute arbitrary code. \n (MFSA 2009-34)\n\n - It may be possible to crash the browser or potentially\n execute arbitrary code by using a flash object that\n presents a slow script dialog. (MFSA 2009-35) \n\n - Glyph rendering libraries are affected by multiple heap/\n integer overflows. (MFSA 2009-36)\n\n - A vulnerability involving SVG element could be exploited\n to crash the browser or execute arbitrary code on the\n remote system. (MFSA 2009-37)\n\n - A SOCKS5 proxy that replies with a hostname containing\n more than 15 characters can corrupt the subsequent\n data stream. This can lead to a denial of service,\n though there is reportedly no memory corruption.\n (MFSA 2009-38)\n\n - A vulnerability in 'setTimeout' could allow unsafe\n access to the 'this' object from chrome code. An\n attacker could exploit this flaw to run arbitrary \n JavaScript with chrome privileges. (MFSA 2009-39)\n\n - It may be possible for JavaScript from one website\n to bypass cross origin wrapper, and unsafely access\n properties of an object from another website.\n (MFSA 2009-40)\");\n\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-34/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-35/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-36/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-37/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-38/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-39/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2009-40/\");\n \n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/22\");\n\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Firefox 3.0.12 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(20, 79, 189, 399);\n\n script_cvs_date(\"Date: 2018/07/16 14:09:14\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Firefox/Version\");\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\nport = get_kb_item_or_exit(\"SMB/transport\"); \n\ninstalls = get_kb_list(\"SMB/Mozilla/Firefox/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Firefox\");\n\nmozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'3.0.12', severity:SECURITY_HOLE);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T09:20:37", "bulletinFamily": "scanner", "description": "The MozillaFirefox 3.0.12 release fixes various bugs and some critical\nsecurity issues.\n\nMFSA 2009-34 / CVE-2009-2462 / CVE-2009-2463 / CVE-2009-2464 /\nCVE-2009-2465 / CVE-2009-2466: Mozilla developers and community\nmembers identified and fixed several stability bugs in the browser\nengine used in Firefox and other Mozilla-based products. Some of these\ncrashes showed evidence of memory corruption under certain\ncircumstances and we presume that with enough effort at least some of\nthese could be exploited to run arbitrary code.\n\nMFSA 2009-35 / CVE-2009-2467: Security researcher Attila Suszter\nreported that when a page contains a Flash object which presents a\nslow script dialog, and the page is navigated while the dialog is\nstill visible to the user, the Flash plugin is unloaded resulting in a\ncrash due to a call to the deleted object. This crash could\npotentially be used by an attacker to run arbitrary code on a victim", "modified": "2019-12-02T00:00:00", "id": "SUSE_11_0_MOZILLAFIREFOX-090724.NASL", "href": "https://www.tenable.com/plugins/nessus/40403", "published": "2009-07-28T00:00:00", "title": "openSUSE Security Update : MozillaFirefox (MozillaFirefox-1135)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update MozillaFirefox-1135.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40403);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2019/10/25 13:36:33\");\n\n script_cve_id(\"CVE-2009-1194\", \"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2469\", \"CVE-2009-2471\", \"CVE-2009-2472\");\n\n script_name(english:\"openSUSE Security Update : MozillaFirefox (MozillaFirefox-1135)\");\n script_summary(english:\"Check for the MozillaFirefox-1135 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The MozillaFirefox 3.0.12 release fixes various bugs and some critical\nsecurity issues.\n\nMFSA 2009-34 / CVE-2009-2462 / CVE-2009-2463 / CVE-2009-2464 /\nCVE-2009-2465 / CVE-2009-2466: Mozilla developers and community\nmembers identified and fixed several stability bugs in the browser\nengine used in Firefox and other Mozilla-based products. Some of these\ncrashes showed evidence of memory corruption under certain\ncircumstances and we presume that with enough effort at least some of\nthese could be exploited to run arbitrary code.\n\nMFSA 2009-35 / CVE-2009-2467: Security researcher Attila Suszter\nreported that when a page contains a Flash object which presents a\nslow script dialog, and the page is navigated while the dialog is\nstill visible to the user, the Flash plugin is unloaded resulting in a\ncrash due to a call to the deleted object. This crash could\npotentially be used by an attacker to run arbitrary code on a victim's\ncomputer.\n\nMFSA 2009-36 / CVE-2009-1194: oCERT security researcher Will Drewry\nreported a series of heap and integer overflow vulnerabilities which\nindependently affected multiple font glyph rendering libraries. On\nLinux platforms libpango was susceptible to the vulnerabilities while\non OS X CoreGraphics was similarly vulnerable. An attacker could\ntrigger these overflows by constructing a very large text run for the\nbrowser to display. Such an overflow can result in a crash which the\nattacker could potentially use to run arbitrary code on a victim's\ncomputer. The open-source nature of Linux meant that Mozilla was able\nto work with the libpango maintainers to implement the correct fix in\nversion 1.24 of that system library which was distributed with OS\nsecurity updates. On Mac OS X Firefox works around the CoreGraphics\nflaw by limiting the length of text runs passed to the system.\n\nMFSA 2009-37 / CVE-2009-2469: Security researcher PenPal reported a\ncrash involving a SVG element on which a watch function and\n__defineSetter__ function have been set for a particular property. The\ncrash showed evidence of memory corruption and could potentially be\nused by an attacker to run arbitrary code on a victim's computer.\n\nMFSA 2009-39 / CVE-2009-2471: Mozilla developer Blake Kaplan reported\nthat setTimeout, when called with certain object parameters which\nshould be protected with a XPCNativeWrapper, will fail to keep the\nobject wrapped when compiling the new function to be executed. If\nchrome privileged code were to call setTimeout using this as an\nargument, the this object will lose its wrapper and could be unsafely\naccessed by chrome code. An attacker could use such vulnerable code to\nrun arbitrary JavaScript with chrome privileges.\n\nMFSA 2009-40 / CVE-2009-2472: Mozilla security researcher moz_bug_r_a4\nreported a series of vulnerabilities in which objects that normally\nreceive a XPCCrossOriginWrapper are constructed without the wrapper.\nThis can lead to cases where JavaScript from one website may unsafely\naccess properties of such an object which had been set by a different\nwebsite. A malicious website could use this vulnerability to launch a\nXSS attack and run arbitrary JavaScript within the context of another\nsite.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=522109\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected MozillaFirefox packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:MozillaFirefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:MozillaFirefox-translations\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-gnomevfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-gnomevfs-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-translations\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:mozilla-xulrunner190-translations-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"MozillaFirefox-3.0.12-0.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"MozillaFirefox-translations-3.0.12-0.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"mozilla-xulrunner190-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"mozilla-xulrunner190-devel-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"mozilla-xulrunner190-gnomevfs-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"mozilla-xulrunner190-translations-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", cpu:\"x86_64\", reference:\"mozilla-xulrunner190-32bit-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", cpu:\"x86_64\", reference:\"mozilla-xulrunner190-gnomevfs-32bit-1.9.0.12-1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", cpu:\"x86_64\", reference:\"mozilla-xulrunner190-translations-32bit-1.9.0.12-1.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MozillaFirefox\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-13T08:52:55", "bulletinFamily": "scanner", "description": "Updated firefox packages that fix several security issues are now\navailable for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having critical security impact by the\nRed Hat Security Response Team.\n\nMozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla\nsecurity advisories for Firefox 3.0.12. You can find a link to the\nMozilla advisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which\ncontain Firefox version 3.0.12, which corrects these issues. After\ninstalling the update, Firefox must be restarted for the changes to\ntake effect.", "modified": "2019-12-02T00:00:00", "id": "REDHAT-RHSA-2009-1162.NASL", "href": "https://www.tenable.com/plugins/nessus/40340", "published": "2009-07-22T00:00:00", "title": "RHEL 4 / 5 : firefox (RHSA-2009:1162)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2009:1162. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40340);\n script_version (\"1.29\");\n script_cvs_date(\"Date: 2019/10/25 13:36:14\");\n\n script_cve_id(\"CVE-2009-1194\", \"CVE-2009-2462\", \"CVE-2009-2463\", \"CVE-2009-2464\", \"CVE-2009-2465\", \"CVE-2009-2466\", \"CVE-2009-2467\", \"CVE-2009-2468\", \"CVE-2009-2469\", \"CVE-2009-2470\", \"CVE-2009-2471\", \"CVE-2009-2472\", \"CVE-2009-2664\");\n script_xref(name:\"RHSA\", value:\"2009:1162\");\n\n script_name(english:\"RHEL 4 / 5 : firefox (RHSA-2009:1162)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated firefox packages that fix several security issues are now\navailable for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having critical security impact by the\nRed Hat Security Response Team.\n\nMozilla Firefox is an open source Web browser. XULRunner provides the\nXUL Runtime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465,\nCVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed\nJavaScript code. A website containing malicious content could launch a\ncross-site scripting (XSS) attack or execute arbitrary JavaScript with\nthe permissions of another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla\nsecurity advisories for Firefox 3.0.12. You can find a link to the\nMozilla advisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which\ncontain Firefox version 3.0.12, which corrects these issues. After\ninstalling the update, Firefox must be restarted for the changes to\ntake effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2463\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2464\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2465\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2466\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2467\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2469\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2471\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2472\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2664\"\n );\n # http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d7d74da4\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2009:1162\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(20, 79, 189, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:xulrunner\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel-unstable\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4.8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/05/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x / 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2009:1162\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"firefox-3.0.12-1.el4\")) flag++;\n\n\n if (rpm_check(release:\"RHEL5\", reference:\"firefox-3.0.12-1.el5_3\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"xulrunner-1.9.0.12-1.el5_3\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"xulrunner-devel-1.9.0.12-1.el5_3\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"xulrunner-devel-unstable-1.9.0.12-1.el5_3\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"xulrunner-devel-unstable-1.9.0.12-1.el5_3\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"xulrunner-devel-unstable-1.9.0.12-1.el5_3\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"firefox / xulrunner / xulrunner-devel / xulrunner-devel-unstable\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2019-05-29T17:21:13", "bulletinFamily": "unix", "description": "Several flaws were discovered in the Firefox browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2469)\n\nAttila Suszter discovered a flaw in the way Firefox processed Flash content. If a user were tricked into viewing and navigating within a specially crafted Flash object, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-2467)\n\nIt was discovered that Firefox did not properly handle some SVG content. An attacker could exploit this to cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-2469)\n\nA flaw was discovered in the JavaScript engine. If a user were tricked into viewing a malicious website, an attacker could exploit this perform cross-site scripting attacks. (CVE-2009-2472)", "modified": "2009-07-22T00:00:00", "published": "2009-07-22T00:00:00", "id": "USN-798-1", "href": "https://usn.ubuntu.com/798-1/", "title": "Firefox and Xulrunner vulnerabilities", "type": "ubuntu", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2019-10-24T22:45:16", "bulletinFamily": "unix", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1840-1 security@debian.org\nhttp://www.debian.org/security/ Steffen Joeris\nJuly 23, 2009 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : xulrunner \nVulnerability : several vulnerabilities \nProblem type : remote \nDebian-specific: no \nCVE IDs : CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 CVE-2009-2465 \n CVE-2009-2466 CVE-2009-2467 CVE-2009-2469 CVE-2009-2471 \n CVE-2009-2472 \n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems: \n\nCVE-2009-2462\n\nMartijn Wargers, Arno Renevier, Jesse Ruderman, Olli Pettay and Blake\nKaplan disocvered several issues in the browser engine that could \npotentially lead to the execution of arbitrary code. (MFSA 2009-34) \n\nCVE-2009-2463\n\nmonarch2020 reported an integer overflow in a base64 decoding function.\n(MFSA 2009-34) \n\nCVE-2009-2464\n\nChristophe Charron reported a possibly exploitable crash occuring when \nmultiple RDF files were loaded in a XUL tree element. (MFSA 2009-34) \n\nCVE-2009-2465\n\nYongqian Li reported that an unsafe memory condition could be created by\nspecially crafted document. (MFSA 2009-34) \n\nCVE-2009-2466\n\nPeter Van der Beken, Mike Shaver, Jesse Ruderman, and Carsten Book\ndiscovered several issues in the JavaScript engine that could possibly\nlead to the execution of arbitrary JavaScript. (MFSA 2009-34)\n\nCVE-2009-2467\n\nAttila Suszter discovered an issue related to a specially crafted Flash\nobject, which could be used to run arbitrary code. (MFSA 2009-35)\n\nCVE-2009-2469\n\nPenPal discovered that it is possible to execute arbitrary code via a\nspecially crafted SVG element. (MFSA 2009-37)\n\nCVE-2009-2471\n\nBlake Kaplan discovered a flaw in the JavaScript engine that might allow\nan attacker to execute arbitrary JavaScript with chrome privileges.\n(MFSA 2009-39)\n\nCVE-2009-2472\n\nmoz_bug_r_a4 discovered an issue in the JavaScript engine that could be\nused to perform cross-site scripting attacks. (MFSA 2009-40)\n\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.9.0.12-0lenny1.\n\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.\n\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.12-1.\n\n\nWe recommend that you upgrade your xulrunner packages.\n\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nDebian (stable)\n- ---------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.12-0lenny1.dsc\n Size/MD5 checksum: 1784 2e69bafb336aca4645e1b2412480d646\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.12-0lenny1.diff.gz\n Size/MD5 checksum: 115977 272c3211139a5bc8b18589b13c2994ff\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner_1.9.0.12.orig.tar.gz\n Size/MD5 checksum: 43962222 60c12321966d292048b4540ef6484661\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozillainterfaces-java_1.9.0.12-0lenny1_all.deb\n Size/MD5 checksum: 1463680 bb282df0a8f54e0b9529ea17d6adb2f3\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 936648 2eb64e94b4cc213be6f6cfa8bfdc9a1c\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 9489172 d0634164e64df2a81116f0b28b83c9c8\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 3650294 22141e833d702cf88f156ee4db656f42\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 51074600 0fa0dabcddaa54a6254e8550c2a4afe0\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 221168 0e9d2c155e31532c784b656ed5388b9e\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 431058 8805ccf7e85238ce43dec92147619332\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 111666 80c24b0dfd1a158d34f78e6045b91ca4\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 163552 2e2962e508693791149682cae6cba482\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_alpha.deb\n Size/MD5 checksum: 71326 6a9373a92b1fc093e4b7c70069ff67b4\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 7716828 c16acd4ce667b6c084bdc39a9e096d11\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 222542 94d525cbb4d54889b70843822c0bdc38\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 3286630 dff8f78b0ec2d9960834da44667724eb\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 69238 f5399e5ceecf41c8eb4db5a072335740\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 50310982 867606879c209be1c13f3710d3c38ae6\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 101074 720e565c2e89dc6603532a7978b2d221\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 151576 d80252bbe931cbab101a89cb3f004a09\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 889814 211a7bc398826f2c56e15a843443d39d\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_amd64.deb\n Size/MD5 checksum: 373716 be621dfd49ae635ef4b4e114f8e50dba\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 50098330 a0f5465dbc467dd1f985e2ca4712f7f9\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 83980 4a4311a43473fe7930a52fdea5e4a5fe\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 6948554 cfdbcb830720627b32f795b36f53f5b7\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 222906 34e6471c847421be2ae16da3f918bcda\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 821816 e250ee372508798ae9e1a68a6c4576f2\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 3578140 f4707d6024a4b9f11ad1fd31882bf0ef\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 69028 0291acaec552e2472fc4209d168cfc6c\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 140978 773c60a149ba625ea1d5c89527d119c0\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_armel.deb\n Size/MD5 checksum: 352562 be66f00faa6afcede4278909e7f4e2a8\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 898622 5ea05f46dc2990b5b0054df8a30b1b58\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 411484 038614ad28aadfeae1abb5339b1251ab\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 158432 c676bfc26336590362ff680f85050906\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 3620828 3a43dc101337b981f9bd33906abe7799\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 105530 d200efc60ae614e57cead787ee85bef3\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 70610 2699e4fe85f2158ed608dbad8e20c38f\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 51198752 2386c56a0556e1f89dbcccdec8691031\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 9501658 0b6a0e1762a611b60912e721f7b9f9bb\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_hppa.deb\n Size/MD5 checksum: 222406 114b5a6f6fc97899e7935592646a5cbb\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 222776 e0f2916c9c3abd448aa46f7665191b49\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 78780 e73a6bfd378c752a8ac5fa7955fae17e\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 67468 18f29aaf6c08b34274f15a48c653707e\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 49480258 b14ed6c733c7d34d2021e806be6439d6\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 6593788 4b4aec6b9005655ba7b80035fa8e6e17\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 350290 e91ff2efb88c2f74fde18a008b56d6e2\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 140982 3c9adef8f1b9f6f25c84e36eefda9a1a\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 3564530 8402885a312d91bdcaffc7d4d65ac0b9\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_i386.deb\n Size/MD5 checksum: 851344 a4538a018fa23d8a53ebebee961849a9\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 179724 8761c9fbbc3f22d6a3a1126916c90bcc\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 542032 1b018fb59b737ac526625352b72d9b52\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 3396102 621e876f64da0046867a6904206fe88d\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 222738 cf7f9faab58a71b3593dbb50596d122c\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 49654530 7f19c4a0ac89e1516e2aba14ae8fc039\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 75710 bf66a6c1c04bb76fd5c8be3302264b5b\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 11291336 891f561351854e144105df6600e7b1a2\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 121190 60ace4c5b1e0de5c0a7276a20e6fa7ea\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_ia64.deb\n Size/MD5 checksum: 811128 d18f2c47908d2ac67175e3aaafaae9be\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 94436 ab06fbe3a24959ef89f46354799e4f60\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 51369574 2389d023864d099f4af1cd38c5dd0ab1\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 222760 0fca732c6d2cc0dbc10d9709db31446e\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 72382 1dbf9611e7482680ccb05387668b7aa8\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 3282416 144ced7b46ff76a25a1b6b4aa826cf52\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 151928 a2c697c4b815a9ec8ccbfa92e46437df\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 887838 2c32e037063218fa7ad957f318bf67d0\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 7269728 cd871cea39393f4e585c7462b7bd7f85\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_powerpc.deb\n Size/MD5 checksum: 361952 73feff1baa6ac1817c37e9e47be19693\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 908910 9ad7f202181aa2aea2e0e5bcf7e7d3a0\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 222738 500490bcdc39f3bf9df8c8adc201af3b\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 3305062 cf82ab8dedc7b2c02102b1923bc2b990\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 51146652 8d73626705e11a5f55617b5fe945a694\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 406172 03dbc242b93c05c30fac54f5845a1a26\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 72194 859204b8be6d3be3f1e5a44d66894d25\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 155732 72eff38ad9f4336aee6999895b9dc2f8\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 8379856 936c6c5f0803bdd9bf4e25389263026d\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_s390.deb\n Size/MD5 checksum: 105222 89354aa048d424d0657e03a3cb99efe0\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/x/xulrunner/spidermonkey-bin_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 68560 be1d93cebaecfded59be656d1c4be947\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 7162094 f8297c20997d2b907bdff9fed1bd17e7\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-gnome-support_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 87220 6e6e140211cab257b855337f78090ed8\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d-dbg_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 821376 3d1f31c492ad4e0d2ff96be8004f8620\n http://security.debian.org/pool/updates/main/x/xulrunner/python-xpcom_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 141574 340b55f67ab110b9dfd8201627856b96\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-dev_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 3576272 c71288e6db975032807788800118883a\n http://security.debian.org/pool/updates/main/x/xulrunner/xulrunner-1.9-dbg_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 49334420 1983e56c55e840fdb7c140aa30ad4c09\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs-dev_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 221490 fdd4e1383544a7c463f2dac1e916303c\n http://security.debian.org/pool/updates/main/x/xulrunner/libmozjs1d_1.9.0.12-0lenny1_sparc.deb\n Size/MD5 checksum: 349248 1cb6c52c91701e3b11c0faa92da6d915\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n", "modified": "2009-07-23T10:30:49", "published": "2009-07-23T10:30:49", "id": "DEBIAN:DSA-1840-1:5A2AB", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2009/msg00155.html", "title": "[SECURITY] [DSA 1840-1] New xulrunner packages fix several vulnerabilities", "type": "debian", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:33", "bulletinFamily": "software", "description": "Multiple memory corruptions, crossite access, integer overflows, buffer overflows.", "modified": "2009-07-22T00:00:00", "published": "2009-07-22T00:00:00", "id": "SECURITYVULNS:VULN:10089", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:10089", "title": "Multiple Mozilla Firefox security vulnerabilities", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2019-12-11T13:32:38", "bulletinFamily": "unix", "description": "Mozilla Firefox is an open source Web browser. XULRunner provides the XUL\nRuntime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,\nCVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed JavaScript\ncode. A website containing malicious content could launch a cross-site\nscripting (XSS) attack or execute arbitrary JavaScript with the permissions\nof another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla security\nadvisories for Firefox 3.0.12. You can find a link to the Mozilla\nadvisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which contain\nFirefox version 3.0.12, which corrects these issues. After installing the\nupdate, Firefox must be restarted for the changes to take effect.", "modified": "2017-09-08T12:16:20", "published": "2009-07-21T04:00:00", "id": "RHSA-2009:1162", "href": "https://access.redhat.com/errata/RHSA-2009:1162", "type": "redhat", "title": "(RHSA-2009:1162) Critical: firefox security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2019-12-11T18:23:29", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2009:1162\n\n\nMozilla Firefox is an open source Web browser. XULRunner provides the XUL\nRuntime environment for Mozilla Firefox.\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox to crash or,\npotentially, execute arbitrary code as the user running Firefox.\n(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,\nCVE-2009-2467, CVE-2009-2469, CVE-2009-2471)\n\nSeveral flaws were found in the way Firefox handles malformed JavaScript\ncode. A website containing malicious content could launch a cross-site\nscripting (XSS) attack or execute arbitrary JavaScript with the permissions\nof another website. (CVE-2009-2472)\n\nFor technical details regarding these flaws, refer to the Mozilla security\nadvisories for Firefox 3.0.12. You can find a link to the Mozilla\nadvisories in the References section of this errata.\n\nAll Firefox users should upgrade to these updated packages, which contain\nFirefox version 3.0.12, which corrects these issues. After installing the\nupdate, Firefox must be restarted for the changes to take effect.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2009-July/016046.html\nhttp://lists.centos.org/pipermail/centos-announce/2009-July/016047.html\n\n**Affected packages:**\nfirefox\nxulrunner\nxulrunner-devel\nxulrunner-devel-unstable\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2009-1162.html", "modified": "2009-07-28T13:22:38", "published": "2009-07-28T13:22:37", "href": "http://lists.centos.org/pipermail/centos-announce/2009-July/016046.html", "id": "CESA-2009:1162", "title": "firefox, xulrunner security update", "type": "centos", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:38:35", "bulletinFamily": "unix", "description": "firefox:\n[3.0.12-1.0.1.el5_3]\n- Update firstrun and homepage URLs\n- Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html\n and removed the corresponding Red Hat ones\n- Added patch oracle-firefox-branding.patch\n[3.0.12-1]\n- Update to 3.0.12\nxulrunner:\n[1.9.0.12-1.0.1.el5_3]\n- Added xulrunner-oracle-default-prefs.js\n- Removed RedHat corresponding one\n[1.9.0.12-1]\n- Update to 1.9.0.12 ", "modified": "2009-07-22T00:00:00", "published": "2009-07-22T00:00:00", "id": "ELSA-2009-1162", "href": "http://linux.oracle.com/errata/ELSA-2009-1162.html", "title": "firefox security update", "type": "oraclelinux", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "seebug": [{"lastseen": "2017-11-19T18:54:24", "bulletinFamily": "exploit", "description": "Bugraq ID: 35758\r\nCVE ID\uff1aCVE-2009-1194\r\nCVE-2009-2462\r\nCVE-2009-2463\r\nCVE-2009-2464\r\nCVE-2009-2465\r\nCVE-2009-2466\r\nCVE-2009-2467\r\nCVE-2009-2468\r\nCVE-2009-2469\r\nCVE-2009-2471\r\nCVE-2009-2472\r\nCNCVE ID\uff1aCNCVE-20091194\r\nCNCVE-20092462\r\nCNCVE-20092463\r\nCNCVE-20092464\r\nCNCVE-20092465\r\nCNCVE-20092466\r\nCNCVE-20092467\r\nCNCVE-20092468\r\nCNCVE-20092469\r\nCNCVE-20092471\r\nCNCVE-20092472\r\n\r\nMozilla Firefox\u662f\u4e00\u6b3e\u5f00\u653e\u6e90\u4ee3\u7801\u7684WEB\u6d4f\u89c8\u5668\u3002\r\nMozilla Firefox\u5b58\u5728\u591a\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u6216\u53ef\u80fd\u4ee5\u5e94\u7528\u7a0b\u5e8f\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n-Firefox\u548c\u591a\u4e2aMozilla\u4ea7\u54c1\u4f7f\u7528\u7684\u6d4f\u89c8\u5668\u5f15\u64ce\u5b58\u5728\u591a\u4e2a\u5185\u5b58\u7834\u574f\u95ee\u9898\uff0c\u53ef\u80fd\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\r\n-Firefox\u5728Flash\u64ad\u653e\u5668\u5378\u8f7d\u65f6\u4f1a\u7531\u4e8e\u8c03\u7528\u5220\u9664\u7684\u5bf9\u8c61\u800c\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u53ef\u80fd\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\r\n-Firefox\u5904\u7406\u5b57\u4f53glyph\u6e32\u67d3\u5e93\u5b58\u5728\u5806\u548c\u6574\u6570\u6ea2\u51fa\uff0c\u901a\u8fc7\u6784\u5efa\u8d85\u5927\u7684\u6587\u672c\u5728\u6d4f\u89c8\u5668\u4e0a\u663e\u793a\u53ef\u89e6\u53d1\u8fd9\u4e9b\u6ea2\u51fa\u3002\r\n-\u5728\u5df2\u7ecf\u8bbe\u7f6e\u4e86\u90e8\u5206\u5c5e\u6027\u7684watch\u548c__defineSetter__\u51fd\u6570\u4e0a\u5904\u7406SVG\u5143\u7d20\u5b58\u5728\u9519\u8bef\uff0c\u53ef\u5bfc\u81f4\u89e6\u53d1\u5185\u5b58\u7834\u574f\uff0c\u53ef\u80fd\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\r\n-\u5f53\u4f7f\u7528\u90e8\u5206\u5bf9\u8c61\u53c2\u6570\u8c03\u7528setTimeout()\u65f6\u5b58\u5728\u9519\u8bef\uff0c\u53ef\u5bfc\u81f4\u5bf9\u8c61\u5c01\u88c5\u51fa\u9519\uff0c\u53ef\u80fd\u4ee5chrome\u7279\u6743\u6267\u884c\u4efb\u610fJavaScript\u4ee3\u7801\u3002\r\n-\u5904\u7406\u5bf9\u8c61\u5c01\u88c5\u5b58\u5728\u5404\u79cd\u9519\u8bef\uff0c\u5229\u7528\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u53ef\u4ee5\u8bbf\u95ee\u7531\u4e0d\u540c\u7ad9\u70b9\u8bbe\u7f6e\u7684\u5bf9\u8c61\u5c5e\u6027\u3002\r\n-\u5904\u7406\u4e24\u6b21\u5e27\u6784\u5efa\u5b58\u5728\u5185\u5b58\u9519\u8bef\uff0c\u53ef\u80fd\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\r\n-\u6587\u6863(document)\u6784\u67b6\u5b58\u5728\u9519\u8bef\uff0c\u53ef\u5bfc\u81f4\u6b64\u6587\u6863\u4e2d\u90e8\u5206\u5143\u7d20\u4e24\u6b21\u62f7\u8d1d\u3002\r\n-BASE64\u89e3\u7801\u51fd\u6570\u5b58\u5728\u6574\u6570\u6ea2\u51fa\u9519\u8bef\uff0c\u53ef\u5bfc\u81f4\u5185\u5b58\u7834\u574f\u4ee5\u5e94\u7528\u7a0b\u5e8f\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n-\u5904\u7406XUL\u6811\u5143\u7d20\u4e2d\u7684\u591a\u4e2aRDF\u6587\u4ef6\u5b58\u5728\u9519\u8bef\uff0c\u53ef\u5bfc\u81f4\u5185\u5b58\u7834\u574f\u4ee5\u5e94\u7528\u7a0b\u5e8f\u6743\u9650\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\n\nMozilla Firefox 3.5\r\nMozilla Firefox 3.0.11\r\nMozilla Firefox 3.0.10\r\nMozilla Firefox 3.0.9\r\nMozilla Firefox 3.0.8\r\nMozilla Firefox 3.0.7 Beta\r\nMozilla Firefox 3.0.7\r\nMozilla Firefox 3.0.6\r\nMozilla Firefox 3.0.5\r\nMozilla Firefox 3.0.4\r\nMozilla Firefox 3.0.3\r\nMozilla Firefox 3.0.2\r\nMozilla Firefox 3.0.1\r\nMozilla Firefox 3.0 Beta 5\r\nMozilla Firefox 3.0\n\u76ee\u524d\u6ca1\u6709\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a\r\nhttp://www.americasarmy.com/", "modified": "2009-07-24T00:00:00", "published": "2009-07-24T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-11869", "id": "SSV:11869", "title": "Mozilla Firefox MFSA\u5b58\u5728\u591a\u4e2a\u5b89\u5168\u6f0f\u6d1e", "type": "seebug", "sourceData": "", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": ""}], "suse": [{"lastseen": "2016-09-04T12:29:07", "bulletinFamily": "unix", "description": "The Mozilla Firefox Browser in SUSE Linux Enterprise 10 Service Pack 2 was brought from the old 2.0.0.x release branch to the current 3.0.12 release of the Firefox 3.0 release branch.\n#### Solution\nThere is no known workaround, please install the update packages.", "modified": "2009-08-06T11:30:16", "published": "2009-08-06T11:30:16", "href": "http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html", "id": "SUSE-SA:2009:042", "title": "remote code execution in MozillaFirefox", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:08:03", "bulletinFamily": "unix", "description": "The MozillaFirefox 3.0.12 release fixes various bugs and some critical security issues.\n#### Solution\nThere is no known workaround, please install the update packages.", "modified": "2009-07-27T13:06:57", "published": "2009-07-27T13:06:57", "id": "SUSE-SA:2009:039", "href": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html", "type": "suse", "title": "remote code execution in MozillaFirefox", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:13", "bulletinFamily": "unix", "description": "### Background\n\nMozilla Firefox is an open-source web browser and Mozilla Thunderbird an open-source email client, both from the Mozilla Project. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the \u2018Mozilla Application Suite\u2019. XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XPCOM applications such as Firefox and Thunderbird. NSS is Mozilla\u2019s Network Security Services library that implements PKI support. IceCat is the GNU version of Firefox. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL\u2019s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser\u2019s font, conduct clickjacking attacks, or have other unspecified impact. \n\nA local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Mozilla Firefox users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-10.0.11\"\n \n\nAll users of the Mozilla Firefox binary package should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/firefox-bin-10.0.11\"\n \n\nAll Mozilla Thunderbird users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=mail-client/thunderbird-10.0.11\"\n \n\nAll users of the Mozilla Thunderbird binary package should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=mail-client/thunderbird-bin-10.0.11\"\n \n\nAll Mozilla SeaMonkey users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/seamonkey-2.14-r1\"\n \n\nAll users of the Mozilla SeaMonkey binary package should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-client/seamonkey-bin-2.14\"\n \n\nAll NSS users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-libs/nss-3.14\"\n \n\nThe \u201cwww-client/mozilla-firefox\u201d package has been merged into the \u201cwww-client/firefox\u201d package. To upgrade, please unmerge \u201cwww-client/mozilla-firefox\u201d and then emerge the latest \u201cwww-client/firefox\u201d package: \n \n \n # emerge --sync\n # emerge --unmerge \"www-client/mozilla-firefox\"\n # emerge --ask --oneshot --verbose \">=www-client/firefox-10.0.11\"\n \n\nThe \u201cwww-client/mozilla-firefox-bin\u201d package has been merged into the \u201cwww-client/firefox-bin\u201d package. To upgrade, please unmerge \u201cwww-client/mozilla-firefox-bin\u201d and then emerge the latest \u201cwww-client/firefox-bin\u201d package: \n \n \n # emerge --sync\n # emerge --unmerge \"www-client/mozilla-firefox-bin\"\n # emerge --ask --oneshot --verbose \">=www-client/firefox-bin-10.0.11\"\n \n\nThe \u201cmail-client/mozilla-thunderbird\u201d package has been merged into the \u201cmail-client/thunderbird\u201d package. To upgrade, please unmerge \u201cmail-client/mozilla-thunderbird\u201d and then emerge the latest \u201cmail-client/thunderbird\u201d package: \n \n \n # emerge --sync\n # emerge --unmerge \"mail-client/mozilla-thunderbird\"\n # emerge --ask --oneshot --verbose \">=mail-client/thunderbird-10.0.11\"\n \n\nThe \u201cmail-client/mozilla-thunderbird-bin\u201d package has been merged into the \u201cmail-client/thunderbird-bin\u201d package. To upgrade, please unmerge \u201cmail-client/mozilla-thunderbird-bin\u201d and then emerge the latest \u201cmail-client/thunderbird-bin\u201d package: \n \n \n # emerge --sync\n # emerge --unmerge \"mail-client/mozilla-thunderbird-bin\"\n # emerge --ask --oneshot --verbose\n \">=mail-client/thunderbird-bin-10.0.11\"\n \n\nGentoo discontinued support for GNU IceCat. We recommend that users unmerge GNU IceCat: \n \n \n # emerge --unmerge \"www-client/icecat\"\n \n\nGentoo discontinued support for XULRunner. We recommend that users unmerge XULRunner: \n \n \n # emerge --unmerge \"net-libs/xulrunner\"\n \n\nGentoo discontinued support for the XULRunner binary package. We recommend that users unmerge XULRunner: \n \n \n # emerge --unmerge \"net-libs/xulrunner-bin\"", "modified": "2013-01-08T00:00:00", "published": "2013-01-08T00:00:00", "id": "GLSA-201301-01", "href": "https://security.gentoo.org/glsa/201301-01", "type": "gentoo", "title": "Mozilla Products: Multiple vulnerabilities", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}