This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.
The remote openSUSE host is missing a security update.
MozillaFirefox was updated to the 3.0.13 release, fixing some security
issues and bugs :
MFSA 2009-44 / CVE-2009-2654: Security researcher Juan Pablo Lopez
Yacubian reported that an attacker could call window.open() on an
invalid URL which looks similar to a legitimate URL and then use
document.write() to place content within the new document, appearing
to have come from the spoofed location. Additionally, if the spoofed
document was created by a document with a valid SSL certificate, the
SSL indicators would be carried over into the spoofed document. An
attacker could use these issues to display misleading location and SSL
information for a malicious web page.
MFSA 2009-45 / CVE-2009-2662:The browser engine in Mozilla Firefox
before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to
cause a denial of service (memory corruption and application crash) or
possibly execute arbitrary code via vectors related to the
TraceRecorder::snapshot function in js/src/jstracer.cpp, and
unspecified other vectors.
CVE-2009-2663 / MFSA 2009-45: libvorbis before r16182, as used in
Mozilla Firefox before 3.0.13 and 3.5.x before 3.5.2 and other
products, allows context-dependent attackers to cause a denial of
service (memory corruption and application crash) or possibly execute
arbitrary code via a crafted .ogg file.
CVE-2009-2664 / MFSA 2009-45: The js_watch_set function in
3.0.13, and 3.5.x before 3.5.2, allows remote attackers to cause a
denial of service (assertion failure and application exit) or possibly
execute arbitrary code via a crafted .js file, related to a 'memory
See also :
Update the affected MozillaFirefox packages.
Risk factor :
Critical / CVSS Base Score : 10.0