This script is Copyright (C) 2012-2017 Tenable Network Security, Inc.
The remote Windows host contains a web browser that is affected by
The installed version of Firefox is earlier than 12.0 and thus, is
potentially affected by the following security issues :
could lead to information disclosure. (CVE-2011-1187)
- An off-by-one error exists in the 'OpenType Sanitizer'
that could lead to out-bounds-reads and possible code
- Memory safety issues exist that could lead
to arbitrary code execution. (CVE-2012-0467,
- A use-after-free error exists related to 'IDBKeyRange'
of 'indexedDB'. (CVE-2012-0469)
- Heap-corruption errors exist related to
'gfxImageSurface' that could lead to possible code
- A multi-octet encoding issue exists that could allow
cross-site scripting attacks as certain octets in
multibyte character sets can destroy following octets.
- An error exists related to font rendering with 'cairo-
dwrite' that could cause memory corruption leading to
crashes and potentially code execution. (CVE-2012-0472)
- An error exists in 'WebGLBuffer' that could lead to the
reading of illegal video memory. (CVE-2012-0473)
- An unspecified error could allow URL bar spoofing.
- IPv6 addresses and cross-site 'XHR' or 'WebSocket'
connections on non-standard ports could allow this
application to send ambiguous origin headers.
- A decoding issue exists related to 'ISO-2022-KR' and
'ISO-2022-CN' character sets that could lead to cross-
site scripting attacks. (CVE-2012-0477)
- An error exists related to 'WebGL' and 'texImage2D'
that could allow application crashes and possibly code
execution when 'JSVAL_TO_OBJECT' is used on ordinary
- Address bar spoofing is possible when 'Atom XML' or
'RSS' data is loaded over HTTPS leading to phishing
See also :
Upgrade to Firefox 12.0 or later.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 7.3
Public Exploit Available : true
Nessus Plugin ID: 58898 ()
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now