The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-552:05 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    Security issues fixed with this release:
     CVE-2013-1682     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR     17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote     attackers to cause a denial of service (memory corruption and application crash) or possibly execute     arbitrary code via unknown vectors.
     CVE-2013-1684     Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in     Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird     ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via a crafted web site.
     CVE-2013-1685     Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0,     Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows     remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a     crafted web site.
     CVE-2013-1686     Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR     17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote     attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified     vectors.
     CVE-2013-1687     The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before     22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do     not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary     JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web     site.
     CVE-2013-1690     Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird     ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page     reloading, which allows remote attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped     memory location.
     CVE-2013-1692     Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird     ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which     makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted     web site.
     CVE-2013-1693     The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird     before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and     possibly bypass the Same Origin Policy and read text from a different domain, by observing timing     differences in execution of filter code.
     CVE-2013-1694     The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7,     Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a     wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly     execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
     CVE-2013-1697     The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird     before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for     method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges     via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MiracleLinux 3 : firefox-17.0.7-1.0.1.AXS3, xulrunner-17.0.7-1.0.1.AXS3 (AXSA:2013-552:05)

high Nessus Plugin ID 289366

Version 1.2