The installed version of Firefox is earlier than 15.0 and thus, is potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty'     and the location object that could allow cross-site     scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,     CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to 'about:newtab' and the     browser's history. This error can allow a newly opened     tab to further open a new window and navigate to the     privileged 'about:newtab' page leading to possible     privilege escalation. (CVE-2012-3965)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists.
    (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - Remote debugging is possible even when disabled and the     'HTTPMonitor' extension is enabled. (CVE-2012-3973)

  - The DOM parser can unintentionally load linked     resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - Calling 'eval' in the web console can allow injected     code to be executed with browser chrome privileges.
    (CVE-2012-3980)

  - SPDY's request header compression leads to information     leakage, which can allow private data such as session     cookies to be extracted, even over an SSL connection.
    (CVE-2012-4930)

Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1970, CVE-2012-1971)

Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

Mariusz Mlynsk discovered that it is possible to shadow the location object using Object.defineProperty. This could potentially result in a cross-site scripting (XSS) attack against plugins. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents or steal confidential data within the same domain.
(CVE-2012-1956)

Mariusz Mlynski discovered an escalation of privilege vulnerability through about:newtab. This could possibly lead to potentially code execution with the privileges of the user invoking Firefox.
(CVE-2012-3965)

Frederic Hoguin discovered that bitmap format images with a negative height could potentially result in memory corruption. If the user were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3966)

It was discovered that Firefox's WebGL implementation was vulnerable to multiple memory safety issues. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-3967, CVE-2012-3968)

Arthur Gerkis discovered multiple memory safety issues in Firefox's Scalable Vector Graphics (SVG) implementation. If the user were tricked into opening a specially crafted image, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3969, CVE-2012-3970)

Christoph Diehl discovered multiple memory safety issues in the bundled Graphite 2 library. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-3971)

Nicolas Gregoire discovered an out-of-bounds read in the format-number feature of XSLT. This could potentially cause inaccurate formatting of numbers and information leakage. (CVE-2012-3972)

Mark Goodwin discovered that under certain circumstances, Firefox's developer tools could allow remote debugging even when disabled.
(CVE-2012-3973)

It was discovered that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and potentially be combined with other attacks to become exploitable. (CVE-2012-3975)

Mark Poticha discovered that under certain circumstances incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This could potentially be used for phishing attacks. (CVE-2012-3976)

It was discovered that, in some instances, certain security checks in the location object could be bypassed. This could allow for the loading of restricted content and can potentially be combined with other issues to become exploitable. (CVE-2012-3978)

Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-3980).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security issues were identified and fixed in mozilla thunderbird :

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1971).

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products (CVE-2012-1970).

Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution (CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976, CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964).

Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks (CVE-2012-1956).

Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative height header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable (CVE-2012-3966).

Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash (CVE-2012-3968, CVE-2012-3967).

Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko's SVG filter code when the sum of two values is too large to be stored as a signed 32-bit integer, causing the function to write past the end of an array. The second issue is a use-after-free when an element with a requiredFeatures attribute is moved between documents. In that situation, the internal representation of the requiredFeatures value could be freed prematurely. Both issues are potentially exploitable (CVE-2012-3969, CVE-2012-3970).

Using the Address Sanitizer tool, Mozilla security researcher Christoph Diehl discovered two memory corruption issues involving the Graphite 2 library used in Mozilla products. Both of these issues can cause a potentially exploitable crash. These problems were fixed in the Graphite 2 library, which has been updated for Mozilla products (CVE-2012-3971).

Security research Nicolas Gregoire used the Address Sanitizer tool to discover an out-of-bounds read in the format-number feature of XSLT, which can cause inaccurate formatting of numbers and information leakage. This is not directly exploitable (CVE-2012-3972).

Security researcher Masato Kinugawa reported that if a crafted executable is placed in the root partition on a Windows file system, the Firefox and Thunderbird installer will launch this program after a standard installation instead of Firefox or Thunderbird, running this program with the user's privileges (CVE-2012-3974).

Security researcher vsemozhetbyt reported that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and can potentially be combined with other attacks to become exploitable (CVE-2012-3975).

Mozilla security researcher moz_bug_r_a4 reported that certain security checks in the location object can be bypassed if chrome code is called content in a specific manner. This allowed for the loading of restricted content. This can be combined with other issues to become potentially exploitable (CVE-2012-3978).

Security researcher Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. This allows for arbitrary code execution through a malicious web page if the web console is invoked by the user (CVE-2012-3980).

The mozilla thunderbird packages has been upgraded to the latest version which is unaffected by these security flaws.

Updated firefox packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3982, CVE-2012-3988, CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188)

Two flaws in Firefox could allow a malicious website to bypass intended restrictions, possibly leading to information disclosure, or Firefox executing arbitrary code. Note that the information disclosure issue could possibly be combined with other flaws to achieve arbitrary code execution. (CVE-2012-3986, CVE-2012-3991)

Multiple flaws were found in the location object implementation in Firefox. Malicious content could be used to perform cross-site scripting attacks, script injection, or spoofing attacks.
(CVE-2012-1956, CVE-2012-3992, CVE-2012-3994)

Two flaws were found in the way Chrome Object Wrappers were implemented. Malicious content could be used to perform cross-site scripting attacks or cause Firefox to execute arbitrary code.
(CVE-2012-3993, CVE-2012-4184)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.8 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Jesse Ruderman, Soroush Dalili, miaubiz, Abhishek Arya, Atte Kettunen, Johnny Stenback, Alice White, moz_bug_r_a4, and Mariusz Mlynski as the original reporters of these issues.

This update also fixes the following bug :

* In certain environments, storing personal Firefox configuration files (~/.mozilla/) on an NFS share, such as when your home directory is on a NFS share, led to Firefox functioning incorrectly, for example, navigation buttons not working as expected, and bookmarks not saving. This update adds a new configuration option, storage.nfs_filesystem, that can be used to resolve this issue.

If you experience this issue :

1) Start Firefox.

2) Type 'about:config' (without quotes) into the URL bar and press the Enter key.

3) If prompted with 'This might void your warranty!', click the 'I'll be careful, I promise!' button.

4) Right-click in the Preference Name list. In the menu that opens, select New -> Boolean.

5) Type 'storage.nfs_filesystem' (without quotes) for the preference name and then click the OK button.

6) Select 'true' for the boolean value and then press the OK button.
(BZ#809571, BZ#816234)

All Firefox users should upgrade to these updated packages, which contain Firefox version 10.0.8 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:1351 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Several flaws were found in the processing of malformed content. Malicious     content could cause Thunderbird to crash or, potentially, execute arbitrary     code with the privileges of the user running Thunderbird. (CVE-2012-3982,     CVE-2012-3988, CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180,     CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186,     CVE-2012-4187, CVE-2012-4188)

    Two flaws in Thunderbird could allow malicious content to bypass intended     restrictions, possibly leading to information disclosure, or Thunderbird     executing arbitrary code. Note that the information disclosure issue could     possibly be combined with other flaws to achieve arbitrary code execution.
    (CVE-2012-3986, CVE-2012-3991)

    Multiple flaws were found in the location object implementation in     Thunderbird. Malicious content could be used to perform cross-site     scripting attacks, script injection, or spoofing attacks. (CVE-2012-1956,     CVE-2012-3992, CVE-2012-3994)

    Two flaws were found in the way Chrome Object Wrappers were implemented.
    Malicious content could be used to perform cross-site scripting attacks or     cause Thunderbird to execute arbitrary code. (CVE-2012-3993, CVE-2012-4184)

    Red Hat would like to thank the Mozilla project for reporting these issues.
    Upstream acknowledges Christian Holler, Jesse Ruderman, Soroush Dalili,     miaubiz, Abhishek Arya, Atte Kettunen, Johnny Stenback, Alice White,     moz_bug_r_a4, and Mariusz Mlynski as the original reporters of these     issues.

    Note: None of the issues in this advisory can be exploited by a     specially-crafted HTML mail message as JavaScript is disabled by default     for mail messages. They could be exploited another way in Thunderbird, for     example, when viewing the full remote content of an RSS feed.

    All Thunderbird users should upgrade to this updated package, which     contains Thunderbird version 10.0.8 ESR, which corrects these issues. After     installing the update, Thunderbird must be restarted for the changes to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-3982, CVE-2012-3988, CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188)

Two flaws in Firefox could allow a malicious website to bypass intended restrictions, possibly leading to information disclosure, or Firefox executing arbitrary code. Note that the information disclosure issue could possibly be combined with other flaws to achieve arbitrary code execution. (CVE-2012-3986, CVE-2012-3991)

Multiple flaws were found in the location object implementation in Firefox. Malicious content could be used to perform cross-site scripting attacks, script injection, or spoofing attacks.
(CVE-2012-1956, CVE-2012-3992, CVE-2012-3994)

Two flaws were found in the way Chrome Object Wrappers were implemented. Malicious content could be used to perform cross-site scripting attacks or cause Firefox to execute arbitrary code.
(CVE-2012-3993, CVE-2012-4184)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 10.0.8 ESR.

This update also fixes the following bug :

  - In certain environments, storing personal Firefox     configuration files (~/.mozilla/) on an NFS share, such     as when your home directory is on a NFS share, led to     Firefox functioning incorrectly, for example, navigation     buttons not working as expected, and bookmarks not     saving. This update adds a new configuration option,     storage.nfs_filesystem, that can be used to resolve this     issue.

If you experience this issue :

1) Start Firefox.

2) Type 'about:config' (without quotes) into the URL bar and press the Enter key.

3) If prompted with 'This might void your warranty!', click the 'I'll be careful, I promise!' button.

4) Right-click in the Preference Name list. In the menu that opens, select New -> Boolean.

5) Type 'storage.nfs_filesystem' (without quotes) for the preference name and then click the OK button.

6) Select 'true' for the boolean value and then press the OK button.

After installing the update, Firefox must be restarted for the changes to take effect.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-1013:06 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XPCOM applications that are as     rich as Firefox and Thunderbird. It provides mechanisms for installing, upgrading, and uninstalling these     applications. XULRunner also provides libxul, a solution which allows the embedding of Mozilla     technologies in other projects and products.
    Security issues fixed with this release:
     CVE-2012-1956     Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the     Object.defineProperty method to shadow the location object (aka window.location), which makes it easier     for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.
     CVE-2012-1970     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR     10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12     allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
     CVE-2012-1972     Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7,     and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via unspecified vectors.
     CVE-2012-1973     Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before     15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-1974     Use-after-free vulnerability in the gfxTextRun::CanBreakLineBefore function in Mozilla Firefox before     15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-1975     Use-after-free vulnerability in the PresShell::CompleteMove function in Mozilla Firefox before 15.0,     Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey     before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via unspecified vectors.
     CVE-2012-1976     Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7,     and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via unspecified vectors.
     CVE-2012-3956     Use-after-free vulnerability in the MediaStreamGraphThreadRunnable::Run function in Mozilla Firefox before     15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-3957     Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0,     Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey     before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
     CVE-2012-3958     Use-after-free vulnerability in the nsHTMLEditRules::DeleteNonTableElements function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7,     and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via unspecified vectors.
     CVE-2012-3959     Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before     15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and     SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-3960     Use-after-free vulnerability in the mozSpellChecker::SetCurrentDictionary function in Mozilla Firefox     before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7,     and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via unspecified vectors.
     CVE-2012-3961     Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR     10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12     allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption)     via unspecified vectors.
     CVE-2012-3962     Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 do not properly iterate through the characters in a text run,     which allows remote attackers to execute arbitrary code via a crafted document.
     CVE-2012-3963     Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0,     Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey     before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
     CVE-2012-3964     Use-after-free vulnerability in the gfxTextRun::GetUserData function in Mozilla Firefox before 15.0,     Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey     before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via unspecified vectors.
     CVE-2012-3966     Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x     before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a     denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file,     related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2)     improper processing of the alpha channel by the nsBMPDecoder component.
     CVE-2012-3967     The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird     before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number     of sampler uniforms are used, does not properly interact with Mesa drivers, which allows remote attackers     to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted web site.
     CVE-2012-3968     Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x     before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12     allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by     its accessor.
     CVE-2012-3969     Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox     ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before     2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect     sum calculation, leading to a heap-based buffer overflow.
     CVE-2012-3970     Use-after-free vulnerability in the nsTArray_base::Length function in Mozilla Firefox before 15.0, Firefox     ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before     2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via vectors involving movement of a requiredFeatures attribute from one SVG document to     another.
     CVE-2012-3972     The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR     10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12     allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based     buffer over-read.
     CVE-2012-3976     Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly     handle onLocationChange events during navigation between different https sites, which allows remote     attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
     CVE-2012-3978     The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7,     Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly     follow the security model of the location object, which allows remote attackers to bypass intended     content-loading restrictions or possibly have unspecified other impact via vectors involving chrome code.
     CVE-2012-3980     The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0,     and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary     JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval     operation.
     CVE-2012-3982     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR     10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13     allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
     CVE-2012-3986     Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x     before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka     nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via     crafted JavaScript code.
     CVE-2012-3988     Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird     before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted     remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter     full-screen mode, and use of the history.back method for backwards history navigation.
     CVE-2012-3990     Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0,     Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey     before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the     nsIContent::GetNameSpaceID function.
     CVE-2012-3991     Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x     before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty     function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified     other impact via a crafted web site.
     CVE-2012-3992     Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x     before 10.0.8, and SeaMonkey before 2.13 do not properly manage history data, which allows remote     attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive POST content via vectors     involving a location.hash write operation and history navigation that triggers the loading of a URL into     the history object.
     CVE-2012-3993     The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before     10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not     properly interact with failures of InstallTrigger methods, which allows remote attackers to execute     arbitrary JavaScript code with chrome privileges via a crafted web site, related to an XrayWrapper     pollution issue.
     CVE-2012-3994     Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x     before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS)     attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the     relationship between top.location and the location property.
     CVE-2012-3995     The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8,     Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote     attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified     vectors.
     CVE-2012-4179     Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox     before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8,     and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service     (heap memory corruption) via unspecified vectors.
     CVE-2012-4180     Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox     before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8,     and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
     CVE-2012-4181     Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before     16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and     SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-4182     Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0,     Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey     before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via unspecified vectors.
     CVE-2012-4183     Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before     16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and     SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap     memory corruption) via unspecified vectors.
     CVE-2012-4184     The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before     10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not     prevent access to properties of a prototype for a standard class, which allows remote attackers to execute     arbitrary JavaScript code with chrome privileges via a crafted web site.
     CVE-2012-4185     Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x     before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13     allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption)     via unspecified vectors.
     CVE-2012-4186     Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0,     Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey     before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
     CVE-2012-4187     Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x     before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable, which allows     remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and     assertion failure) via unspecified vectors.
     CVE-2012-4188     Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x     before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13     allows remote attackers to execute arbitrary code via unspecified vectors.
     CVE-2012-4193     Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR     10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during     the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and     read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site.
     CVE-2012-4194     Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR     10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the     location object (aka window.location), which makes it easier for remote attackers to conduct cross-site     scripting (XSS) attacks via vectors involving a plugin.
     CVE-2012-4195     The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10,     Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not     properly determine the calling document and principal in its return value, which makes it easier for     remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier     for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.
     CVE-2012-4196     Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR     10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy     and read the Location object via a prototype property-injection attack that defeats certain protection     mechanisms for this object.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of SeaMonkey is earlier than 2.12.0. Such versions are potentially affected by the following security issues :

  - An error exists related to 'Object.defineProperty'     and the location object that could allow cross-site     scripting attacks. (CVE-2012-1956)

  - Unspecified memory safety issues exist. (CVE-2012-1970,     CVE-2012-1971)

  - Multiple use-after-free errors exist. (CVE-2012-1972,     CVE-2012-1973, CVE-2012-1974, CVE-2012-1975,     CVE-2012-1976, CVE-2012-3956, CVE-2012-3957,     CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,     CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,     CVE-2012-3964)

  - An error exists related to bitmap (BMP) and icon (ICO)     file decoding that can lead to memory corruption,     causing application crashes and potentially arbitrary     code execution. (CVE-2012-3966)

  - A use-after-free error exists related to WebGL shaders.
    (CVE-2012-3968)

  - A buffer overflow exists related to SVG filters.
    (CVE-2012-3969)

  - A use-after-free error exists related to elements     having 'requiredFeatures' attributes. (CVE-2012-3970)

  - A 'Graphite 2' library memory corruption error exists.
    (CVE-2012-3971)

  - An XSLT out-of-bounds read error exists related to     'format-number'. (CVE-2012-3972)

  - The DOM parser can unintentionally load linked     resources in extensions. (CVE-2012-3975)

  - Incorrect SSL certificate information can be displayed     in the address bar when two 'onLocationChange' events     fire out of order. (CVE-2012-3976)

  - Security checks related to location objects can be     bypassed if crafted calls are made to the browser     chrome code. (CVE-2012-3978)

  - SPDY's request header compression leads to information     leakage, which can allow private data such as session     cookies to be extracted, even over an SSL connection.
    (CVE-2012-4930)

The Mozilla Project reports :

MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)

MFSA 2012-58 Use-after-free issues found using Address Sanitizer

MFSA 2012-59 Location object can be shadowed using Object.defineProperty

MFSA 2012-60 Escalation of privilege through about:newtab

MFSA 2012-61 Memory corruption with bitmap format images with negative height

MFSA 2012-62 WebGL use-after-free and memory corruption

MFSA 2012-63 SVG buffer overflow and use-after-free issues

MFSA 2012-64 Graphite 2 memory corruption

MFSA 2012-65 Out-of-bounds read in format-number in XSLT

MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation

MFSA 2012-67 Installer will launch incorrect executable following new installation

MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html

MFSA 2012-69 Incorrect site SSL certificate data display

MFSA 2012-70 Location object security checks bypassed by chrome code

MFSA 2012-71 Insecure use of __android_log_print

MFSA 2012-72 Web console eval capable of executing chrome-privileged code

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2012-1351 advisory.

    [10.0.8-1.0.1.el6_3]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
    - Replace clean.gif in tarball

    [10.0.8-1]
    - Update to 10.0.8 ESR

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
61711	Firefox < 15.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	8/29/2012	3/3/2026	critical
61730	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1548-1)	Nessus	Ubuntu Local Security Checks	8/30/2012	9/19/2019	critical
61990	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2012:147)	Nessus	Mandriva Local Security Checks	9/6/2012	1/6/2021	critical
62472	RHEL 5 / 6 : firefox (RHSA-2012:1350)	Nessus	Red Hat Local Security Checks	10/10/2012	1/14/2021	high
62473	RHEL 6 : thunderbird (RHSA-2012:1351)	Nessus	Red Hat Local Security Checks	10/10/2012	4/15/2025	medium
62492	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20121009)	Nessus	Scientific Linux Local Security Checks	10/11/2012	1/14/2021	critical
284427	MiracleLinux 4 : firefox-10.0.10-1.0.1.AXS4, xulrunner-10.0.10-1.0.1.AXS4 (AXSA:2012-1013:06)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
61718	SeaMonkey < 2.12.0 Multiple Vulnerabilities	Nessus	Windows	8/29/2012	5/27/2026	critical
61741	FreeBSD : mozilla -- multiple vulnerabilities (2b8cad90-f289-11e1-a215-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	8/31/2012	1/6/2021	critical
62484	CentOS 5 / 6 : firefox (CESA-2012:1350)	Nessus	CentOS Local Security Checks	10/11/2012	1/4/2021	high
68636	Oracle Linux 5 / 6 : thunderbird (ELSA-2012-1351)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	medium

Detections

Analytics

Plugins Search

critical

critical

critical

high

medium

critical

medium

critical

critical

high

medium