The remote Solaris system is missing necessary patches to address security updates :

  - CRLF injection vulnerability in Mozilla Firefox 4.x     through 10.0, Firefox ESR 10.x before 10.0.3,     Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x     before 10.0.3, and SeaMonkey before 2.8 allows remote     web servers to bypass intended Content Security Policy     (CSP) restrictions and possibly conduct cross-site     scripting (XSS) attacks via crafted HTTP headers.
    (CVE-2012-0451)

  - Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 do not properly     restrict drag-and-drop operations on javascript: URLs,     which allows user-assisted remote attackers to conduct     cross-site scripting (XSS) attacks via a crafted web     page, related to a 'DragAndDropJacking' issue.
    (CVE-2012-0455)

  - The SVG Filters implementation in Mozilla Firefox before     3.6.28 and 4.x through 10.0, Firefox ESR 10.x before     10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 might allow remote attackers to obtain sensitive     information from process memory via vectors that trigger     an out-of-bounds read. (CVE-2012-0456)

  - Use-after-free vulnerability in the     nsSMILTimeValueSpec::ConvertBetweenTimeContainer     function in Mozilla Firefox before 3.6.28 and 4.x     through 10.0, Firefox ESR 10.x before 10.0.3,     Thunderbird before 3.1.20 and 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 might allow remote attackers to execute arbitrary     code via an SVG animation. (CVE-2012-0457)

  - Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 do not properly     restrict setting the home page through the dragging of a     URL to the home button, which allows user-assisted     remote attackers to execute arbitrary JavaScript code     with chrome privileges via a javascript: URL that is     later interpreted in the about:sessionrestore context.
    (CVE-2012-0458)

  - The Cascading Style Sheets (CSS) implementation in     Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x     before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird     ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via dynamic modification of a keyframe followed by     access to the cssText of the keyframe. (CVE-2012-0459)

  - Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x     before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird     ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not     properly restrict write access to the window.fullScreen     object, which allows remote attackers to spoof the user     interface via a crafted web page. (CVE-2012-0460)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 3.6.28 and 4.x through     10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 allow remote attackers     to cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors. (CVE-2012-0461)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox 4.x through 10.0, Firefox ESR     10.x before 10.0.3, Thunderbird 5.0 through 10.0,     Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before     2.8 allow remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors.
    (CVE-2012-0462)

  - Use-after-free vulnerability in the browser engine in     Mozilla Firefox before 3.6.28 and 4.x through 10.0,     Firefox ESR 10.x before 10.0.3, Thunderbird before     3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before     10.0.3, and SeaMonkey before 2.8 allows remote attackers     to execute arbitrary code via vectors involving an empty     argument to the array.join function in conjunction with     the triggering of garbage collection. (CVE-2012-0464)

USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird.

It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. (CVE-2011-3658)

Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. (CVE-2012-0457)

Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content.
(CVE-2012-0456)

Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data. (CVE-2012-0455)

Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. (CVE-2012-0458)

Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-0461, CVE-2012-0464).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:0388 advisory.

  - Mozilla: XSS with multiple Content Security Policy headers (MFSA 2012-15) (CVE-2012-0451)

  - Mozilla: XSS with Drag and Drop and Javascript: URL (MFSA 2012-13) (CVE-2012-0455)

  - Mozilla: SVG issues found with Address Sanitizer (MFSA 2012-14) (CVE-2012-0456, CVE-2012-0457)

  - Mozilla: Escalation of privilege with Javascript: URL as home page (MFSA 2012-16) (CVE-2012-0458)

  - Mozilla: Crash when accessing keyframe cssText after dynamic modification (MFSA 2012-17) (CVE-2012-0459)

  - Mozilla: window.fullScreen writeable by untrusted content (MFSA 2012-18) (CVE-2012-0460)

  - Mozilla: Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28) (MFSA 2012-19)     (CVE-2012-0461, CVE-2012-0462, CVE-2012-0464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Thunderbird 10.0.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability exists that     can be leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The installed version of Thunderbird 3.1.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0457,      CVE-2012-0461, CVE-2012-0462, CVE-2012-0463,     CVE-2012-0464)

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

Mozilla Firefox was updated to 10.0.3 ESR to fix various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-19)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

    References :

    Bob Clary reported two bugs that causes crashes that     affected Firefox 3.6, Firefox ESR, and Firefox 10.
    (CVE-2012-0461)

    Christian Holler, Jesse Ruderman, Nils, Michael     Bebenita, Dindog, and David Anderson reported memory     safety problems and crashes that affect Firefox ESR and     Firefox 10. (CVE-2012-0462)

    Jeff Walden reported a memory safety problem in the     array.join function. This bug was independently reported     by Vincenzo Iozzo via TippingPoint's Zero Day Initiative     Pwn2Own contest. (CVE-2012-0464)

    Masayuki Nakano reported a memory safety problem that     affected Mobile Firefox

  - CVE-2012-0463

  - Mozilla developer Matt Brubeck reported that     window.fullScreen is writeable by untrusted content now     that the DOM fullscreen API is enabled. Because     window.fullScreen does not include     mozRequestFullscreen's security protections, it could be     used for UI spoofing. This code change makes     window.fullScreen read only by untrusted content,     forcing the use of the DOM fullscreen API in normal     usage. (MFSA 2012-18 / CVE-2012-0460)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Mozilla community member Daniel Glazman of Disruptive     Innovations reported a crash when accessing a keyframe's     cssText after dynamic modification. This crash may be     potentially exploitable. (MFSA 2012-17 / CVE-2012-0459)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Mariusz Mlynski reported that an     attacker able to convince a potential victim to set a     new home page by dragging a link to the 'home' button     can set that user's home page to a javascript: URL. Once     this is done the attacker's page can cause repeated     crashes of the browser, eventually getting the script     URL loaded in the privileged about:sessionrestore     context. (MFSA 2012-16 / CVE-2012-0458)

  - Security Researcher Mike Brooks of Sitewatch reported     that if multiple Content Security Policy (CSP) headers     are present on a page, they have an additive effect page     policy. Using carriage return line feed (CRLF)     injection, a new CSP rule can be introduced which allows     for cross-site scripting (XSS) on sites with a separate     header injection vulnerability. (MFSA 2012-15 /     CVE-2012-0451)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Atte Kettunen from OUSPG found two     issues with Firefox's handling of SVG using the Address     Sanitizer tool. The first issue, critically rated, is a     use-after-free in SVG animation that could potentially     lead to arbitrary code execution. The second issue is     rated moderate and is an out of bounds read in SVG     Filters. This could potentially incorporate data from     the user's memory, making it accessible to the page     content. (MFSA 2012-14 / CVE-2012-0457 / CVE-2012-0456)

  - Firefox prevents the dropping of javascript: links onto     a frame to prevent malicious sites from tricking users     into performing a cross-site scripting (XSS) attacks on     themselves. Security researcher Soroush Dalili reported     a way to bypass this protection. (MFSA 2012-13 /     CVE-2012-0455)

  - Security researchers Blair Strang and Scott Bell of     Security Assessment found that when a parent window     spawns and closes a child window that uses the file open     dialog, a crash can be induced in shlwapi.dll on 32-bit     Windows 7 systems. This crash may be potentially     exploitable. (MFSA 2012-12 / CVE-2012-0454)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Reworked the KDE4 integration. (bnc#745017)

Mozilla Firefox was updated to 3.6.28 to fix various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-19)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Bob Clary reported two bugs that causes crashes that     affected Firefox 3.6, Firefox ESR, and Firefox 10.
    (CVE-2012-0461)

    Christian Holler, Jesse Ruderman, Nils, Michael     Bebenita, Dindog, and David Anderson reported memory     safety problems and crashes that affect Firefox ESR and     Firefox 10. (CVE-2012-0462)

    Jeff Walden reported a memory safety problem in the     array.join function. This bug was independently reported     by Vincenzo Iozzo via TippingPoint's Zero Day Initiative     Pwn2Own contest. (CVE-2012-0464)

    Masayuki Nakano reported a memory safety problem that     affected Mobile Firefox 10. (CVE-2012-0463)

  - Security researcher Mariusz Mlynski reported that an     attacker able to convince a potential victim to set a     new home page by dragging a link to the 'home' button     can set that user's home page to a javascript: URL. Once     this is done the attacker's page can cause repeated     crashes of the browser, eventually getting the script     URL loaded in the privileged about:sessionrestore     context. (MFSA 2012-16 / CVE-2012-0458)

  - Security researcher Atte Kettunen from OUSPG found two     issues with Firefox's handling of SVG using the Address     Sanitizer tool. The first issue, critically rated, is a     use-after-free in SVG animation that could potentially     lead to arbitrary code execution. The second issue is     rated moderate and is an out of bounds read in SVG     Filters. This could potentially incorporate data from     the user's memory, making it accessible to the page     content. (MFSA 2012-14 / CVE-2012-0457 / CVE-2012-0456)

  - Firefox prevents the dropping of javascript: links onto     a frame to prevent malicious sites from tricking users     into performing a cross-site scripting (XSS) attacks on     themselves. Security researcher Soroush Dalili reported     a way to bypass this protection. (MFSA 2012-13 /     CVE-2012-0455)

The full overview can be found on Mozillas security page at:
http://www.mozilla.org/security/announce/

ID	Name	Product	Family	Published	Updated	Severity
80606	Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_in_firefox_web)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	high
58481	Ubuntu 10.04 LTS / 10.10 / 11.04 : thunderbird vulnerabilities (USN-1401-2)	Nessus	Ubuntu Local Security Checks	3/26/2012	9/19/2019	high
58339	RHEL 5 / 6 : thunderbird (RHSA-2012:0388)	Nessus	Red Hat Local Security Checks	3/14/2012	4/27/2024	medium
58350	Mozilla Thunderbird 10.0.x < 10.0.3 Multiple Vulnerabilities	Nessus	Windows	3/15/2012	7/16/2018	high
58351	Mozilla Thunderbird 3.1.x < 3.1.20 Multiple Vulnerabilities	Nessus	Windows	3/15/2012	7/16/2018	high
58524	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6007)	Nessus	SuSE Local Security Checks	3/29/2012	1/19/2021	high
58525	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8029)	Nessus	SuSE Local Security Checks	3/29/2012	1/19/2021	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high