The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required     character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout     CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP     response. (CVE-2013-6167)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Mozilla Firefox から 27 までが、必要な文字セット制限があることを最初に検証せずに、HTTP Cookie ヘッダーを送信します。これにより、リモートの攻撃者は、Web アプリケーションに無効な形式の Cookie を設定させるように細工されたパラメーターを介して、持続的なログアウト CSRF 攻撃と同等の攻撃を仕掛ける可能性があります。可能性があります。 （CVE-2013-6167）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Mozilla Firefox 至 27 未首先验证 HTTP Cookie 标头具有所需的字符集限制就发送了 HTTP Cookie 标头，这允许远程攻击者通过构建的参数执行等同于持久性注销 CSRF 攻击的行为，该参数强制 Web 应用程序设置畸形 Cookie HTTP 响应中触发 。 (CVE-2013-6167)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Mozilla Firefox 到 27 版即傳送 HTTP Cookie 標頭，而未先驗證其是否具備所需的字元集限制，進而允許遠端攻擊者透過特製的參數，強制 Web 應用程式設定格式錯誤的 Cookie，藉此發動等同於持續登出 CSRF 攻擊的參數。在 HTTP 回應中。 (CVE-2013-6167)

請注意，Nessus 依賴供應商報告的套件存在。

Versions of Firefox 20.0 and older are potentially affected by the following security issues :

 - Remote memory-corruption vulnerabilities in the browser engine that could lead to arbitrary code execution. Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition. (CVE-2013-0788, CVE-2013-0789, CVE-2013-0790)
  - A local privilege-escalation vulnerability exists due to a buffer-overflow in Mozilla Maintenance Service. An attacker requires local file system access to exploit this issue. Exploiting this issue allows attackers to execute arbitrary code with elevated privileges. (CVE-2013-0799)
  - The applications are prone to a denial-of-service vulnerability due to an an out-of-bounds write condition in the Cairo graphics library. (CVE-2013-0800)
  - A remote memory-corruption vulnerability exists due to an out-of-bounds read condition in the 'CERT_DecodeCertPackage()' function of the Network Security Services (NSS) library when decoding a certificate. (CVE-2013-0791)
  - A local privilege-escalation vulnerability exists due to an error when using Mozilla Updater. Specifically, the issue occurs when the malicious 'DLL' file is placed in a specific location on the local system before the Mozilla Updater is run. (CVE-2013-0797)
  - A remote memory-corruption vulnerability when processing crafted PNG images. Specifically, this issue occurs because certain grayscale PNG images are displayed improperly when "gfx.color_management.enablev4" is enabled. Successful exploits may allow an attacker to gain access to sensitive information. (CVE-2013-0792)
  - A remote memory-corruption vulnerability exists in WebGL rendering. Specifically, the issue occurs because the applications attempts to free memory that has not previously been allocated. The vulnerability only affects Linux users who have Intel Mesa graphics drivers. (CVE-2013-0796)
  - An information disclosure vulnerability exists. Specifically, this issue exists in tab-modal dialog boxes. An attacker can exploit this issue to overlay a page and show another site's content. (CVE-2013-0794)
  - A security-bypass vulnerability due to an error when cloning a node through the 'cloneNode()' method. An attacker can exploit this issue to bypass System Only Wrappers (SOW) and the same origin policy. (CVE-2013-0795)
  - A cross-site scripting vulnerability exists because of an error related to a 'baseURI' of a page in the history. An attacker can exploit this issue to spoof the URL displayed in the address bar while displaying a different page and execute script code. (CVE-2013-0793)
 - A flaw exists and is triggered during the handling of the 'browser.cookie' header. This may allow a context-dependent attacker to terminate a user's session on a website, which will not allow the attacker to log back in to the website until after the browser has been restarted. (CVE-2013-6167)

ID	名稱	產品	系列	已發布	已更新	嚴重性
218341	Linux Distros Unpatched Vulnerability : CVE-2013-6167	Nessus	Misc.	2025/3/4	2025/9/3	high
218341	Linux Distros のパッチ未適用の脆弱性: CVE-2013-6167	Nessus	Misc.	2025/3/4	2025/9/3	high
218341	Linux Distros 未修补的漏洞: CVE-2013-6167	Nessus	Misc.	2025/3/4	2025/9/3	high
218341	Linux Distros 未修補弱點：CVE-2013-6167	Nessus	Misc.	2025/3/4	2025/9/3	high
6734	Mozilla Firefox < 20.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/4/4	2019/3/6	critical

偵測

搜尋 Plugin

high

high

high

high

critical