The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1674 advisory.

    firefox:

    [3.0.16-1.0.1.el5_4]
    - Update firstrun and homepage URLs in specfile
    - Added patch oracle-firefox-branding.patch
    - Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html       and removed the corresponding  Red Hat ones

    [3.0.16-1]
    - Update to 3.0.16

    xulrunner:

    [1.9.0.16-2.0.1.el5_4]
    - Added xulrunner-oracle-default-prefs.js and removed the corresponding       RedHat one.

    [1.9.0.16-2]
    - Rebuild due to Mozilla's respin

    [1.9.0.16-1]
    - Update to 1.9.0.16

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mozilla Firefox earlier than 3.0.16 or 3.5.6.  Such versions are potentially affected by multiple vulnerabilities : 

 - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)
 - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)
 - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)
 - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)
 - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)
 - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)
 - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)



The remote host is running a version of SeaMonkey earlier than 2.0.1.  Such versions are potentially affected by multiple vulnerabilities : 

  - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)

  - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)

  - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)

  - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)

The remote host is running a version of Mozilla SeaMonkey earlier than 2.0.1.  Such versions are potentially affected by multiple vulnerabilities : 

  - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)

  - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)

  - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)

  - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)

The remote host is running a version of Mozilla Firefox earlier than 3.0.16 or 3.5.6.  Such versions are potentially affected by multiple vulnerabilities : 

  - Multiple crashes that could result in arbitrary code execution. (MFSA 2009-65)

  - Multiple vulnerabilities in 'liboggplay'  which could lead to arbitrary code execution.  Note that this only affects the 3.5.x branch. (MFSA 2009-66)

  - An integer overflow in the 'Theora' video library which could lead to a crash or the execution of arbitrary code.  Note that this only affects the 3.5.x branch. (MFSA 2009-67)

  - The NTML implementation is vulnerable to reflection attacks in which NTML credentials from one application could be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities. (MFSA 2009-69)

  - A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property which could lead to a privilege escalation. (MFSA 2009-70)

  - The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)

ID	名稱	產品	系列	已發布	已更新	嚴重性
67975	Oracle Linux 5 : firefox (ELSA-2009-1674)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	critical
5264	Mozilla Firefox < 3.0.16 / 3.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/12/16	2019/3/6	medium
5265	SeaMonkey < 2.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/12/16	2019/3/6	medium
801360	Mozilla SeaMonkey < 2.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2009/12/16		high
801369	Mozilla Firefox < 3.0.16 / 3.5.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2009/12/16		high

偵測

搜尋 Plugin

critical

medium

medium

high

high