a. Update for Service Console packages nss and nspr

   Service console packages for Network Security Services (NSS) and    NetScape Portable Runtime (NSPR) are updated to versions    nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This    patch fixes several security issues in the service console    packages for NSS and NSPR.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-2409, CVE-2009-2408, CVE-2009-2404,    CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372,    CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376,    CVE-2009-3380, and CVE-2009-3382 to these issues.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Network Security Services (NSS)
  - NetScape Portable Runtime (NSPR)

The remote host has a version of Mozilla Firefox earlier than 3.0.15 / 3.5.4 installed.  Such versions are potentially affected by multiple vulnerabilities : 

 - A user's form history, both from web content as well as the smart location bar, was vulnerable to theft. (MFSA 2009-52)
 - The file naming scheme used for downloading a file which already exists in the download folder is predictable.  An attacker with local access could exploit this to trick the browser into opening the incorrect downloaded file. (MFSA 2009-53)
 - Recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. Note that this only affects Firefox 3.5.x. (MFSA 2009-54)
 - A flaw exists in the parsing of regular expressions used in Proxy Auto-configuration (PAC) files. (MFSA 2009-55)
 - A heap-based overflow exists in Mozilla's GIF image parser. (MFSA 2009-56)
 - The XPCOM utility 'XPCVariant: : VariantDataToJS' unwrapped doubly-wrapped objects before returning them to chrome callers which could lead to chrome privileged code calling methods on an object which had previously been created or modified by web content. (MFSA 2009-57)
 - A heap-based overflow exists in Mozilla's string to floating point number conversion routines. (MFSA 2009-59)
 - The text within a selection on a web page can be read by JavaScript in a different domain using the 'document.getSelection' function, violating the same-origin policy. (MFSA 2009-61)
 - When downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. (MFSA 2009-62)
 - Multiple memory safety and stability bugs exist in the 'liboggz', 'libvorbis', and 'liboggplay' libraries.  Note that this issue only affects Firefox 3.5.x. (MFSA 2009-63)
 - Several memory corruption issues exist in the browser engine. (MFSA 2009-64)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
43826	VMSA-2010-0001 : ESX Service Console and vMA updates for nss and nspr	Nessus	VMware ESX Local Security Checks	2010/1/8	2021/1/6	critical
89735	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2010-0001) (remote check)	Nessus	VMware ESX Local Security Checks	2016/3/8	2021/1/6	critical
5218	Mozilla Firefox < 3.0.15 / 3.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/10/28	2019/3/6	medium

检测

插件搜索

critical

critical

medium