Mozilla Firefox and Thunderbird were updated to version 8.0 which fixes several security vulnerabilities :

  - MFSA 2011-52 - Code execution via NoWaiverWrapper     (CVE-2011-3655)

  - MFSA 2011-51 - Cross-origin image theft on Mac with     integrated Intel GPU (CVE-2011-3653)

  - MFSA 2011-50 - Cross-origin data theft using canvas and     Windows D2D (CVE-2011-3649)

  - MFSA 2011-49 - Memory corruption while profiling using     Firebug (CVE-2011-3650)

  - MFSA 2011-48 - Miscellaneous memory safety hazards     (rv:8.0) (CVE-2011-3651, CVE-2011-3652, CVE-2011-3654)

  - MFSA 2011-47 - Potential XSS against sites using     Shift-JIS (CVE-2011-3648)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding, which can allow cross-site     scripting attacks. (CVE-2011-3648)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element, which can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

The Mozilla Project reports :

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)

MFSA 2011-47 Potential XSS against sites using Shift-JIS

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

MFSA 2011-49 Memory corruption while profiling using Firebug

MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D

MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU

MFSA 2011-52 Code execution via NoWaiverWrapper

The version of Thunderbird installed on the remote Windows host is prior to 8.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2011-51 advisory.

  - Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU     memory behavior of a certain driver for Intel integrated GPUs, which allows remote attackers to bypass the     Same Origin Policy and read image data via vectors related to WebGL textures. (CVE-2011-3653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 8.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2011-51 advisory.

  - Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU     memory behavior of a certain driver for Intel integrated GPUs, which allows remote attackers to bypass the     Same Origin Policy and read image data via vectors related to WebGL textures. (CVE-2011-3653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mozilla Firefox has been updated to version 1.9.2.24 (bnc#728520) to fix the following security issues :

  - (bmo#680880) loadSubScript unwraps XPCNativeWrapper     scope parameter. (MFSA 2011-46 / CVE-2011-3647)

  - (bmo#690225) Potential XSS against sites using     Shift-JIS. (MFSA 2011-47 / CVE-2011-3648)

  - (bmo#674776) Memory corruption while profiling using     Firebug. (MFSA 2011-49 / CVE-2011-3650)

The installed version of Firefox is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

  - MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS     against sites using Shift-JIS

  - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654     Miscellaneous memory safety hazards

  - MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory     corruption while profiling using Firebug

  - MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution     via NoWaiverWrapper

SeaMonkey was upgraded to version 2.5 in order to fix the following security problems :

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug

dbg114-seamonkey-5487 new_updateinfo seamonkey-5487 MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

This update to version 3.13.1 of mozilla-nss fixes the following issues :

  - Explicitly distrust DigiCert Sdn. Bhd (bmo#698753)

  - Better SHA-224 support (bmo#647706)

  - Fix a regression (causing hangs in some situations)     introduced in 3.13 (bmo#693228)

  - SSL 2.0 is disabled by default

  - A defense against the SSL 3.0 and TLS 1.0 CBC chosen     plaintext attack demonstrated by Rizzo and Duong     (CVE-2011-3389) has been enabled by default. Set the     SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.

  - Support SHA-224

  - Add PORT_ErrorToString and PORT_ErrorToName to return     the error message and symbolic name of an NSS error code

  - Add NSS_GetVersion to return the NSS version string

  - Add experimental support of RSA-PSS to the softoken only

  - NSS_NoDB_Init does not try to open /pkcs11.txt and     /secmod.db anymore (bmo#641052)

The installed version of Thunderbird is earlier than 8.0 and thus, is potentially affected by the following security issues :

  - Certain invalid sequences are not handled properly in     'Shift-JIS' encoding and can allow cross-site scripting     attacks. (CVE-2011-3648)

  - The addition of the 'Azure' graphics functionality re-     introduced a cross-origin information disclosure issue     previously described in CVE-2011-2986. (CVE-2011-3649)

  - Profiling JavaScript files with many functions can cause     the application to crash. It may be possible to trigger     this behavior even when the debugging APIs are not being     used. (CVE-2011-3650)

  - Multiple memory safety issues exist. (CVE-2011-3651)

  - An unchecked memory allocation failure can cause the     application to crash. (CVE-2011-3652)

  - An issue with WebGL graphics and GPU drivers can allow     allow cross-origin image theft. (CVE-2011-3653)

  - An error exists related to SVG 'mpath' linking to a     non-SVG element and can result in potentially     exploitable application crashes. (CVE-2011-3654)

  - An error in internal privilege checking can allow     web content to obtain elevated privileges.
    (CVE-2011-3655)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74542	openSUSE Security Update : firefox / thunderbird (openSUSE-2011-9)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
56756	Firefox < 8.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2011/11/9	2026/3/3	high
56762	FreeBSD : mozilla -- multiple vulnerabilities (6c8ad3e8-0a30-11e1-9580-4061862b8c22)	Nessus	FreeBSD Local Security Checks	2011/11/10	2021/1/6	critical
279220	Mozilla Thunderbird < 8.0	Nessus	Windows	2025/12/18	2025/12/18	high
279228	Mozilla Firefox < 8.0	Nessus	MacOS X Local Security Checks	2025/12/18	2025/12/18	high
57084	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 5429)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	critical
56751	Firefox < 8.0 Multiple Vulnerabilities	Nessus	Windows	2011/11/9	2026/6/23	high
75743	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
76024	openSUSE Security Update : seamonkey (openSUSE-SU-2011:1290-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2013/1/8	2025/10/6	critical
57226	SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)	Nessus	SuSE Local Security Checks	2011/12/13	2022/12/5	critical
56753	Mozilla Thunderbird < 8.0 Multiple Vulnerabilities	Nessus	Windows	2011/11/9	2018/7/16	high

检测

插件搜索

critical

high

critical

high

high

critical

high

critical

critical

critical

critical

high