Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

2015-06-10/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

2015-06-04/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

2015-06-10/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

2015-06-04/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

Full Sized Blog Element (Big Preview Pic)

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

2015-06-10/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Vulnerability

Severity

Host

Location

Actions

Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)

7.5 (High)

192.168.1.106

general/tcp

SummaryThis host is installed with Mozilla Firefox and is prone to multiple vulnerabilities.

Vulnerability Detection Result

Installed version: 35.0.1
Fixed version:     38.0

ImpactSuccessful exploitation will allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code, bypass security restrictions, bypass origin restrictions, gain knowledge of sensitive information, run custom code, cause the server to crash and gain privileged access.

Impact Level: System/Application

SolutionUpgrade to Mozilla Firefox version 38.0 or later, For updates refer to http://www.mozilla.com/en-US/firefox/all.html

Vulnerability InsightMultiple flaws are due to: – Flaw in WebChannel.jsm module in Mozilla Firefox. – Integer overflow in libstagefright in Mozilla Firefox. – Buffer overflow in the XML parser in Mozilla Firefox. – Race condition in the ‘nsThreadManager::RegisterCurrentThread’ function in Mozilla Firefox. – Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox. – Flaw in Mozilla Firefox so that does not recognize a referrer policy delivered by a referrer META element. – Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox. – Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox. – Flaw in asm.js implementation in Mozilla Firefox. – Flaw in GStreamer in Mozilla Firefox.

Vulnerability Detection MethodGet the installed version with the help of detect NVT and check the version is vulnerable or not.

Details: Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X) (OID: 1.3.6.1.4.1.25623.1.0.805626)

Version used: $Revision: 1271 $

References

CVE:	CVE-2015-2708, CVE-2015-2709, CVE-2015-2710, CVE-2015-2711, CVE-2015-2712, CVE-2015-2713, CVE-2015-2715, CVE-2015-2716, CVE-2015-2717, CVE-2015-2718, CVE-2015-0797
BID:	74615, 74611
CERT:	DFN-CERT-2015-0692 , DFN-CERT-2015-0683 , DFN-CERT-2015-0566
Other:	http://osvdb.org/122021
	http://osvdb.org/122022
	http://osvdb.org/122038
	https://www.mozilla.org/en-US/security/advisories/mfsa2015-46

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

2015-06-04/0 Comments/in Vulnerability & Threat Report/by SecurityOrb_Staff

Vulnerability

Severity

Host

Location

Actions

Pidgin Multiple Vulnerabilities Feb 2014 (Windows)

10.0 (High)

192.168.1.10

general/tcp

SummaryThe host is installed with Pidgin and is prone to multiple vulnerabilities.

Vulnerability Detection ResultVulnerability was detected according to the Vulnerability Detection Method.

ImpactSuccessful exploitation will allow remote attackers to conduct denial of service or execute arbitrary programs or spoof iq traffic.

Impact Level: System/Application

SolutionUpgrade to Pidgin version 2.10.8 or later, For updates refer to http://www.pidgin.im/

Vulnerability InsightThe flaws are due to an, – Improper validation of data by the Yahoo protocol plugin. – Improper validation of argument counts by IRC protocol plugin. – Improper validation of input to content-length header. – Integer signedness error in the ‘MXit’ functionality. – Integer overflow in ‘ibpurple/protocols/gg/lib/http.c’ in the ‘Gadu-Gadu’ (gg) parser. – Error due to incomplete fix for earlier flaw. – Integer overflow condition in the ‘process_chunked_data’ function in ‘util.c’. – Error in ‘STUN’ protocol implementation in ‘libpurple’. – Error in the ‘XMPP’ protocol plugin in ‘libpurple’. – Error in the MSN module. – Improper validation of the length field in ‘libpurple/protocols/yahoo/libymsg.c’. – Improper allocation of memory by ‘util.c’ in ‘libpurple’. – Error in the libx11 library. – Multiple integer signedness errors in libpurple.

Vulnerability Detection MethodGet the installed version with the help of detect NVT and check the version is vulnerable or not.

Details: Pidgin Multiple Vulnerabilities Feb 2014 (Windows) (OID: 1.3.6.1.4.1.25623.1.0.804314)

Version used: $Revision: 302 $

References

CVE:	CVE-2012-6152, CVE-2013-6477, CVE-2013-6478, CVE-2013-6479, CVE-2013-6481, CVE-2013-6482, CVE-2013-6483, CVE-2013-6484, CVE-2013-6485, CVE-2013-6486, CVE-2013-6487, CVE-2013-6489, CVE-2013-6490, CVE-2014-0020
BID:	65492, 65243, 65189, 65188, 65192, 65195
CERT:	DFN-CERT-2014-0676 , DFN-CERT-2014-0160 , DFN-CERT-2014-0123
Other:	http://www.osvdb.com/102622
	http://www.osvdb.com/102616
	http://secunia.com/advisories/56693/
	http://www.pidgin.im/news/security/?id=70
	http://www.pidgin.im/news/security/?id=85