ID CVE-2014-1592
Summary Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:seamonkey:2.30
    cpe:2.3:a:mozilla:seamonkey:2.30
  • Mozilla Firefox 33.0
    cpe:2.3:a:mozilla:firefox:33.0
  • Mozilla Firefox Extended Support Release (ESR) 31.2
    cpe:2.3:a:mozilla:firefox_esr:31.2
  • Mozilla Thunderbird 31.2
    cpe:2.3:a:mozilla:thunderbird:31.2
CVSS
Base: 6.8 (as of 11-12-2014 - 13:25)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_31_3_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 79664
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79664
    title Firefox ESR 31.x < 31.3 Multiple Vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_31_3.NASL
    description The version of Thunderbird installed on the remote Windows host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 79666
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79666
    title Mozilla Thunderbird < 31.3 Multiple Vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_34.NASL
    description The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the 'XrayWrappers' filter not properly validating object properties. This allows a remote attacker to bypass security protection mechanisms to access protected objects. (CVE-2014-8631) - A security bypass vulnerability exists due to Chrome Object Wrappers (COW) being passed as native interfaces. This allows a remote attacker to access normally protected objects. (CVE-2014-8632) - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A security bypass vulnerability exists due improper declaration of chrome accessible CSS primary namespaces allowing for XML Binding Language (XBL) bindings to be triggered remotely. (CVE-2014-1589) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - An information disclosure vulnerability exists due to Content Security Policy (CSP) violation reports triggered by a redirect not properly removing path information which can reveal sensitive information. Note that this only affects Firefox 33. (CVE-2014-1591) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 79665
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79665
    title Firefox < 34.0 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-784.NASL
    description seamonkey was updated to version 2.31 to fix 20 security issues. These security issues were fixed : - Miscellaneous memory safety hazards (CVE-2014-1587, CVE-2014-1588). - XBL bindings accessible via improper CSS declarations (CVE-2014-1589). - XMLHttpRequest crashes with some input streams (CVE-2014-1590). - CSP leaks redirect data via violation reports (CVE-2014-1591). - Use-after-free during HTML5 parsing (CVE-2014-1592). - Buffer overflow while parsing media content (CVE-2014-1593). - Bad casting from the BasicThebesLayer to BasicContainerLayer (CVE-2014-1594). - Miscellaneous memory safety hazards (CVE-2014-1574, CVE-2014-1575). - Buffer overflow during CSS manipulation (CVE-2014-1576). - Web Audio memory corruption issues with custom waveforms (CVE-2014-1577). - Out-of-bounds write with WebM video (CVE-2014-1578). - Further uninitialized memory use during GIF rendering (CVE-2014-1580). - Use-after-free interacting with text directionality (CVE-2014-1581). - Key pinning bypasses (CVE-2014-1582, CVE-2014-1584). - Inconsistent video sharing within iframe (CVE-2014-1585, CVE-2014-1586). - Accessing cross-origin objects via the Alarms API (only relevant for installed web apps) (CVE-2014-1583). This non-security issue was fixed : - define /usr/share/myspell as additional dictionary location and remove add-plugins.sh finally (bnc#900639).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80093
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80093
    title openSUSE Security Update : seamonkey (openSUSE-SU-2014:1655-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-746.NASL
    description This MozillaFirefox update fixes several security and non security issues. Changes in MozillaFirefox : - update to Firefox 34.0.5 (bnc#908009) - Default search engine changed to Yahoo! for North America - Default search engine changed to Yandex for Belarusian, Kazakh, and Russian locales - Improved search bar (en-US only) - Firefox Hello real-time communication client - Easily switch themes/personas directly in the Customizing mode - Implementation of HTTP/2 (draft14) and ALPN - Disabled SSLv3 - MFSA 2014-83/CVE-2014-1587/CVE-2014-1588 Miscellaneous memory safety hazards - MFSA 2014-84/CVE-2014-1589 (bmo#1043787) XBL bindings accessible via improper CSS declarations - MFSA 2014-85/CVE-2014-1590 (bmo#1087633) XMLHttpRequest crashes with some input streams - MFSA 2014-86/CVE-2014-1591 (bmo#1069762) CSP leaks redirect data via violation reports - MFSA 2014-87/CVE-2014-1592 (bmo#1088635) Use-after-free during HTML5 parsing - MFSA 2014-88/CVE-2014-1593 (bmo#1085175) Buffer overflow while parsing media content - MFSA 2014-89/CVE-2014-1594 (bmo#1074280) Bad casting from the BasicThebesLayer to BasicContainerLayer - rebased patches - limit linker memory usage for %ix86 - update to Firefox 33.1 - Adding DuckDuckGo as a search option (upstream) - Forget Button added - Enhanced Tiles - Privacy tour introduced - fix typo in GStreamer Recommends - Disable elf-hack for aarch64 - Enable EGL for aarch64 - Limit RAM usage during link for %arm - Fix _constraints for ARM - use proper macros for ARM - use '--disable-optimize' not only on 32-bit x86, but on 32-bit arm too to fix compiling. - pass '-Wl,--no-keep-memory' to linker to reduce required memory during linking on arm. - update to Firefox 33.0.2 - Fix a startup crash with some combination of hardware and drivers 33.0.1 - Firefox displays a black screen at start-up with certain graphics drivers - adjusted _constraints for ARM - added mozilla-bmo1088588.patch to fix build with EGL (bmo#1088588) - define /usr/share/myspell as additional dictionary location and remove add-plugins.sh finally (bnc#900639) - use Firefox default optimization flags instead of -Os - specfile cleanup
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79796
    published 2014-12-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79796
    title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:1581-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1924.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. This update disables SSL 3.0 support by default in Thunderbird. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1284233 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.3.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.3.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79694
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79694
    title CentOS 5 / 6 : thunderbird (CESA-2014:1924)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1919.NASL
    description Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) This update disables SSL 3.0 support by default in Firefox. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1283153 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.3.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 79682
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79682
    title RHEL 5 / 6 / 7 : firefox (RHSA-2014:1919)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2428-1.NASL
    description Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, and Max Jonas Werner discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1587) Joe Vennix discovered a crash when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-1590) Berend-Jan Wever discovered a use-after-free during HTML parsing. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1592) Abhishek Arya discovered a buffer overflow when parsing media content. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1593) Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the compositor. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause undefined behaviour, a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1594). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 79716
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79716
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : thunderbird vulnerabilities (USN-2428-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3090.NASL
    description Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79731
    published 2014-12-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79731
    title Debian DSA-3090-1 : iceweasel - security update
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1924.NASL
    description From Red Hat Security Advisory 2014:1924 : An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. This update disables SSL 3.0 support by default in Thunderbird. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1284233 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.3.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.3.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 79680
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79680
    title Oracle Linux 6 : thunderbird (ELSA-2014-1924)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_FIREFOX-201412-141208.NASL
    description Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues. - Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587) - Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. (MFSA 2014-85 / CVE-2014-1590) - Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. (MFSA 2014-87 / CVE-2014-1592) - Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. (MFSA 2014-88 / CVE-2014-1593) - Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. (MFSA 2014-89 / CVE-2014-1594) - Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events. On vulnerable systems, this issue can result in private data such as usernames, passwords, and other inputed data being saved to a log file on the local system. (MFSA 2014-90 / CVE-2014-1595)
    last seen 2019-02-21
    modified 2015-01-18
    plugin id 80023
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80023
    title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10064)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_31_3.NASL
    description The version of Thunderbird installed on the remote Mac OS X host is a version prior to 31.3. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 79663
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79663
    title Mozilla Thunderbird < 31.3 Multiple Vulnerabilities (Mac OS X)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1924.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. This update disables SSL 3.0 support by default in Thunderbird. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1284233 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.3.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.3.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 79683
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79683
    title RHEL 5 / 6 : thunderbird (RHSA-2014:1924)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_7AE618709DD24884A2F2F19BB5784D09.NASL
    description The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer MFSA-2014-88 Buffer overflow while parsing media content MFSA-2014-87 Use-after-free during HTML5 parsing MFSA-2014-86 CSP leaks redirect data via violation reports MFSA-2014-85 XMLHttpRequest crashes with some input streams MFSA-2014-84 XBL bindings accessible via improper CSS declarations MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)
    last seen 2019-02-21
    modified 2018-12-19
    plugin id 79707
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79707
    title FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_31_3_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.3. It is, therefore, affected by the following vulnerabilities : - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 79661
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79661
    title Firefox ESR 31.x < 31.3 Multiple Vulnerabilities (Mac OS X)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-785.NASL
    description seamonkey was updated to version 2.31 to fix eight security issues. These security issues were fixed : - Miscellaneous memory safety hazards (CVE-2014-1587, CVE-2014-1588). - XBL bindings accessible via improper CSS declarations (CVE-2014-1589). - XMLHttpRequest crashes with some input streams (CVE-2014-1590). - CSP leaks redirect data via violation reports (CVE-2014-1591). - Use-after-free during HTML5 parsing (CVE-2014-1592). - Buffer overflow while parsing media content (CVE-2014-1593). - Bad casting from the BasicThebesLayer to BasicContainerLayer (CVE-2014-1594). This non-security issue was fixed : - define /usr/share/myspell as additional dictionary location and remove add-plugins.sh finally (bnc#900639).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80094
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80094
    title openSUSE Security Update : seamonkey (openSUSE-SU-2014:1656-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_34.NASL
    description The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists due to the 'XrayWrappers' filter not properly validating object properties. This allows a remote attacker to bypass security protection mechanisms to access protected objects. (CVE-2014-8631) - A security bypass vulnerability exists due to Chrome Object Wrappers (COW) being passed as native interfaces. This allows a remote attacker to access normally protected objects. (CVE-2014-8632) - A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER. (CVE-2014-1569) - Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588) - A security bypass vulnerability exists due improper declaration of chrome accessible CSS primary namespaces allowing for XML Binding Language (XBL) bindings to be triggered remotely. (CVE-2014-1589) - A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash. (CVE-2014-1590) - An information disclosure vulnerability exists due to Content Security Policy (CSP) violation reports triggered by a redirect not properly removing path information which can reveal sensitive information. Note that this only affects Firefox 33. (CVE-2014-1591) - A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with 'document.open()' function which can result in arbitrary code execution. (CVE-2014-1592) - A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution. (CVE-2014-1593) - A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution. (CVE-2014-1594) - An information disclosure vulnerability exists due to the CoreGraphic framework creating log files containing sensitive information in the '/tmp' directory. (CVE-2014-1595)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 79662
    published 2014-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79662
    title Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20141202_THUNDERBIRD_ON_SL6_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. This update disables SSL 3.0 support by default in Thunderbird. Details on how to re-enable SSL 3.0 support are available at : After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 79714
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79714
    title Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1919.NASL
    description From Red Hat Security Advisory 2014:1919 : Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) This update disables SSL 3.0 support by default in Firefox. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1283153 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.3.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 79708
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79708
    title Oracle Linux 5 / 6 / 7 : firefox (ELSA-2014-1919)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2424-1.NASL
    description Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Christian Holler, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1587, CVE-2014-1588) Cody Crews discovered a way to trigger chrome-level XBL bindings from web content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-1589) Joe Vennix discovered a crash when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-1590) Muneaki Nishimura discovered that CSP violation reports did not remove path information in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2014-1591) Berend-Jan Wever discovered a use-after-free during HTML parsing. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1592) Abhishek Arya discovered a buffer overflow when parsing media content. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1593) Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the compositor. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause undefined behaviour, a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1594). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 79688
    published 2014-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79688
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox vulnerabilities (USN-2424-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20141202_FIREFOX_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) This update disables SSL 3.0 support by default in Firefox. Details on how to re-enable SSL 3.0 support are available at : After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 79712
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79712
    title Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-786.NASL
    description This MozillaThunderbird update fixes several security and non security issues : Changes in MozillaThunderbird : - update to Thunderbird 31.3.0 (bnc#908009) - MFSA 2014-83/CVE-2014-1587 Miscellaneous memory safety hazards - MFSA 2014-85/CVE-2014-1590 (bmo#1087633) XMLHttpRequest crashes with some input streams - MFSA 2014-87/CVE-2014-1592 (bmo#1088635) Use-after-free during HTML5 parsing - MFSA 2014-88/CVE-2014-1593 (bmo#1085175) Buffer overflow while parsing media content - MFSA 2014-89/CVE-2014-1594 (bmo#1074280) Bad casting from the BasicThebesLayer to BasicContainerLayer - fix bashism in mozilla.sh script - Limit RAM usage during link for ARM - remove add-plugins.sh and use /usr/share/myspell directly (bnc#900639)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80095
    published 2014-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80095
    title openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2014:1654-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1919.NASL
    description Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593) A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy. (CVE-2014-1594) This update disables SSL 3.0 support by default in Firefox. Details on how to re-enable SSL 3.0 support are available at: https://access.redhat.com/articles/1283153 Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Joe Vennix, Berend-Jan Wever, Abhishek Arya, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.3.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79693
    published 2014-12-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79693
    title CentOS 5 / 6 / 7 : firefox (CESA-2014:1919)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3092.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, the bypass of security restrictions or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79806
    published 2014-12-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79806
    title Debian DSA-3092-1 : icedove - security update
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201504-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 82632
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82632
    title GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
redhat via4
rpms
  • firefox-0:31.3.0-4.el5_11
  • firefox-0:31.3.0-3.el7_0
  • firefox-0:31.3.0-3.el6_6
  • thunderbird-0:31.3.0-1.el5_11
  • thunderbird-0:31.3.0-1.el6_6
refmap via4
bid 71398
confirm
debian
  • DSA-3090
  • DSA-3092
gentoo GLSA-201504-01
suse
  • openSUSE-SU-2015:0138
  • openSUSE-SU-2015:1266
Last major update 23-12-2016 - 21:59
Published 11-12-2014 - 06:59
Back to Top