ID CVE-2014-8639
Summary Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
References
Vulnerable Configurations
  • Mozilla SeaMonkey 2.31
    cpe:2.3:a:mozilla:seamonkey:2.31
  • Mozilla Firefox 34.0.5
    cpe:2.3:a:mozilla:firefox:34.0.5
  • Mozilla Firefox Extended Support Release (ESR) 31.3.0
    cpe:2.3:a:mozilla:firefox_esr:31.3.0
  • Mozilla Firefox Extended Support Release (ESR) 31.2
    cpe:2.3:a:mozilla:firefox_esr:31.2
  • Mozilla Firefox Extended Support Release (ESR) 31.1.1
    cpe:2.3:a:mozilla:firefox_esr:31.1.1
  • Mozilla Firefox Extended Support Release (ESR) 31.1.0
    cpe:2.3:a:mozilla:firefox_esr:31.1.0
  • Mozilla Firefox Extended Support Release (ESR) 31.0
    cpe:2.3:a:mozilla:firefox_esr:31.0
  • Mozilla Thunderbird 31.3.0
    cpe:2.3:a:mozilla:thunderbird:31.3.0
CVSS
Base: 6.8 (as of 14-01-2015 - 11:37)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2458-2.NASL
    description USN-2458-1 fixed vulnerabilities in Firefox. This update provides the corresponding version of Ubufox. Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 80549
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80549
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : ubufox update (USN-2458-2)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_31_4.NASL
    description The version of Thunderbird installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header. This allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 80521
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80521
    title Mozilla Thunderbird < 31.4 Multiple Vulnerabilities (Mac OS X)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2458-1.NASL
    description Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 80548
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80548
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox vulnerabilities (USN-2458-1)
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_31_4.NASL
    description The version of Thunderbird installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header. This allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 80524
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80524
    title Mozilla Thunderbird < 31.4 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-69.NASL
    description MozillaThunderbird was updated to Thunderbird 31.4.0 (bnc#910669) - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80993
    published 2015-01-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80993
    title openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2015:0133-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0047.NASL
    description From Red Hat Security Advisory 2015:0047 : An updated thunderbird package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639) It was found that the Beacon interface implementation in Thunderbird did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, and Xiaofeng Zheng as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.4.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.4.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 80504
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80504
    title Oracle Linux 6 : thunderbird (ELSA-2015-0047)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_35.NASL
    description The version of Firefox installed on the remote Mac OS X host is prior to 35.0. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639) - A flaw exists in Web Audio that cam allow a small block of memory to be read. (CVE-2014-8640) - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641) - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 80520
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80520
    title Firefox < 35.0 Multiple Vulnerabilities (Mac OS X)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2458-3.NASL
    description USN-2458-1 fixed vulnerabilities in Firefox. This update introduced a regression which could make websites that use CSP fail to load under some circumstances. This update fixes the problem. We apologize for the inconvenience. Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 81041
    published 2015-01-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81041
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox regression (USN-2458-3)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3132.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code, information leaks or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80834
    published 2015-01-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80834
    title Debian DSA-3132-1 : icedove - security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0047.NASL
    description An updated thunderbird package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639) It was found that the Beacon interface implementation in Thunderbird did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, and Xiaofeng Zheng as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.4.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.4.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 80509
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80509
    title RHEL 5 / 6 : thunderbird (RHSA-2015:0047)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_FIREFOX-201501-150127.NASL
    description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/
    last seen 2019-02-21
    modified 2016-08-22
    plugin id 81123
    published 2015-02-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81123
    title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0076-1.NASL
    description This update fixes the following security issues in MozillaFirefox : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889, bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538, bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871, bmo#1098583) Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC Also Mozilla NSS was updated to 3.17.3 to fix : - The QuickDER decoder now decodes lengths robustly (bmo#1064670/CVE-2014-1569) - Support for TLS_FALLBACK_SCSV has been added to the ssltap and tstclnt utilities - Changes in CA certificates Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83666
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83666
    title SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0046.NASL
    description Updated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox's spell checker is now correctly set to the system's locale language. (BZ#643954, BZ#1150572) All Firefox users should upgrade to these updated packages, which contain Firefox version 31.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 80508
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80508
    title RHEL 5 / 6 / 7 : firefox (RHSA-2015:0046)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0046.NASL
    description From Red Hat Security Advisory 2015:0046 : Updated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox's spell checker is now correctly set to the system's locale language. (BZ#643954, BZ#1150572) All Firefox users should upgrade to these updated packages, which contain Firefox version 31.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 80503
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80503
    title Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-0046)
  • NASL family Windows
    NASL id SEAMONKEY_2_32.NASL
    description The version of SeaMonkey installed on the remote host is prior to 2.32. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639) - A flaw exists in Web Audio that cam allow a small block of memory to be read. (CVE-2014-8640) - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641) - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642)
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 80525
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80525
    title SeaMonkey < 2.32 Vulnerability
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0171-1.NASL
    description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83676
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83676
    title SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2015:0171-1)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_35_0.NASL
    description The version of Firefox installed on the remote Windows host is prior to 35.0. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists where DOM objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. (CVE-2014-8636) - A flaw exists in the rendering of bitmap images. When rending a malformed bitmap image, memory may not always be properly initialized, which can result in a leakage of data to web content. (CVE-2014-8637) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639) - A flaw exists in Web Audio that cam allow a small block of memory to be read. (CVE-2014-8640) - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641) - A flaw exists where delegated Online Certificate Status Protocol responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. This can result in a user connecting to a site with a revoked certificate. (CVE-2014-8642) - A flaw exists in the Gecko Media Plugin which can allow an attacker to break out of the sandbox. (CVE-2014-8643)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 80523
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80523
    title Firefox < 35 Multiple Vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150113_FIREFOX_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) This update also fixes the following bug : - The default dictionary for Firefox's spell checker is now correctly set to the system's locale language. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 80545
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80545
    title Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2460-1.NASL
    description Christian Holler and Patrick McManus discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-8634) Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638) Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 80851
    published 2015-01-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80851
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : thunderbird vulnerabilities (USN-2460-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150113_THUNDERBIRD_ON_SL5_X.NASL
    description Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639) It was found that the Beacon interface implementation in Thunderbird did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 80546
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80546
    title Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0047.NASL
    description An updated thunderbird package that fixes three security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639) It was found that the Beacon interface implementation in Thunderbird did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, and Xiaofeng Zheng as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.4.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.4.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80527
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80527
    title CentOS 5 / 6 : thunderbird (CESA-2015:0047)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0173-1.NASL
    description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificates list. For more information, please refer to https://www.mozilla.org/en-US/security/advisories/ . Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83677
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83677
    title SUSE SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0173-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_FIREFOX-201501-150126.NASL
    description Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/
    last seen 2019-02-21
    modified 2016-08-22
    plugin id 81122
    published 2015-02-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81122
    title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10225)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201504-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 82632
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82632
    title GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_31_4_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639) - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 80522
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80522
    title Firefox ESR 31.x < 31.4 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_31_4_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities : - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2014-8634, CVE-2014-8635) - A flaw exists in 'navigator.sendBeacon()' in which it does not follow the cross-origin resource sharing specification. This results in requests from 'sendBeacon()' lacking an 'origin' header, which allows malicious sites to perform XSRF attacks. (CVE-2014-8638) - A flaw exists when receiving 407 Proxy Authentication responses with a 'set-cookie' header. This can allow a session-fixation attack. (CVE-2014-8639) - A read-after-free flaw exists in WebRTC due to the way tracks are handled, which can result in a potentially exploitable crash or incorrect WebRTC behavior. (CVE-2014-8641)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 80519
    published 2015-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80519
    title Firefox ESR 31.x < 31.4 Multiple Vulnerabilities (Mac OS X)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-40.NASL
    description MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features : - Firefox Hello with new rooms-based conversations model - Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80843
    published 2015-01-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80843
    title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2015:0077-2)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0046.NASL
    description Updated firefox packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-8634, CVE-2014-8639, CVE-2014-8641) It was found that the Beacon interface implementation in Firefox did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack. (CVE-2014-8638) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Patrick McManus, Muneaki Nishimura, Xiaofeng Zheng, and Mitchell Harper as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. This update also fixes the following bug : * The default dictionary for Firefox's spell checker is now correctly set to the system's locale language. (BZ#643954, BZ#1150572) All Firefox users should upgrade to these updated packages, which contain Firefox version 31.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80526
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80526
    title CentOS 5 / 6 / 7 : firefox / xulrunner (CESA-2015:0046)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3127.NASL
    description Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code, information leaks or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 80528
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80528
    title Debian DSA-3127-1 : iceweasel - security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-92.NASL
    description Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669) - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - use GStreamer 1.0 from 13.2 on
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81142
    published 2015-02-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81142
    title openSUSE Security Update : seamonkey (openSUSE-SU-2015:0192-1)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_BD62C6409BB911E4A5AD000C297FB80F.NASL
    description The Mozilla Project reports : MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) MFSA-2015-02 Uninitialized memory use during bitmap rendering MFSA-2015-03 sendBeacon requests lack an Origin header MFSA-2015-04 Cookie injection through Proxy Authenticate responses MFSA-2015-05 Read of uninitialized memory in Web Audio MFSA-2015-06 Read-after-free in WebRTC MFSA-2015-07 Gecko Media Plugin sandbox escape MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension MFSA-2015-09 XrayWrapper bypass through DOM objects
    last seen 2019-02-21
    modified 2018-11-23
    plugin id 80538
    published 2015-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80538
    title FreeBSD : mozilla -- multiple vulnerabilities (bd62c640-9bb9-11e4-a5ad-000c297fb80f)
redhat via4
advisories
  • bugzilla
    id 1180967
    title CVE-2014-8639 Mozilla: Cookie injection through Proxy Authenticate responses (MFSA 2015-04)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • comment thunderbird is earlier than 0:31.4.0-1.el5_11
        oval oval:com.redhat.rhsa:tst:20150047002
      • comment thunderbird is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20070108003
    • AND
      • comment thunderbird is earlier than 0:31.4.0-1.el6_6
        oval oval:com.redhat.rhsa:tst:20150047008
      • comment thunderbird is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100896006
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2015:0047
    released 2015-01-13
    severity Important
    title RHSA-2015:0047: thunderbird security update (Important)
  • rhsa
    id RHSA-2015:0046
rpms
  • firefox-0:31.4.0-1.el5_11
  • xulrunner-0:31.4.0-1.el7_0
  • xulrunner-devel-0:31.4.0-1.el7_0
  • firefox-0:31.4.0-1.el7_0
  • firefox-0:31.4.0-1.el6_6
  • thunderbird-0:31.4.0-1.el5_11
  • thunderbird-0:31.4.0-1.el6_6
refmap via4
bid 72046
confirm
debian
  • DSA-3127
  • DSA-3132
gentoo GLSA-201504-01
sectrack
  • 1031533
  • 1031534
secunia
  • 62237
  • 62242
  • 62250
  • 62253
  • 62259
  • 62273
  • 62274
  • 62283
  • 62293
  • 62304
  • 62313
  • 62315
  • 62316
  • 62418
  • 62446
  • 62657
  • 62790
suse
  • SUSE-SU-2015:0171
  • SUSE-SU-2015:0173
  • SUSE-SU-2015:0180
  • openSUSE-SU-2015:0077
  • openSUSE-SU-2015:0133
  • openSUSE-SU-2015:0192
  • openSUSE-SU-2015:1266
ubuntu USN-2460-1
xf firefox-cve20148639-session-hijacking(99959)
Last major update 02-01-2017 - 21:59
Published 14-01-2015 - 06:59
Last modified 07-09-2017 - 21:29
Back to Top