ID CVE-2015-0836
Summary Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
References
Vulnerable Configurations
  • Mozilla Firefox Extended Support Release (ESR) 31.0
    cpe:2.3:a:mozilla:firefox_esr:31.0
  • Mozilla Firefox Extended Support Release (ESR) 31.1
    cpe:2.3:a:mozilla:firefox_esr:31.1
  • Mozilla Firefox Extended Support Release (ESR) 31.1.1
    cpe:2.3:a:mozilla:firefox_esr:31.1.1
  • Mozilla Firefox Extended Support Release (ESR) 31.2
    cpe:2.3:a:mozilla:firefox_esr:31.2
  • Mozilla Firefox Extended Support Release (ESR) 31.3
    cpe:2.3:a:mozilla:firefox_esr:31.3
  • Mozilla Firefox Extended Support Release (ESR) 31.4
    cpe:2.3:a:mozilla:firefox_esr:31.4
  • Mozilla Firefox Extended Support Release (ESR) 31.5
    cpe:2.3:a:mozilla:firefox_esr:31.5
  • Mozilla Thunderbird 31.4
    cpe:2.3:a:mozilla:thunderbird:31.4
  • Mozilla Thunderbird 31.3
    cpe:2.3:a:mozilla:thunderbird:31.3
  • Mozilla Thunderbird 31.2
    cpe:2.3:a:mozilla:thunderbird:31.2
  • Mozilla Thunderbird 31.1.2
    cpe:2.3:a:mozilla:thunderbird:31.1.2
  • Mozilla Thunderbird 31.0
    cpe:2.3:a:mozilla:thunderbird:31.0
  • Mozilla Firefox 35.0.1
    cpe:2.3:a:mozilla:firefox:35.0.1
  • Mozilla Firefox 34.0.5
    cpe:2.3:a:mozilla:firefox:34.0.5
  • Mozilla Firefox 33.0
    cpe:2.3:a:mozilla:firefox:33.0
  • Mozilla Firefox 32.0
    cpe:2.3:a:mozilla:firefox:32.0
  • Mozilla Firefox 31.1.0
    cpe:2.3:a:mozilla:firefox:31.1.0
  • Mozilla Firefox 31.0
    cpe:2.3:a:mozilla:firefox:31.0
  • Mozilla Firefox 30.0
    cpe:2.3:a:mozilla:firefox:30.0
  • Mozilla Firefox 3.6.9
    cpe:2.3:a:mozilla:firefox:3.6.9
  • Mozilla Firefox 3.6.8
    cpe:2.3:a:mozilla:firefox:3.6.8
  • Mozilla Firefox 3.6.7
    cpe:2.3:a:mozilla:firefox:3.6.7
  • Mozilla Firefox 3.6.6
    cpe:2.3:a:mozilla:firefox:3.6.6
  • Mozilla Firefox 3.6.4
    cpe:2.3:a:mozilla:firefox:3.6.4
  • Mozilla Firefox 3.6.3
    cpe:2.3:a:mozilla:firefox:3.6.3
  • Mozilla Firefox 3.6.28
    cpe:2.3:a:mozilla:firefox:3.6.28
  • Mozilla Firefox 3.6.27
    cpe:2.3:a:mozilla:firefox:3.6.27
  • Mozilla Firefox 3.6.26
    cpe:2.3:a:mozilla:firefox:3.6.26
  • Mozilla Firefox 3.6.25
    cpe:2.3:a:mozilla:firefox:3.6.25
  • Mozilla Firefox 3.6.24
    cpe:2.3:a:mozilla:firefox:3.6.24
  • Mozilla Firefox 3.6.23
    cpe:2.3:a:mozilla:firefox:3.6.23
  • Mozilla Firefox 3.6.22
    cpe:2.3:a:mozilla:firefox:3.6.22
  • Mozilla Firefox 3.6.21
    cpe:2.3:a:mozilla:firefox:3.6.21
  • Mozilla Firefox 3.6.20
    cpe:2.3:a:mozilla:firefox:3.6.20
  • Mozilla Firefox 3.6.2
    cpe:2.3:a:mozilla:firefox:3.6.2
  • Mozilla Firefox 3.6.19
    cpe:2.3:a:mozilla:firefox:3.6.19
  • Mozilla Firefox 3.6.18
    cpe:2.3:a:mozilla:firefox:3.6.18
  • Mozilla Firefox 3.6.17
    cpe:2.3:a:mozilla:firefox:3.6.17
  • Mozilla Firefox 3.6.16
    cpe:2.3:a:mozilla:firefox:3.6.16
  • Mozilla Firefox 3.6.15
    cpe:2.3:a:mozilla:firefox:3.6.15
  • Mozilla Firefox 3.6.14
    cpe:2.3:a:mozilla:firefox:3.6.14
  • Mozilla Firefox 3.6.13
    cpe:2.3:a:mozilla:firefox:3.6.13
  • Mozilla Firefox 3.6.12
    cpe:2.3:a:mozilla:firefox:3.6.12
  • Mozilla Firefox 3.6.11
    cpe:2.3:a:mozilla:firefox:3.6.11
  • Mozilla Firefox 3.6.10
    cpe:2.3:a:mozilla:firefox:3.6.10
  • Mozilla Firefox 3.6
    cpe:2.3:a:mozilla:firefox:3.6
  • Mozilla Firefox 3.5.9
    cpe:2.3:a:mozilla:firefox:3.5.9
  • Mozilla Firefox 3.5.8
    cpe:2.3:a:mozilla:firefox:3.5.8
  • Mozilla Firefox 3.5.7
    cpe:2.3:a:mozilla:firefox:3.5.7
  • Mozilla Firefox 3.5.6
    cpe:2.3:a:mozilla:firefox:3.5.6
  • Mozilla Firefox 3.5.5
    cpe:2.3:a:mozilla:firefox:3.5.5
  • Mozilla Firefox 3.5.4
    cpe:2.3:a:mozilla:firefox:3.5.4
  • Mozilla Firefox 3.5.3
    cpe:2.3:a:mozilla:firefox:3.5.3
  • Mozilla Firefox 3.5.2
    cpe:2.3:a:mozilla:firefox:3.5.2
  • Mozilla Firefox 3.5.19
    cpe:2.3:a:mozilla:firefox:3.5.19
  • Mozilla Firefox 3.5.18
    cpe:2.3:a:mozilla:firefox:3.5.18
  • Mozilla Firefox 3.5.17
    cpe:2.3:a:mozilla:firefox:3.5.17
  • Mozilla Firefox 3.5.16
    cpe:2.3:a:mozilla:firefox:3.5.16
  • Mozilla Firefox 3.5.15
    cpe:2.3:a:mozilla:firefox:3.5.15
  • Mozilla Firefox 3.5.14
    cpe:2.3:a:mozilla:firefox:3.5.14
  • Mozilla Firefox 3.5.13
    cpe:2.3:a:mozilla:firefox:3.5.13
  • Mozilla Firefox 3.5.12
    cpe:2.3:a:mozilla:firefox:3.5.12
  • Mozilla Firefox 3.5.11
    cpe:2.3:a:mozilla:firefox:3.5.11
  • Mozilla Firefox 3.5.10
    cpe:2.3:a:mozilla:firefox:3.5.10
  • Mozilla Firefox 3.5.1
    cpe:2.3:a:mozilla:firefox:3.5.1
  • Mozilla Firefox 3.5
    cpe:2.3:a:mozilla:firefox:3.5
  • Mozilla Firefox 3.0.9
    cpe:2.3:a:mozilla:firefox:3.0.9
  • Mozilla Firefox 3.0.8
    cpe:2.3:a:mozilla:firefox:3.0.8
  • Mozilla Firefox 3.0.7
    cpe:2.3:a:mozilla:firefox:3.0.7
  • Mozilla Firefox 3.0.6
    cpe:2.3:a:mozilla:firefox:3.0.6
  • Mozilla Firefox 3.0.5
    cpe:2.3:a:mozilla:firefox:3.0.5
  • Mozilla Firefox 3.0.4
    cpe:2.3:a:mozilla:firefox:3.0.4
  • Mozilla Firefox 3.0.3
    cpe:2.3:a:mozilla:firefox:3.0.3
  • Mozilla Firefox 3.0.2
    cpe:2.3:a:mozilla:firefox:3.0.2
  • Mozilla Firefox 3.0.19
    cpe:2.3:a:mozilla:firefox:3.0.19
  • Mozilla Firefox 3.0.18
    cpe:2.3:a:mozilla:firefox:3.0.18
  • Mozilla Firefox 3.0.17
    cpe:2.3:a:mozilla:firefox:3.0.17
  • Mozilla Firefox 3.0.16
    cpe:2.3:a:mozilla:firefox:3.0.16
  • Mozilla Firefox 3.0.15
    cpe:2.3:a:mozilla:firefox:3.0.15
  • Mozilla Firefox 3.0.14
    cpe:2.3:a:mozilla:firefox:3.0.14
  • Mozilla Firefox 3.0.13
    cpe:2.3:a:mozilla:firefox:3.0.13
  • Mozilla Firefox 3.0.12
    cpe:2.3:a:mozilla:firefox:3.0.12
  • Mozilla Firefox 3.0.11
    cpe:2.3:a:mozilla:firefox:3.0.11
  • Mozilla Firefox 3.0.10
    cpe:2.3:a:mozilla:firefox:3.0.10
  • Mozilla Firefox 3.0.1
    cpe:2.3:a:mozilla:firefox:3.0.1
  • Mozilla Firefox 3.0
    cpe:2.3:a:mozilla:firefox:3.0
  • Mozilla Firefox 29.0.1
    cpe:2.3:a:mozilla:firefox:29.0.1
  • Mozilla Firefox 29.0
    cpe:2.3:a:mozilla:firefox:29.0
  • Mozilla Firefox 28.0
    cpe:2.3:a:mozilla:firefox:28.0
  • Mozilla Firefox 27.0.1
    cpe:2.3:a:mozilla:firefox:27.0.1
  • Mozilla Firefox 27.0
    cpe:2.3:a:mozilla:firefox:27.0
  • Mozilla Firefox 26.0
    cpe:2.3:a:mozilla:firefox:26.0
  • Mozilla Firefox 25.0.1
    cpe:2.3:a:mozilla:firefox:25.0.1
  • Mozilla Firefox 25.0
    cpe:2.3:a:mozilla:firefox:25.0
  • Mozilla Firefox 24.1.1
    cpe:2.3:a:mozilla:firefox:24.1.1
  • Mozilla Firefox 24.1
    cpe:2.3:a:mozilla:firefox:24.1
  • Mozilla Firefox 24.0
    cpe:2.3:a:mozilla:firefox:24.0
  • Mozilla Firefox 23.0.1
    cpe:2.3:a:mozilla:firefox:23.0.1
  • Mozilla Firefox 23.0
    cpe:2.3:a:mozilla:firefox:23.0
  • Mozilla Firefox 22.0
    cpe:2.3:a:mozilla:firefox:22.0
  • Mozilla Firefox 21.0
    cpe:2.3:a:mozilla:firefox:21.0
  • Mozilla Firefox 20.0.1
    cpe:2.3:a:mozilla:firefox:20.0.1
  • Mozilla Firefox 20.0
    cpe:2.3:a:mozilla:firefox:20.0
  • Mozilla Firefox 2.0.0.9
    cpe:2.3:a:mozilla:firefox:2.0.0.9
  • Mozilla Firefox 2.0.0.8
    cpe:2.3:a:mozilla:firefox:2.0.0.8
  • Mozilla Firefox 2.0.0.7
    cpe:2.3:a:mozilla:firefox:2.0.0.7
  • Mozilla Firefox 2.0.0.6
    cpe:2.3:a:mozilla:firefox:2.0.0.6
  • Mozilla Firefox 2.0.0.5
    cpe:2.3:a:mozilla:firefox:2.0.0.5
  • Mozilla Firefox 2.0.0.4
    cpe:2.3:a:mozilla:firefox:2.0.0.4
  • Mozilla Firefox 2.0.0.3
    cpe:2.3:a:mozilla:firefox:2.0.0.3
  • Mozilla Firefox 2.0.0.20
    cpe:2.3:a:mozilla:firefox:2.0.0.20
  • Mozilla Firefox 2.0.0.2
    cpe:2.3:a:mozilla:firefox:2.0.0.2
  • Mozilla Firefox 2.0.0.19
    cpe:2.3:a:mozilla:firefox:2.0.0.19
  • Mozilla Firefox 2.0.0.18
    cpe:2.3:a:mozilla:firefox:2.0.0.18
  • Mozilla Firefox 2.0.0.17
    cpe:2.3:a:mozilla:firefox:2.0.0.17
  • Mozilla Firefox 2.0.0.16
    cpe:2.3:a:mozilla:firefox:2.0.0.16
  • Mozilla Firefox 2.0.0.15
    cpe:2.3:a:mozilla:firefox:2.0.0.15
  • Mozilla Firefox 2.0.0.14
    cpe:2.3:a:mozilla:firefox:2.0.0.14
  • Mozilla Firefox 2.0.0.13
    cpe:2.3:a:mozilla:firefox:2.0.0.13
  • Mozilla Firefox 2.0.0.12
    cpe:2.3:a:mozilla:firefox:2.0.0.12
  • Mozilla Firefox 2.0.0.11
    cpe:2.3:a:mozilla:firefox:2.0.0.11
  • Mozilla Firefox 2.0.0.10
    cpe:2.3:a:mozilla:firefox:2.0.0.10
  • Mozilla Firefox 2.0.0.1
    cpe:2.3:a:mozilla:firefox:2.0.0.1
  • Mozilla Firefox 2.0
    cpe:2.3:a:mozilla:firefox:2.0
  • Mozilla Firefox 19.0.2
    cpe:2.3:a:mozilla:firefox:19.0.2
  • Mozilla Firefox 19.0.1
    cpe:2.3:a:mozilla:firefox:19.0.1
  • Mozilla Firefox 19.0
    cpe:2.3:a:mozilla:firefox:19.0
  • Mozilla Firefox 18.0.2
    cpe:2.3:a:mozilla:firefox:18.0.2
  • Mozilla Firefox 18.0.1
    cpe:2.3:a:mozilla:firefox:18.0.1
  • Mozilla Firefox 18.0
    cpe:2.3:a:mozilla:firefox:18.0
  • Mozilla Firefox 17.0.9
    cpe:2.3:a:mozilla:firefox:17.0.9
  • Mozilla Firefox 17.0.8
    cpe:2.3:a:mozilla:firefox:17.0.8
  • Mozilla Firefox 17.0.7
    cpe:2.3:a:mozilla:firefox:17.0.7
  • Mozilla Firefox 17.0.6
    cpe:2.3:a:mozilla:firefox:17.0.6
  • Mozilla Firefox 17.0.5
    cpe:2.3:a:mozilla:firefox:17.0.5
  • Mozilla Firefox 17.0.4
    cpe:2.3:a:mozilla:firefox:17.0.4
  • Mozilla Firefox 17.0.3
    cpe:2.3:a:mozilla:firefox:17.0.3
  • Mozilla Firefox 17.0.2
    cpe:2.3:a:mozilla:firefox:17.0.2
  • Mozilla Firefox 17.0.11
    cpe:2.3:a:mozilla:firefox:17.0.11
  • Mozilla Firefox 17.0.10
    cpe:2.3:a:mozilla:firefox:17.0.10
  • Mozilla Firefox 17.0.1
    cpe:2.3:a:mozilla:firefox:17.0.1
  • Mozilla Firefox 17.0
    cpe:2.3:a:mozilla:firefox:17.0
  • Mozilla Firefox 16.0.2
    cpe:2.3:a:mozilla:firefox:16.0.2
  • Mozilla Firefox 16.0.1
    cpe:2.3:a:mozilla:firefox:16.0.1
  • Mozilla Firefox 16.0
    cpe:2.3:a:mozilla:firefox:16.0
  • Mozilla Firefox 15.0.1
    cpe:2.3:a:mozilla:firefox:15.0.1
  • Mozilla Firefox 15.0
    cpe:2.3:a:mozilla:firefox:15.0
  • Mozilla Firefox 14.0.1
    cpe:2.3:a:mozilla:firefox:14.0.1
  • Mozilla Firefox 14.0
    cpe:2.3:a:mozilla:firefox:14.0
  • Mozilla Firefox 13.0.1
    cpe:2.3:a:mozilla:firefox:13.0.1
  • Mozilla Firefox 13.0
    cpe:2.3:a:mozilla:firefox:13.0
  • Mozilla Firefox 12.0 beta6
    cpe:2.3:a:mozilla:firefox:12.0:beta6
  • Mozilla Firefox 12.0
    cpe:2.3:a:mozilla:firefox:12.0
  • Mozilla Firefox 11.0
    cpe:2.3:a:mozilla:firefox:11.0
  • Mozilla Firefox 10.0.9
    cpe:2.3:a:mozilla:firefox:10.0.9
  • Mozilla Firefox 10.0.8
    cpe:2.3:a:mozilla:firefox:10.0.8
  • Mozilla Firefox 10.0.7
    cpe:2.3:a:mozilla:firefox:10.0.7
  • Mozilla Firefox 10.0.6
    cpe:2.3:a:mozilla:firefox:10.0.6
  • Mozilla Firefox 10.0.5
    cpe:2.3:a:mozilla:firefox:10.0.5
  • Mozilla Firefox 10.0.4
    cpe:2.3:a:mozilla:firefox:10.0.4
  • Mozilla Firefox 10.0.3
    cpe:2.3:a:mozilla:firefox:10.0.3
  • Mozilla Firefox 10.0.2
    cpe:2.3:a:mozilla:firefox:10.0.2
  • Mozilla Firefox 10.0.12
    cpe:2.3:a:mozilla:firefox:10.0.12
  • Mozilla Firefox 10.0.11
    cpe:2.3:a:mozilla:firefox:10.0.11
  • Mozilla Firefox 10.0.10
    cpe:2.3:a:mozilla:firefox:10.0.10
  • Mozilla Firefox 10.0.1
    cpe:2.3:a:mozilla:firefox:10.0.1
  • Mozilla Firefox 10.0
    cpe:2.3:a:mozilla:firefox:10.0
  • Mozilla Firefox 4.0
    cpe:2.3:a:mozilla:firefox:4.0
  • Mozilla Firefox 4.0 beta1
    cpe:2.3:a:mozilla:firefox:4.0:beta1
  • Mozilla Firefox 4.0 beta10
    cpe:2.3:a:mozilla:firefox:4.0:beta10
  • Mozilla Firefox 4.0 beta11
    cpe:2.3:a:mozilla:firefox:4.0:beta11
  • Mozilla Firefox 4.0 beta12
    cpe:2.3:a:mozilla:firefox:4.0:beta12
  • Mozilla Firefox 4.0 beta2
    cpe:2.3:a:mozilla:firefox:4.0:beta2
  • Mozilla Firefox 4.0 beta3
    cpe:2.3:a:mozilla:firefox:4.0:beta3
  • Mozilla Firefox 4.0 beta4
    cpe:2.3:a:mozilla:firefox:4.0:beta4
  • Mozilla Firefox 4.0 beta5
    cpe:2.3:a:mozilla:firefox:4.0:beta5
  • Mozilla Firefox 4.0 beta6
    cpe:2.3:a:mozilla:firefox:4.0:beta6
  • Mozilla Firefox 4.0 beta7
    cpe:2.3:a:mozilla:firefox:4.0:beta7
  • Mozilla Firefox 4.0 beta8
    cpe:2.3:a:mozilla:firefox:4.0:beta8
  • Mozilla Firefox 4.0 beta9
    cpe:2.3:a:mozilla:firefox:4.0:beta9
  • Mozilla Firefox 4.0.1
    cpe:2.3:a:mozilla:firefox:4.0.1
  • Mozilla Firefox 5.0
    cpe:2.3:a:mozilla:firefox:5.0
  • Mozilla Firefox 5.0.1
    cpe:2.3:a:mozilla:firefox:5.0.1
  • Mozilla Firefox 6.0
    cpe:2.3:a:mozilla:firefox:6.0
  • Mozilla Firefox 6.0.1
    cpe:2.3:a:mozilla:firefox:6.0.1
  • Mozilla Firefox 6.0.2
    cpe:2.3:a:mozilla:firefox:6.0.2
  • Mozilla Firefox 7.0
    cpe:2.3:a:mozilla:firefox:7.0
  • Mozilla Firefox 7.0.1
    cpe:2.3:a:mozilla:firefox:7.0.1
  • Mozilla Firefox 8.0
    cpe:2.3:a:mozilla:firefox:8.0
  • Mozilla Firefox 8.0.1
    cpe:2.3:a:mozilla:firefox:8.0.1
  • Mozilla Firefox 9.0
    cpe:2.3:a:mozilla:firefox:9.0
  • Mozilla Firefox 9.0.1
    cpe:2.3:a:mozilla:firefox:9.0.1
  • Mozilla Firefox 1.8
    cpe:2.3:a:mozilla:firefox:1.8
  • Mozilla Firefox 1.5.8
    cpe:2.3:a:mozilla:firefox:1.5.8
  • Mozilla Firefox 1.5.7
    cpe:2.3:a:mozilla:firefox:1.5.7
  • Mozilla Firefox 1.5.6
    cpe:2.3:a:mozilla:firefox:1.5.6
  • Mozilla Firefox 1.5.5
    cpe:2.3:a:mozilla:firefox:1.5.5
  • Mozilla Firefox 1.5.4
    cpe:2.3:a:mozilla:firefox:1.5.4
  • Mozilla Firefox 1.5.3
    cpe:2.3:a:mozilla:firefox:1.5.3
  • Mozilla Firefox 1.5.2
    cpe:2.3:a:mozilla:firefox:1.5.2
  • Mozilla Firefox 1.5.1
    cpe:2.3:a:mozilla:firefox:1.5.1
  • Mozilla Firefox 1.5.0.9
    cpe:2.3:a:mozilla:firefox:1.5.0.9
  • Mozilla Firefox 1.5.0.8
    cpe:2.3:a:mozilla:firefox:1.5.0.8
  • Mozilla Firefox 1.5.0.7
    cpe:2.3:a:mozilla:firefox:1.5.0.7
  • Mozilla Firefox 1.5.0.6
    cpe:2.3:a:mozilla:firefox:1.5.0.6
  • Mozilla Firefox 1.5.0.5
    cpe:2.3:a:mozilla:firefox:1.5.0.5
  • Mozilla Firefox 1.5.0.4
    cpe:2.3:a:mozilla:firefox:1.5.0.4
  • Mozilla Firefox 1.5.0.3
    cpe:2.3:a:mozilla:firefox:1.5.0.3
  • Mozilla Firefox 1.5.0.2
    cpe:2.3:a:mozilla:firefox:1.5.0.2
  • Mozilla Firefox 1.5.0.12
    cpe:2.3:a:mozilla:firefox:1.5.0.12
  • Mozilla Firefox 1.5.0.11
    cpe:2.3:a:mozilla:firefox:1.5.0.11
  • Mozilla Firefox 1.5.0.10
    cpe:2.3:a:mozilla:firefox:1.5.0.10
  • Mozilla Firefox 1.5.0.1
    cpe:2.3:a:mozilla:firefox:1.5.0.1
  • Mozilla Firefox 1.5 Beta 2
    cpe:2.3:a:mozilla:firefox:1.5:beta2
  • Mozilla Firefox 1.5 Beta 1
    cpe:2.3:a:mozilla:firefox:1.5:beta1
  • Mozilla Firefox 1.5
    cpe:2.3:a:mozilla:firefox:1.5
  • Mozilla Firefox 1.4.1
    cpe:2.3:a:mozilla:firefox:1.4.1
  • Mozilla Firefox 1.0.8
    cpe:2.3:a:mozilla:firefox:1.0.8
  • Mozilla Firefox 1.0.7
    cpe:2.3:a:mozilla:firefox:1.0.7
  • Mozilla Firefox 1.0.6
    cpe:2.3:a:mozilla:firefox:1.0.6
  • Mozilla Firefox 1.0.5
    cpe:2.3:a:mozilla:firefox:1.0.5
  • Mozilla Firefox 1.0.4
    cpe:2.3:a:mozilla:firefox:1.0.4
  • Mozilla Firefox 1.0.3
    cpe:2.3:a:mozilla:firefox:1.0.3
  • Mozilla Firefox 1.0.2
    cpe:2.3:a:mozilla:firefox:1.0.2
  • Mozilla Firefox 1.0.1
    cpe:2.3:a:mozilla:firefox:1.0.1
  • Mozilla Firefox 1.0 Preview Release
    cpe:2.3:a:mozilla:firefox:1.0:preview_release
  • Mozilla Firefox 1.0
    cpe:2.3:a:mozilla:firefox:1.0
  • Mozilla Firefox 0.9.3
    cpe:2.3:a:mozilla:firefox:0.9.3
  • Mozilla Firefox 0.9.2
    cpe:2.3:a:mozilla:firefox:0.9.2
  • Mozilla Firefox 0.9.1
    cpe:2.3:a:mozilla:firefox:0.9.1
  • Mozilla Firefox 0.9 rc
    cpe:2.3:a:mozilla:firefox:0.9:rc
  • Mozilla Firefox 0.9
    cpe:2.3:a:mozilla:firefox:0.9
  • Mozilla Firefox 0.8
    cpe:2.3:a:mozilla:firefox:0.8
  • Mozilla Firefox 0.7.1
    cpe:2.3:a:mozilla:firefox:0.7.1
  • Mozilla Firefox 0.7
    cpe:2.3:a:mozilla:firefox:0.7
  • Mozilla Firefox 0.6.1
    cpe:2.3:a:mozilla:firefox:0.6.1
  • Mozilla Firefox 0.6
    cpe:2.3:a:mozilla:firefox:0.6
  • Mozilla Firefox 0.5
    cpe:2.3:a:mozilla:firefox:0.5
  • Mozilla Firefox 0.4
    cpe:2.3:a:mozilla:firefox:0.4
  • Mozilla Firefox 0.3
    cpe:2.3:a:mozilla:firefox:0.3
  • Mozilla Firefox 0.2
    cpe:2.3:a:mozilla:firefox:0.2
  • Mozilla Firefox 0.10.1
    cpe:2.3:a:mozilla:firefox:0.10.1
  • Mozilla Firefox 0.10
    cpe:2.3:a:mozilla:firefox:0.10
  • Mozilla Firefox 0.1
    cpe:2.3:a:mozilla:firefox:0.1
CVSS
Base: 7.5 (as of 23-09-2015 - 15:21)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2505-2.NASL
    description USN-2505-1 fixed vulnerabilities in Firefox. This update removed the deprecated '-remote' command-line switch that some older software still depends on. This update fixes the problem. We apologize for the inconvenience. Matthew Noorenberghe discovered that whitelisted Mozilla domains could make UITour API calls from background tabs. If one of these domains were compromised and open in a background tab, an attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2015-0819) Jan de Mooij discovered an issue that affects content using the Caja Compiler. If web content loads specially crafted code, this could be used to bypass sandboxing security measures provided by Caja. (CVE-2015-0820) Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2015-0821) Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822) Atte Kettunen discovered a use-after-free in the OpenType Sanitiser (OTS) in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2015-0823) Atte Kettunen discovered a crash when drawing images using Cairo in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-0824) Atte Kettunen discovered a buffer underflow during playback of MP3 files in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0825) Atte Kettunen discovered a buffer overflow during CSS restyling in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0826) Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0827) A buffer overflow was discovered in libstagefright during video playback in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0829) Daniele Di Proietto discovered that WebGL could cause a crash in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-0830) Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0831) Muneaki Nishimura discovered that a period appended to a hostname could bypass key pinning and HSTS in some circumstances. A remote attacker could potentially exloit this to conduct a Man-in-the-middle (MITM) attack. (CVE-2015-0832) Alexander Kolesnik discovered that Firefox would attempt plaintext connections to servers when handling turns: and stuns: URIs. A remote attacker could potentially exploit this by conducting a Man-in-the-middle (MITM) attack in order to obtain credentials. (CVE-2015-0834) Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Christian Holler, Jesse Ruderman, Randell Jesup, Robin Whittleton, Jon Coppeard, and Nikhil Marathe discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0835, CVE-2015-0836). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 81729
    published 2015-03-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81729
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox regression (USN-2505-2)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2505-1.NASL
    description Matthew Noorenberghe discovered that whitelisted Mozilla domains could make UITour API calls from background tabs. If one of these domains were compromised and open in a background tab, an attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2015-0819) Jan de Mooij discovered an issue that affects content using the Caja Compiler. If web content loads specially crafted code, this could be used to bypass sandboxing security measures provided by Caja. (CVE-2015-0820) Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2015-0821) Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822) Atte Kettunen discovered a use-after-free in the OpenType Sanitiser (OTS) in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2015-0823) Atte Kettunen discovered a crash when drawing images using Cairo in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-0824) Atte Kettunen discovered a buffer underflow during playback of MP3 files in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0825) Atte Kettunen discovered a buffer overflow during CSS restyling in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0826) Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0827) A buffer overflow was discovered in libstagefright during video playback in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0829) Daniele Di Proietto discovered that WebGL could cause a crash in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-0830) Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0831) Muneaki Nishimura discovered that a period appended to a hostname could bypass key pinning and HSTS in some circumstances. A remote attacker could potentially exloit this to conduct a Man-in-the-middle (MITM) attack. (CVE-2015-0832) Alexander Kolesnik discovered that Firefox would attempt plaintext connections to servers when handling turns: and stuns: URIs. A remote attacker could potentially exploit this by conducting a Man-in-the-middle (MITM) attack in order to obtain credentials. (CVE-2015-0834) Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Christian Holler, Jesse Ruderman, Randell Jesup, Robin Whittleton, Jon Coppeard, and Nikhil Marathe discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0835, CVE-2015-0836). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 81544
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81544
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : firefox vulnerabilities (USN-2505-1)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_31_5_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.5. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 81520
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81520
    title Firefox ESR 31.x < 31.5 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-185.NASL
    description MozillaFirefox, mozilla-nss were updated to fix 18 security issues. MozillaFirefox was updated to version 36.0. These security issues were fixed : - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory safety hazards - CVE-2015-0832: Appended period to hostnames can bypass HPKP and HSTS protections - CVE-2015-0830: Malicious WebGL content crash when writing strings - CVE-2015-0834: TLS TURN and STUN connections silently fail to simple TCP connections - CVE-2015-0831: Use-after-free in IndexedDB - CVE-2015-0829: Buffer overflow in libstagefright during MP4 video playback - CVE-2015-0828: Double-free when using non-default memory allocators with a zero-length XHR - CVE-2015-0827: Out-of-bounds read and write while rendering SVG content - CVE-2015-0826: Buffer overflow during CSS restyling - CVE-2015-0825: Buffer underflow during MP3 playback - CVE-2015-0824: Crash using DrawTarget in Cairo graphics library - CVE-2015-0823: Use-after-free in Developer Console date with OpenType Sanitiser - CVE-2015-0822: Reading of local files through manipulation of form autocomplete - CVE-2015-0821: Local files or privileged URLs in pages can be opened into new tabs - CVE-2015-0819: UI Tour whitelisted sites in background tab can spoof foreground tabs - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass mozilla-nss was updated to version 3.17.4 to fix the following issues : - CVE-2014-1569: QuickDER decoder length issue (bnc#910647). - bmo#1084986: If an SSL/TLS connection fails, because client and server don't have any common protocol version enabled, NSS has been changed to report error code SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting SSL_ERROR_NO_CYPHER_OVERLAP). - bmo#1112461: libpkix was fixed to prefer the newest certificate, if multiple certificates match. - bmo#1094492: fixed a memory corruption issue during failure of keypair generation. - bmo#1113632: fixed a failure to reload a PKCS#11 module in FIPS mode. - bmo#1119983: fixed interoperability of NSS server code with a LibreSSL client.
    last seen 2019-02-21
    modified 2015-03-28
    plugin id 81589
    published 2015-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81589
    title openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_36.NASL
    description The version of Firefox installed on the remote Mac OS X host is prior to 36.0. It is, therefore, affected by the following vulnerabilities : - An issue exists that allows whitelisted Mozilla domains to make 'UITour' API calls while UI Tour pages are present in background tabs. This allows an attacker, via a compromised Mozilla domain, to engage in spoofing and clickjacking in any foreground tab. (CVE-2015-0819) - An issue exists related to sandbox libraries, including the Caja Compiler, which allows JavaScript objects to be marked as extensible even though the objects were initially marked as non-extensible. (CVE-2015-0820) - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821) - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823) - An issue exists in the DrawTarget() function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824) - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825) - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A double-free issue exists when sending a zero-length XmlHttpRequest (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828) - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829) - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832) - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in cleartext connections. (CVE-2015-0834) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 81518
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81518
    title Firefox < 36.0 Multiple Vulnerabilities (Mac OS X)
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_31_5.NASL
    description The version of Thunderbird installed on the remote Windows host is prior to 31.5. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 81522
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81522
    title Mozilla Thunderbird < 31.5 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_MOZILLAFIREFOX-150226.NASL
    description Mozilla Firefox has been updated to version 31.5.0 ESR to fix five security issues. These security issues have been fixed : - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.5 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (bnc#917597). (CVE-2015-0836) - Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 31.5 allowed remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic. (bnc#917597). (CVE-2015-0827) - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (bnc#917597). (CVE-2015-0835) - Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 31.5 allowed remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation. (bnc#917597). (CVE-2015-0831) - The Form Autocompletion feature in Mozilla Firefox before 31.5 allowed remote attackers to read arbitrary files via crafted JavaScript code. (bnc#917597). (CVE-2015-0822) These non-security issues have been fixed : - Reverted desktop file name back to MozillaFirefox.desktop. (bnc#916196, bnc#917100) - Obsolete subpackages of firefox-gcc47 from SLE11-SP1/2, that caused problems when upgrading to SLE11-SP3 (bnc#917300)
    last seen 2019-02-21
    modified 2015-03-28
    plugin id 81697
    published 2015-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81697
    title SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10373)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150225_FIREFOX_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Firefox implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 81540
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81540
    title Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0412-1.NASL
    description Mozilla Firefox was updated to version 31.5.0 ESR to fix five security issues. These security issues were fixed : - CVE-2015-0836: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.5 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bnc#917597). - CVE-2015-0827: Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 31.5 allowed remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic (bnc#917597). - CVE-2015-0835: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bnc#917597). - CVE-2015-0831: Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 31.5 allowed remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation (bnc#917597). - CVE-2015-0822: The Form Autocompletion feature in Mozilla Firefox before 31.5 allowed remote attackers to read arbitrary files via crafted JavaScript code (bnc#917597). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 83691
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83691
    title SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0412-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-206.NASL
    description MozillaThunderbird was updated to version 31.5.0 to fix four security issues. These security issues were fixed : - CVE-2015-0836: Miscellaneous memory safety hazards - CVE-2015-0831: Use-after-free in IndexedDB - CVE-2015-0827: Out-of-bounds read and write while rendering SVG content - CVE-2015-0822: Reading of local files through manipulation of form autocomplete
    last seen 2019-02-21
    modified 2015-03-28
    plugin id 81693
    published 2015-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81693
    title openSUSE Security Update : MozillaThunderbird (openSUSE-2015-206)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-250.NASL
    description SeaMonkey was updated to 2.33 (bnc#917597) - MFSA 2015-11/CVE-2015-0835/CVE-2015-0836 Miscellaneous memory safety hazards - MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla updater will load locally stored DLL files (Windows only) - MFSA 2015-13/CVE-2015-0832 (bmo#1065909) Appended period to hostnames can bypass HPKP and HSTS protections - MFSA 2015-14/CVE-2015-0830 (bmo#1110488) Malicious WebGL content crash when writing strings - MFSA 2015-15/CVE-2015-0834 (bmo#1098314) TLS TURN and STUN connections silently fail to simple TCP connections - MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free in IndexedDB - MFSA 2015-17/CVE-2015-0829 (bmo#1128939) Buffer overflow in libstagefright during MP4 video playback - MFSA 2015-18/CVE-2015-0828 (bmo#1030667, bmo#988675) Double-free when using non-default memory allocators with a zero-length XHR - MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds read and write while rendering SVG content - MFSA 2015-20/CVE-2015-0826 (bmo#1092363) Buffer overflow during CSS restyling - MFSA 2015-21/CVE-2015-0825 (bmo#1092370) Buffer underflow during MP3 playback - MFSA 2015-22/CVE-2015-0824 (bmo#1095925) Crash using DrawTarget in Cairo graphics library - MFSA 2015-23/CVE-2015-0823 (bmo#1098497) Use-after-free in Developer Console date with OpenType Sanitiser - MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of local files through manipulation of form autocomplete - MFSA 2015-25/CVE-2015-0821 (bmo#1111960) Local files or privileged URLs in pages can be opened into new tabs - MFSA 2015-26/CVE-2015-0819 (bmo#1079554) UI Tour whitelisted sites in background tab can spoof foreground tabs - MFSA 2015-27CVE-2015-0820 (bmo#1125398) Caja Compiler JavaScript sandbox bypass Update to SeaMonkey 2.32.1 - fixed MailNews feeds not updating - fixed selected profile in Profile Manager not remembered - fixed opening a bookmark folder in tabs on Linux - fixed Troubleshooting Information (about:support) with the Modern theme
    last seen 2019-02-21
    modified 2015-03-28
    plugin id 82013
    published 2015-03-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82013
    title openSUSE Security Update : seamonkey (openSUSE-2015-250)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_36_0.NASL
    description The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities : - An issue exists that allows whitelisted Mozilla domains to make 'UITour' API calls while UI Tour pages are present in background tabs. This allows an attacker, via a compromised Mozilla domain, to engage in spoofing and clickjacking in any foreground tab. (CVE-2015-0819) - An issue exists related to sandbox libraries, including the Caja Compiler, which allows JavaScript objects to be marked as extensible even though the objects were initially marked as non-extensible. (CVE-2015-0820) - An issue exists when opening hyperlinks on a page with the mouse and specific keyboard key combinations that allows a Chrome privileged URL to be opened without context restrictions being preserved. Additionally, the issue allows the opening of local files and resources from a known location to be opened with local privileges, bypassing security protections. (CVE-2015-0821) - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - A use-after-free error exists with the OpenType Sanitiser (OTS) when expanding macros. (CVE-2015-0823) - An issue exists in the DrawTarget() function of the Cairo graphics library that allows an attacker cause a segmentation fault, resulting in a denial of service. (CVE-2015-0824) - A buffer underflow issue exists during audio playback of invalid MP3 audio files. (CVE-2015-0825) - An out-of-bounds read issue exists while restyling and reflowing changes of web content with CSS, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0826) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A double-free issue exists when sending a zero-length XmlHttpRequest (XHR) object due to errors in memory allocation when using different memory allocator libraries than 'jemalloc'. This allows an attacker to crash the application. (CVE-2015-0828) - A buffer overflow issue exists in the 'libstagefright' library when processing invalid MP4 video files, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0829) - An unspecified issue exists that allows an attacker, via specially crafted WebGL content, to cause a denial of service condition. (CVE-2015-0830) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - An issue exists when a period is appended to a hostname that results in a bypass of the Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS) when certificate pinning is set to strict mode. An attacker can exploit this issue to perform man-in-the-middle attacks if the attacker has a security certificate for a domain with the added period. (CVE-2015-0832) - An issue exists in the Mozilla updater in which DLL files in the current working directory or Windows temporary directories will be loaded, allowing the execution of arbitrary code. Note that hosts are only affected if the updater is not run by the Mozilla Maintenance Service. (CVE-2015-0833) - An information disclosure vulnerability exists due to the lack of TLS support for connections to TURN and STUN servers, resulting in cleartext connections. (CVE-2015-0834) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 81521
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81521
    title Firefox < 36 Multiple Vulnerabilities
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_990291728253407D9D8B2CFEAB9ABF81.NASL
    description The Mozilla Project reports : MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5) MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections MFSA-2015-14 Malicious WebGL content crash when writing strings MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections MFSA-2015-16 Use-after-free in IndexedDB MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR MFSA-2015-19 Out-of-bounds read and write while rendering SVG content MFSA-2015-20 Buffer overflow during CSS restyling MFSA-2015-21 Buffer underflow during MP3 playback MFSA-2015-22 Crash using DrawTarget in Cairo graphics library MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser MFSA-2015-24 Reading of local files through manipulation of form autocomplete MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs MFSA-2015-27 Caja Compiler JavaScript sandbox bypass
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 81588
    published 2015-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81588
    title FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201504-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 82632
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82632
    title GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0265.NASL
    description Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Firefox implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.5.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.5.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81503
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81503
    title CentOS 5 / 6 / 7 : firefox (CESA-2015:0265)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0642.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81664
    published 2015-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81664
    title RHEL 7 : thunderbird (RHSA-2015:0642)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3174.NASL
    description Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code or information disclosure.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81528
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81528
    title Debian DSA-3174-1 : iceweasel - security update
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_31_5.NASL
    description The version of Thunderbird installed on the remote Mac OS X host is prior to 31.5. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 81519
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81519
    title Mozilla Thunderbird < 31.5 Multiple Vulnerabilities (Mac OS X)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_31_5_ESR.NASL
    description The version of Firefox ESR 31.x installed on the remote Mac OS X host is prior to 31.5. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists related to the autocomplete feature that allows an attacker to read arbitrary files. (CVE-2015-0822) - An out-of-bounds read and write issue exists when processing invalid SVG graphic files. This allows an attacker to disclose sensitive information. (CVE-2015-0827) - A use-after-free issue exists when running specific web content with 'IndexedDB' to create an index, resulting in a denial of service condition or arbitrary code execution. (CVE-2015-0831) - Multiple unspecified memory safety issues exist within the browser engine. (CVE-2015-0835, CVE-2015-0836)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 81517
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81517
    title Firefox ESR 31.x < 31.5 Multiple Vulnerabilities (Mac OS X)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2506-1.NASL
    description Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822) Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0827) Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-0831) Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, and Ryan VanderMeulen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-0836). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 81644
    published 2015-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81644
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : thunderbird vulnerabilities (USN-2506-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0642.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81954
    published 2015-03-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81954
    title CentOS 7 : thunderbird (CESA-2015:0642)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0266.NASL
    description From Red Hat Security Advisory 2015:0266 : An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 81538
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81538
    title Oracle Linux 6 : thunderbird (ELSA-2015-0266)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0265.NASL
    description Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Firefox implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.5.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.5.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 81506
    published 2015-02-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81506
    title RHEL 5 / 6 / 7 : firefox (RHSA-2015:0265)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0266.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81525
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81525
    title CentOS 5 / 6 : thunderbird (CESA-2015:0266)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150225_THUNDERBIRD_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 81541
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81541
    title Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-0447-1.NASL
    description Mozilla Firefox has been updated to version 31.5.0 ESR to fix five security issues. These security issues have been fixed : - CVE-2015-0836: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.5 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bnc#917597). - CVE-2015-0827: Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 31.5 allowed remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic (bnc#917597). - CVE-2015-0835: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bnc#917597). - CVE-2015-0831: Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 31.5 allowed remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation (bnc#917597). - CVE-2015-0822: The Form Autocompletion feature in Mozilla Firefox before 31.5 allowed remote attackers to read arbitrary files via crafted JavaScript code (bnc#917597). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 83692
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83692
    title SUSE SLES10 / SLES11 Security Update : Mozilla Firefox (SUSE-SU-2015:0447-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3179.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and implementation errors may lead to the execution of arbitrary code or information disclosure.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81607
    published 2015-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81607
    title Debian DSA-3179-1 : icedove - security update
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0265.NASL
    description From Red Hat Security Advisory 2015:0265 : Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Firefox implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 31.5.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 31.5.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 81537
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81537
    title Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-0265)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0266.NASL
    description An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 81539
    published 2015-02-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81539
    title RHEL 5 / 6 : thunderbird (RHSA-2015:0266)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0642.NASL
    description From Red Hat Security Advisory 2015:0642 : An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-0836, CVE-2015-0831, CVE-2015-0827) An information leak flaw was found in the way Thunderbird implemented autocomplete forms. An attacker able to trick a user into specifying a local file in the form could use this flaw to access the contents of that file. (CVE-2015-0822) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan VanderMeulen, Paul Bandha, Abhishek Arya, and Armin Razmdjou as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 81808
    published 2015-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81808
    title Oracle Linux 7 : thunderbird (ELSA-2015-0642)
redhat via4
advisories
  • bugzilla
    id 1195638
    title CVE-2015-0822 Mozilla: Reading of local files through manipulation of form autocomplete (MFSA 2015-24)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • comment firefox is earlier than 0:31.5.0-1.el5_11
        oval oval:com.redhat.rhsa:tst:20150265002
      • comment firefox is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20070097009
    • AND
      • OR
        • comment Red Hat Enterprise Linux 7 Client is installed
          oval oval:com.redhat.rhsa:tst:20140675001
        • comment Red Hat Enterprise Linux 7 Server is installed
          oval oval:com.redhat.rhsa:tst:20140675002
        • comment Red Hat Enterprise Linux 7 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20140675003
        • comment Red Hat Enterprise Linux 7 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20140675004
      • OR
        • AND
          • comment firefox is earlier than 0:31.5.0-2.el7_0
            oval oval:com.redhat.rhsa:tst:20150265008
          • comment firefox is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861010
        • AND
          • comment xulrunner is earlier than 0:31.5.0-1.el7_0
            oval oval:com.redhat.rhsa:tst:20150265010
          • comment xulrunner is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861006
        • AND
          • comment xulrunner-devel is earlier than 0:31.5.0-1.el7_0
            oval oval:com.redhat.rhsa:tst:20150265012
          • comment xulrunner-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861008
    • AND
      • comment firefox is earlier than 0:31.5.0-1.el6_6
        oval oval:com.redhat.rhsa:tst:20150265018
      • comment firefox is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100861010
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2015:0265
    released 2015-02-24
    severity Critical
    title RHSA-2015:0265: firefox security update (Critical)
  • bugzilla
    id 1195638
    title CVE-2015-0822 Mozilla: Reading of local files through manipulation of form autocomplete (MFSA 2015-24)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • comment thunderbird is earlier than 0:31.5.0-1.el5_11
        oval oval:com.redhat.rhsa:tst:20150266002
      • comment thunderbird is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20070108003
    • AND
      • comment thunderbird is earlier than 0:31.5.0-1.el6_6
        oval oval:com.redhat.rhsa:tst:20150266008
      • comment thunderbird is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100896006
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2015:0266
    released 2015-02-25
    severity Important
    title RHSA-2015:0266: thunderbird security update (Important)
  • bugzilla
    id 1195638
    title CVE-2015-0822 Mozilla: Reading of local files through manipulation of form autocomplete (MFSA 2015-24)
    oval
    AND
    • comment thunderbird is earlier than 0:31.5.0-2.el7_1
      oval oval:com.redhat.rhsa:tst:20150642005
    • comment thunderbird is signed with Red Hat redhatrelease2 key
      oval oval:com.redhat.rhsa:tst:20100896006
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    rhsa
    id RHSA-2015:0642
    released 2015-03-05
    severity Important
    title RHSA-2015:0642: thunderbird security update (Important)
rpms
  • firefox-0:31.5.0-1.el5_11
  • firefox-0:31.5.0-2.el7_0
  • xulrunner-0:31.5.0-1.el7_0
  • xulrunner-devel-0:31.5.0-1.el7_0
  • firefox-0:31.5.0-1.el6_6
  • thunderbird-0:31.5.0-1.el5_11
  • thunderbird-0:31.5.0-1.el6_6
  • thunderbird-0:31.5.0-2.el7_1
refmap via4
bid 72742
confirm
debian
  • DSA-3174
  • DSA-3179
gentoo GLSA-201504-01
sectrack
  • 1031791
  • 1031792
suse
  • SUSE-SU-2015:0412
  • SUSE-SU-2015:0446
  • SUSE-SU-2015:0447
  • openSUSE-SU-2015:0404
  • openSUSE-SU-2015:0448
  • openSUSE-SU-2015:0567
  • openSUSE-SU-2015:0570
  • openSUSE-SU-2015:1266
ubuntu
  • USN-2505-1
  • USN-2506-1
Last major update 23-12-2016 - 21:59
Published 25-02-2015 - 06:59
Back to Top