The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

The version of Firefox installed on the remote Mac OS X host is prior to 35.0. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

MozillaThunderbird was updated to Thunderbird 31.4.0 (bnc#910669)

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous     memory safety hazards

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

The version of Firefox installed on the remote Windows host is prior to 35.0. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

  - A flaw exists in the Gecko Media Plugin which can allow     an attacker to break out of the sandbox. (CVE-2014-8643)

This update fixes the following security issues in MozillaFirefox :

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889,     bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538,     bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871,     bmo#1098583) Miscellaneous memory safety hazards     (rv:35.0 / rv:31.4)

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

Also Mozilla NSS was updated to 3.17.3 to fix :

  - The QuickDER decoder now decodes lengths robustly     (bmo#1064670/CVE-2014-1569)

  - Support for TLS_FALLBACK_SCSV has been added to the     ssltap and tstclnt utilities

  - Changes in CA certificates

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The Mozilla Project reports :

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)

MFSA-2015-02 Uninitialized memory use during bitmap rendering

MFSA-2015-03 sendBeacon requests lack an Origin header

MFSA-2015-04 Cookie injection through Proxy Authenticate responses

MFSA-2015-05 Read of uninitialized memory in Web Audio

MFSA-2015-06 Read-after-free in WebRTC

MFSA-2015-07 Gecko Media Plugin sandbox escape

MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension

MFSA-2015-09 XrayWrapper bypass through DOM objects

Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669)

  - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous     memory safety hazards

  - MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized     memory use during bitmap rendering

  - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon     requests lack an Origin header

  - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie     injection through Proxy Authenticate responses

  - MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of     uninitialized memory in Web Audio

  - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free     in WebRTC

  - MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only)     Gecko Media Plugin sandbox escape

  - MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP     responder certificates failure with id-pkix-ocsp-nocheck     extension

  - MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper     bypass through DOM objects

  - use GStreamer 1.0 from 13.2 on

The version of Thunderbird installed on the remote Mac OS X host is prior to 31.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header. This allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

The version of SeaMonkey installed on the remote host is prior to 2.32. It is, therefore, affected by the following vulnerabilities :

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2014-8634, CVE-2014-8635)

  - A flaw exists where DOM objects with some specific     properties can bypass XrayWrappers. This can allow web     content to confuse privileged code, potentially     enabling privilege escalation. (CVE-2014-8636)

  - A flaw exists in the rendering of bitmap images. When     rending a malformed bitmap image, memory may not always     be properly initialized, which can result in a leakage     of data to web content. (CVE-2014-8637)

  - A flaw exists in 'navigator.sendBeacon()' in which it     does not follow the cross-origin resource sharing     specification. This results in requests from     'sendBeacon()' lacking an 'origin' header, which allows     malicious sites to perform XSRF attacks. (CVE-2014-8638)

  - A flaw exists when receiving 407 Proxy Authentication     responses with a 'set-cookie' header. This can allow     a session-fixation attack. (CVE-2014-8639)

  - A flaw exists in Web Audio that cam allow a small block     of memory to be read. (CVE-2014-8640)

  - A read-after-free flaw exists in WebRTC due to the way     tracks are handled, which can result in a potentially     exploitable crash or incorrect WebRTC behavior.
    (CVE-2014-8641)

  - A flaw exists where delegated Online Certificate Status     Protocol responder certificates fail to recognize the     id-pkix-ocsp-nocheck extension. This can result in a     user connecting to a site with a revoked certificate.
    (CVE-2014-8642)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80522	Firefox ESR 31.x < 31.4 Multiple Vulnerabilities	Nessus	Windows	2015/1/14	2019/11/25	high
80520	Firefox < 35.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/1/14	2026/3/3	high
80993	openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2015:0133-1)	Nessus	SuSE Local Security Checks	2015/1/26	2021/1/19	high
80523	Firefox < 35 Multiple Vulnerabilities	Nessus	Windows	2015/1/14	2019/11/25	high
83666	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0076-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/6	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
80538	FreeBSD : mozilla -- multiple vulnerabilities (bd62c640-9bb9-11e4-a5ad-000c297fb80f)	Nessus	FreeBSD Local Security Checks	2015/1/15	2021/1/6	high
81142	openSUSE Security Update : seamonkey (openSUSE-SU-2015:0192-1)	Nessus	SuSE Local Security Checks	2015/2/3	2021/1/19	high
80521	Mozilla Thunderbird < 31.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2015/1/14	2019/11/25	high
80525	SeaMonkey < 2.32 Vulnerability	Nessus	Windows	2015/1/14	2019/11/25	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high