The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2754-1 advisory.

    Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, and     Cameron McCormack discovered multiple memory safety issues in Thunderbird. If a user were tricked in to     opening a specially crafted message, an attacker could potentially exploit these to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking     Thunderbird. (CVE-2015-4500)

    Khalil Zhani discovered a buffer overflow when parsing VP9 content in some circumstances. If a user were     tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2015-4506)

    A use-after-free was discovered when manipulating HTML media content in some circumstances. If a user were     tricked in to opening a specially crafted website in a browsing context, an attacker could potentially     exploit this to cause a denial of service via application crash, or execute arbitrary code with the     privileges of the user invoking Thunderbird. (CVE-2015-4509)

    Atte Kettunen discovered a buffer overflow in the nestegg library when decoding WebM format video in some     circumstances. If a user were tricked in to opening a specially crafted message, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Thunderbird. (CVE-2015-4511)

    Ronald Crane reported multiple vulnerabilities. If a user were tricked in to opening a specially crafted     website in a browsing context, an attacker could potentially exploit these to cause a denial of service     via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird.
    (CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177,     CVE-2015-7180)

    Mario Gomes discovered that dragging and dropping an image after a redirect exposes the redirected URL to     scripts. An attacker could potentially exploit this to obtain sensitive information. (CVE-2015-4519)

    Ehsan Akhgari discovered 2 issues with CORS preflight requests. An attacker could potentially exploit     these to bypass CORS restrictions. (CVE-2015-4520)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Firefox was updated to version 38.3.0 ESR (bsc#947003), fixing bugs and security issues.

  - MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous     memory safety hazards (rv:41.0 / rv:38.3)

  - MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx     while parsing vp9 format video

  - MFSA 2015-105/CVE-2015-4511 Buffer overflow while     decoding WebM video

  - MFSA 2015-106/CVE-2015-4509 Use-after-free while     manipulating HTML media content

  - MFSA 2015-110/CVE-2015-4519 Dragging and dropping images     exposes final URL after redirects

  - MFSA 2015-111/CVE-2015-4520 Errors in the handling of     CORS preflight request headers

  - MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522     CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177     CVE-2015-7180 Vulnerabilities found through code     inspection

More details can be found on https://www.mozilla.org/en-US/security/advisories/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

[Updated 25 August 2014] This erratum previously included an incorrect list of fixed issues. The issue list has been updated to reflect the CVEs that were fixed in this update. The firefox packages provided by this advisory have not been modified in any way.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4500, CVE-2015-4506, CVE-2015-4509, CVE-2015-4511, CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177, CVE-2015-7180)

Two information leak flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to disclose sensitive information or, in certain cases, crash.
(CVE-2015-4519, CVE-2015-4520)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, Cameron McCormack, Khalil Zhani, Atte Kettunen, Ronald Crane, Mario Gomes, and Ehsan Akhgari as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.3.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86293	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2754-1)	Nessus	Ubuntu Local Security Checks	2015/10/6	2024/8/27	critical
86341	SUSE SLED11 / SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1703-1)	Nessus	SuSE Local Security Checks	2015/10/12	2021/1/6	high
86514	CentOS 5 / 6 / 7 : firefox (CESA-2015:1834)	Nessus	CentOS Local Security Checks	2015/10/22	2021/1/4	high

检测

插件搜索

critical

high

high