Mozilla Firefox was updated to version 28.0, receiving enhancements, bug and security fixes. Mozilla NSPR was updated to 4.10.4 receiving enhancements, bug and security fixes. Mozilla NSS was updated to 3.15.5 receiving enhancements, bug and security fixes.

Changes in MozillaFirefox :

  - update to Firefox 28.0 (bnc#868603)

  - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous     memory safety hazards

  - MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds     read during WAV file decoding

  - MFSA 2014-18/CVE-2014-1498 (bmo#935618)     crypto.generateCRMFRequest does not validate type of key

  - MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack     on WebRTC permission prompt

  - MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload     and JavaScript navigation DOS

  - MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content     injection from one domain to rendering in another

  - MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security     Policy for data: documents not preserved by session     restore

  - MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information     disclosure through polygon rendering in MathML

  - MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory     corruption in Cairo during PDF font rendering

  - MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters     information disclosure through feDisplacementMap

  - MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906,     bmo#982909) Privilege escalation using     WebIDL-implemented APIs

  - MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free     in TypeObject

  - MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds     read/write through neutering ArrayBuffer objects

  - MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds     write through TypedArrayObject after neutering

  - requires NSPR 4.10.3 and NSS 3.15.5

  - new build dependency (and recommends) :

  - libpulse

  - JS math correctness issue (bmo#941381)

Changes in mozilla-nspr :

  - update to version 4.10.4

  - bmo#767759: Add support for new x32 abi

  - bmo#844784: Thread data race in PR_EnterMonitor

  - bmo#939786: data race     nsprpub/pr/src/pthreads/ptthread.c:137 _pt_root

  - bmo#958796: Users of _beginthreadex that set a custom     stack size may not be getting the behavior they want

  - bmo#963033: AArch64 support update for NSPR

  - bmo#969061:&#9;Incorrect end-of-list test when iterating     over a PRCList in prcountr.c and prtrace.c

  - bmo#971152: IPv6 detection on linux depends on     availability of /proc/net/if_inet6

  - update to version 4.10.3

  - bmo#749849: ensure we'll free the thread-specific data     key.

  - bmo#941461: don't compile android with unaligned memory     access.

  - bmo#932398: Add PR_SyncMemMap, a portable version of     msync/FlushViewOfFile.

  - bmo#952621: Fix a thread-unsafe access to lock->owner in     PR_Lock.

  - bmo#957458: Fix several bugs in the lock rank checking     code.

  - bmo#936320: Use an alternative test for IPv6 support on     Linux to avoid opening a socket.

Changes in mozilla-nss :

  - update to 3.15.5

  - required for Firefox 28

  - export FREEBL_LOWHASH to get the correct default headers     (bnc#865539) New functionality

  - Added support for the TLS application layer protocol     negotiation (ALPN) extension. Two SSL socket options,     SSL_ENABLE_NPN and SSL_ENABLE_ALPN, can be used to     control whether NPN or ALPN (or both) should be used for     application layer protocol negotiation.

  - Added the TLS padding extension. The extension type     value is 35655, which may change when an official     extension type value is assigned by IANA. NSS     automatically adds the padding extension to ClientHello     when necessary.

  - Added a new macro CERT_LIST_TAIL, defined in certt.h,     for getting the tail of a CERTCertList. Notable Changes

  - bmo#950129: Improve the OCSP fetching policy when     verifying OCSP responses

  - bmo#949060: Validate the iov input argument (an array of     PRIOVec structures) of ssl_WriteV (called via     PR_Writev). Applications should still take care when     converting struct iov to PRIOVec because the iov_len     members of the two structures have different types     (size_t vs. int). size_t is unsigned and may be larger     than int.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505)

A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

After installing the update, Thunderbird must be restarted for the changes to take effect.

Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman and Christoph Diehl discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1493)

Atte Kettunen discovered an out-of-bounds read during WAV file decoding. If a user had enabled audio, an attacker could potentially exploit this to cause a denial of service via application crash.
(CVE-2014-1497)

Robert O'Callahan discovered a mechanism for timing attacks involving SVG filters and displacements input to feDisplacementMap. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1505)

Tyson Smith and Jesse Schwartzentruber discovered an out-of-bounds read during polygon rendering in MathML. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1508)

John Thomson discovered a memory corruption bug in the Cairo graphics library. If a user had a malicious extension installed, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1509)

Mariusz Mlynski discovered that web content could open a chrome privileged page and bypass the popup blocker in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1510, CVE-2014-1511)

It was discovered that memory pressure during garbage collection resulted in memory corruption in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1512)

Juri Aedla discovered out-of-bounds reads and writes with TypedArrayObject in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1513)

George Hotz discovered an out-of-bounds write with TypedArrayObject.
If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2014-1514).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Gregor Wagner, Gary Kwong, Luke Wagner, Rob Fletcher and Makoto Kato discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1493, CVE-2014-1494)

Atte Kettunen discovered an out-of-bounds read during WAV file decoding. An attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2014-1497)

David Keeler discovered that crypto.generateCRFMRequest did not correctly validate all arguments. An attacker could potentially exploit this to cause a denial of service via application crash.
(CVE-2014-1498)

Ehsan Akhgari discovered that the WebRTC permission dialog can display the wrong originating site information under some circumstances. An attacker could potentially exploit this by tricking a user in order to gain access to their webcam or microphone. (CVE-2014-1499)

Tim Philipp Schafers and Sebastian Neef discovered that onbeforeunload events used with page navigations could make the browser unresponsive in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2014-1500)

Jeff Gilbert discovered that WebGL content could manipulate content from another sites WebGL context. An attacker could potentially exploit this to conduct spoofing attacks. (CVE-2014-1502)

Nicolas Golubovic discovered that CSP could be bypassed for data:
documents during session restore. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2014-1504)

Robert O'Callahan discovered a mechanism for timing attacks involving SVG filters and displacements input to feDisplacementMap. An attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1505)

Tyson Smith and Jesse Schwartzentruber discovered an out-of-bounds read during polygon rendering in MathML. An attacker could potentially exploit this to steal confidential information across domains.
(CVE-2014-1508)

John Thomson discovered a memory corruption bug in the Cairo graphics library. If a user had a malicious extension installed, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1509)

Mariusz Mlynski discovered that web content could open a chrome privileged page and bypass the popup blocker in some circumstances. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1510, CVE-2014-1511)

It was discovered that memory pressure during garbage collection resulted in memory corruption in some circumstances. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1512)

Juri Aedla discovered out-of-bounds reads and writes with TypedArrayObject in some circumstances. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1513)

George Hotz discovered an out-of-bounds write with TypedArrayObject.
An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1514).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is a version prior to version 28.0.
It is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An issue exists in the 'crypto.generateCRFMRequest'     method due to improper validation of the KeyParams     argument when generating 'ec-dual-use' requests.  This     could lead to a denial of service attack.
    (CVE-2014-1498)

  - An issue exists that could allow for spoofing attacks to     occur during a WebRTC session.  Exploitation of this     issue could allow an attacker to gain access to the     user's webcam or microphone. (CVE-2014-1499)

  - An issue exists with JavaScript 'onbeforeunload' events     that could lead to denial of service attacks.
    (CVE-2014-1500)

  - An issue exists where WebGL context from one website     can be injected into the WebGL context of another     website, which could result in arbitrary content being     rendered from the second website. (CVE-2014-1502)

  - A cross-site scripting issue exists due to the Content     Security Policy (CSP) of 'data:' documents not being     saved for a session restore.  Under certain     circumstances, an attacker may be able to evade the CSP     of a remote website resulting in a cross-scripting     attack. (CVE-2014-1504)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which may result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Firefox is a version prior to 28.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An issue exists in the 'crypto.generateCRFMRequest'     method due to improper validation of the KeyParams     argument when generating 'ec-dual-use' requests.  This     could lead to a denial of service attack.
    (CVE-2014-1498)

  - An issue exists that could allow for spoofing attacks to     occur during a WebRTC session.  Exploitation of this     issue could allow an attacker to gain access to the     user's webcam or microphone. (CVE-2014-1499)

  - An issue exists with JavaScript 'onbeforeunload' events     that could lead to denial of service attacks.
    (CVE-2014-1500)

  - An issue exists where WebGL context from one website     can be injected into the WebGL context of another     website that could result in arbitrary content being     rendered from the second website. (CVE-2014-1502)

  - A cross-site scripting issue exists due to the Content     Security Policy (CSP) of 'data:' documents not being     saved for a session restore.  Under certain     circumstances, an attacker may be able to evade the CSP     of a remote website resulting in a cross-scripting     attack. (CVE-2014-1504)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:0316 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Thunderbird to crash or,     potentially, execute arbitrary code with the privileges of the user running     Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512,     CVE-2014-1513, CVE-2014-1514)

    Several information disclosure flaws were found in the way Thunderbird     processed malformed web content. An attacker could use these flaws to gain     access to sensitive information such as cross-domain content or protected     memory addresses or, potentially, cause Thunderbird to crash.
    (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505)

    A memory corruption flaw was found in the way Thunderbird rendered certain     PDF files. An attacker able to trick a user into installing a malicious     extension could use this flaw to crash Thunderbird or, potentially, execute     arbitrary code with the privileges of the user running Thunderbird.
    (CVE-2014-1509)

    Red Hat would like to thank the Mozilla project for reporting these issues.
    Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij,     Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith,     Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski,     Jri Aedla, George Hotz, and the security research firm VUPEN as the     original reporters of these issues.

    Note: All of the above issues cannot be exploited by a specially-crafted     HTML mail message as JavaScript is disabled by default for mail messages.
    They could be exploited another way in Thunderbird, for example, when     viewing the full remote content of an RSS feed.

    For technical details regarding these flaws, refer to the Mozilla security     advisories for Thunderbird 24.4.0. You can find a link to the Mozilla     advisories in the References section of this erratum.

    All Thunderbird users should upgrade to this updated package, which     contains Thunderbird version 24.4.0, which corrects these issues.
    After installing the update, Thunderbird must be restarted for the changes     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75307	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:0448-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/8	2021/1/11	critical
73116	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140319)	Nessus	Scientific Linux Local Security Checks	2014/3/20	2021/1/14	high
73148	Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2151-1)	Nessus	Ubuntu Local Security Checks	2014/3/22	2021/1/19	high
73092	Ubuntu 12.04 LTS / 12.10 / 13.10 : firefox vulnerabilities (USN-2150-1)	Nessus	Ubuntu Local Security Checks	2014/3/19	2021/1/19	high
73096	Firefox < 28.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/3/19	2026/3/3	high
73099	Firefox < 28.0 Multiple Vulnerabilities	Nessus	Windows	2014/3/19	2026/6/23	high
73113	RHEL 5 / 6 : thunderbird (RHSA-2014:0316)	Nessus	Red Hat Local Security Checks	2014/3/20	2025/3/20	critical

检测

插件搜索

high

critical

high

high

high

high

high

critical