Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman and Christoph Diehl discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1493)

Atte Kettunen discovered an out-of-bounds read during WAV file decoding. If a user had enabled audio, an attacker could potentially exploit this to cause a denial of service via application crash.
(CVE-2014-1497)

Robert O'Callahan discovered a mechanism for timing attacks involving SVG filters and displacements input to feDisplacementMap. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1505)

Tyson Smith and Jesse Schwartzentruber discovered an out-of-bounds read during polygon rendering in MathML. If a user had enabled scripting, an attacker could potentially exploit this to steal confidential information across domains. (CVE-2014-1508)

John Thomson discovered a memory corruption bug in the Cairo graphics library. If a user had a malicious extension installed, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1509)

Mariusz Mlynski discovered that web content could open a chrome privileged page and bypass the popup blocker in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1510, CVE-2014-1511)

It was discovered that memory pressure during garbage collection resulted in memory corruption in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1512)

Juri Aedla discovered out-of-bounds reads and writes with TypedArrayObject in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1513)

George Hotz discovered an out-of-bounds write with TypedArrayObject.
If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2014-1514).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-175:02 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and     portability.
    Security issues fixed with this release:
     CVE-2014-1493     Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR     24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a     denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown     vectors.
     CVE-2014-1497     The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before     24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive     information from process heap memory, cause a denial of service (out-of-bounds read and application     crash), or possibly have unspecified other impact via a crafted WAV file.
     CVE-2014-1505     The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird     before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-     correlation information, and possibly bypass the Same Origin Policy and read text from a different domain,     via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
     CVE-2014-1508     The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4,     Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information     from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly     bypass the Same Origin Policy via vectors involving MathML polygon rendering.
     CVE-2014-1509     Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before     28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote     attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
     CVE-2014-1510     The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird     before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with     chrome privileges by using an IDL fragment to trigger a window.open call.
     CVE-2014-1511     Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before     2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
     CVE-2014-1512     Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before     28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote     attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is     occurring.
     CVE-2014-1513     TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before     24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer     object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based     out-of-bounds write or read) via a crafted web site.
     CVE-2014-1514     vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before     24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy     operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-     bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash.
(CVE-2014-1497, CVE-2014-1508, CVE-2014-1505)

A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski, Juri Aedla, George Hotz, and the security research firm VUPEN as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum.

All Firefox users should upgrade to these updated packages, which contain Firefox version 24.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:0310 advisory.

    Mozilla Firefox is an open source web browser. XULRunner provides the XUL     Runtime environment for Mozilla Firefox.

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Firefox to crash or,     potentially, execute arbitrary code with the privileges of the user running     Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512,     CVE-2014-1513, CVE-2014-1514)

    Several information disclosure flaws were found in the way Firefox     processed malformed web content. An attacker could use these flaws to gain     access to sensitive information such as cross-domain content or protected     memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497,     CVE-2014-1508, CVE-2014-1505)

    A memory corruption flaw was found in the way Firefox rendered certain PDF     files. An attacker able to trick a user into installing a malicious     extension could use this flaw to crash Firefox or, potentially, execute     arbitrary code with the privileges of the user running Firefox.
    (CVE-2014-1509)

    Red Hat would like to thank the Mozilla project for reporting these issues.
    Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij,     Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith,     Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski,     Jri Aedla, George Hotz, and the security research firm VUPEN as the     original reporters of these issues.

    For technical details regarding these flaws, refer to the Mozilla security     advisories for Firefox 24.4.0 ESR. You can find a link to the Mozilla     advisories in the References section of this erratum.

    All Firefox users should upgrade to these updated packages, which contain     Firefox version 24.4.0 ESR, which corrects these issues. After installing     the update, Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Firefox ESR 24.x is prior to 24.4 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - A flaw exists in the checkHandshake() function due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2014-1495)     
  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Thunderbird is a version prior to 24.4 and is, therefore, potentially affected the following vulnerabilities:

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514)

Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash.
(CVE-2014-1497, CVE-2014-1508, CVE-2014-1505)

A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509)

After installing the update, Firefox must be restarted for the changes to take effect.

Mozilla Thunderbird was updated to 24.4.0. Mozilla SeaMonkey was updated to 2.25.

  - MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous     memory safety hazards

  - MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds     read during WAV file decoding

  - MFSA 2014-18/CVE-2014-1498 (bmo#935618)     crypto.generateCRMFRequest does not validate type of key

  - MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack     on WebRTC permission prompt

  - MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload     and JavaScript navigation DOS

  - MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content     injection from one domain to rendering in another

  - MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security     Policy for data: documents not preserved by session     restore

  - MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information     disclosure through polygon rendering in MathML

  - MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory     corruption in Cairo during PDF font rendering

  - MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters     information disclosure through feDisplacementMap

  - MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906,     bmo#982909) Privilege escalation using     WebIDL-implemented APIs

  - MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free     in TypeObject

  - MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds     read/write through neutering ArrayBuffer objects

  - MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds     write through TypedArrayObject after neutering

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
73148	Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2151-1)	Nessus	Ubuntu Local Security Checks	2014/3/22	2021/1/19	high
289190	MiracleLinux 4 : firefox-24.4.0-1.0.1.AXS4 (AXSA:2014-175:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	critical
73084	CentOS 5 / 6 : firefox (CESA-2014:0310)	Nessus	CentOS Local Security Checks	2014/3/19	2021/1/4	critical
73090	RHEL 6 : firefox (RHSA-2014:0310)	Nessus	Red Hat Local Security Checks	2014/3/19	2025/4/15	critical
73095	Firefox ESR 24.x < 24.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/3/19	2026/3/3	high
73100	Mozilla Thunderbird < 24.4 Multiple Vulnerabilities	Nessus	Windows	2014/3/19	2018/7/16	high
73114	Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20140318)	Nessus	Scientific Linux Local Security Checks	2014/3/20	2021/1/14	high
75333	openSUSE Security Update : MozillaThunderbird / seamonkey (openSUSE-SU-2014:0584-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	high

检测

插件搜索

high

critical

critical

critical

high

high

high

high