Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0916 advisory.

    Network Security Services (NSS) is a set of libraries designed to support     the cross-platform development of security-enabled client and server     applications. Netscape Portable Runtime (NSPR) provides platform     independence for non-GUI operating system facilities.

    A race condition was found in the way NSS verified certain certificates.
    A remote attacker could use this flaw to crash an application using NSS or,     possibly, execute arbitrary code with the privileges of the user running     that application. (CVE-2014-1544)

    Red Hat would like to thank the Mozilla project for reporting     CVE-2014-1544. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber     as the original reporters.

    Users of NSS and NSPR are advised to upgrade to these updated packages,     which correct this issue. After installing this update, applications using     NSS or NSPR must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

The version of Firefox ESR 24.x installed on the remote host is prior to 24.7. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-467:02 advisory.

    Description :
    nss     Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    nspr     NSPR provides platform independence for non-GUI operating system     facilities. These facilities include threads, thread synchronization,     normal file and network I/O, interval timing and calendar time, basic     memory management (malloc and free) and shared library linking.
    nss-util     Utilities for Network Security Services and the Softoken module     Security issues fixed with this release:
    CVE-2013-1740     The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before     3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL     servers by using an arbitrary X.509 certificate during certain handshake traffic.
    CVE-2014-1490     Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla     Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and     other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have     unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement     of a session ticket.
    CVE-2014-1491     Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR     24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly     restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to     bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
    CVE-2014-1492     The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in     Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an     internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL     servers via a crafted certificate.
    CVE-2014-1544     Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network     Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird     before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper     removal of an NSSCertificate structure from a trust domain.
    CVE-2014-1545     Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code     or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console     functions.
    enhancement;
    The nss ans nss-util package has been upgraded to upstream version 3.16.1,     and the nspr package has been upgraded to upstream version 4.10.6.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
78328	Amazon Linux AMI : nss (ALAS-2014-385)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	critical
76697	RHEL 7 : nss and nspr (RHSA-2014:0916)	Nessus	Red Hat Local Security Checks	2014/7/23	2025/4/15	high
76759	Firefox < 31.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2014/7/24	2026/3/3	critical
76762	Firefox ESR 24.x < 24.7 Multiple Vulnerabilities	Nessus	Windows	2014/7/24	2026/6/23	critical
76765	Mozilla Thunderbird < 31.0 Multiple Vulnerabilities	Nessus	Windows	2014/7/24	2019/11/26	critical
289418	MiracleLinux 4 : nss-3.16.1-4.AXS4, nss-util-3.16.1-1.AXS4,nspr-4.10.6-1.AXS4 (AXSA:2014-467:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

high

critical

critical

critical

critical