Mozilla Firefox < 26.0 Multiple Vulnerabilities

critical Nessus Network Monitor Plugin ID 8070

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox earlier than 26.0 are prone to the following vulnerabilities :

- Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)
- Application Installation doorhanger does not get properly dismissed, which can be leveraged to trick a user into installing an application from one site while thinking it originated from another (CVE-2013-5611)
- Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)
- Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)
- Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)
- Binary search algorithms in the Javascript engine contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)
- Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)
- On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)
- Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)
- GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)
- Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)
- An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

Solution

Upgrade to Firefox 26.0, or later.

Plugin Details

Severity: Critical

ID: 8070

Family: Web Clients

Published: 12/16/2013

Updated: 11/6/2019

Nessus ID: 71349

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Patch Publication Date: 12/10/2012

Vulnerability Publication Date: 12/10/2012

Reference Information

CVE: CVE-2013-5609, CVE-2013-5610, CVE-2013-5611, CVE-2013-5612, CVE-2013-5613, CVE-2013-5614, CVE-2013-5615, CVE-2013-5616, CVE-2013-5618, CVE-2013-5619, CVE-2013-6671, CVE-2013-6672, CVE-2013-6673

BID: 64216, 64215, 64214, 64213, 64212, 64211, 64210, 64209, 64207, 64206, 64205, 64204, 64203

Detections

Analytics