Untrusted search path vulnerability in the GL tracing functionality in Mozilla Firefox before 24.0 on Android allows attackers to execute arbitrary code via a Trojan horse .so file in a world-writable directory.

Versions of Mozilla Firefox older than 24.0 contain a flaw wherein a shared object library (.so) will be optionally loaded to enable GL tracing. This library can be loaded from a world writeable location, allowing for modification or replacement by a malicious third party. Note that the flaw requires malicious software to be loaded on the device and is not accessible by web content.

The Mozilla Project reports :

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

MFSA 2013-78 Integer overflow in ANGLE library

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning

MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed

MFSA 2013-81 Use-after-free with select element

MFSA 2013-82 Calling scope for new JavaScript objects can lead to memory corruption

MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification

MFSA 2013-84 Same-origin bypass through symbolic links

MFSA 2013-85 Uninitialized data in IonMonkey

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers

MFSA 2013-87 Shared object library loading from writable location

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

MFSA 2013-90 Memory corruption involving scrolling

MFSA 2013-91 User-defined properties on DOM proxies get the wrong 'this' object

MFSA 2013-92 GC hazard with default compartments and frame chain restoration

Upstream security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Firefox earlier than version 24.0 are prone to the following vulnerabilities :

 - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)
 - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)
 - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)
 - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)
 - flaw in the NVIDIA OS X graphic drivers would allow portions of a user's desktop or other visible applications to be incorporated into WebGL canvases, leading to potential information disclosure (CVE-2013-1729)
 - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)
 - Same-origin bypass through symbolic links can allow for cross-site scripting and access to locally stored Firefox containing sensitive user data (CVE-2013-1727)
 - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)
 - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)
 - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)
 - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)
 - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)
 - An integer overflow in the Almost Native Graphics Layer Engine (ANGLE) can lead to a potentially exploitable crash (CVE-2013-1721)
 - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)  - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

ID	Name	Product	Family	Severity
8244	Mozilla Firefox for Android < 24.0 Shared Library Loading	Nessus Network Monitor	Web Clients	high
70262	FreeBSD : mozilla -- multiple vulnerabilities (7dfed67b-20aa-11e3-b8d8-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
70205	Fedora 18 : firefox-24.0-1.fc18 / xulrunner-24.0-2.fc18 (2013-17047)	Nessus	Fedora Local Security Checks	critical
70062	Fedora 20 : firefox-24.0-1.fc20 / xulrunner-24.0-2.fc20 (2013-17074)	Nessus	Fedora Local Security Checks	critical
70036	Fedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)	Nessus	Fedora Local Security Checks	critical
8010	Mozilla Firefox < 24.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2013-1731

high

Tenable Plugins

high

critical

critical

critical

critical

high