Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.

Mozilla Firefox ESR version 24.4 is now patched against multiple vulnerabilities, the most critical of which include:

 - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access through TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)
 - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)
 - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)
 - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)
 - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

SeaMonkey 2.25 is now patched against multiple vulnerabilities, the most critical of which include:

  - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access throuhg TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)

  - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)

  - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)

  - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)

  - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

Versions of Mozilla Firefox prior to 28.0 have been patched against multiple vulnerabilities, the most critical of which include:

 - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access through TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)
 - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)
 - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)
 - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)
 - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

Mozilla Firefox was updated to 24.4.0ESR release, fixing various security issues and bugs :

  - Mozilla developers and community identified identified     and fixed several memory safety bugs in the browser     engine used in Firefox and other Mozilla-based products.
    Some of these bugs showed evidence of memory corruption     under certain circumstances, and we presume that with     enough effort at least some of these could be exploited     to run arbitrary code. (MFSA 2014-15)

  - Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij,     Jesse Ruderman, Dan Gohman, and Christoph Diehl reported     memory safety problems and crashes that affect Firefox     ESR 24.3 and Firefox 27. (CVE-2014-1493)

  - Gregor Wagner, Olli Pettay, Gary Kwong, Jesse Ruderman,     Luke Wagner, Rob Fletcher, and Makoto Kato reported     memory safety problems and crashes that affect Firefox     27. (CVE-2014-1494)

  - Security researcher Ash reported an issue where the     extracted files for updates to existing files are not     read only during the update process. This allows for the     potential replacement or modification of these files     during the update process if a malicious application is     present on the local system. (MFSA 2014-16 /     CVE-2014-1496)

  - Security researcher Atte Kettunen from OUSPG reported an     out of bounds read during the decoding of WAV format     audio files for playback. This could allow web content     access to heap data as well as causing a crash. (MFSA     2014-17 / CVE-2014-1497)

  - Mozilla developer David Keeler reported that the     crypto.generateCRFMRequest method did not correctly     validate the key type of the KeyParams argument when     generating ec-dual-use requests. This could lead to a     crash and a denial of service (DOS) attack. (MFSA     2014-18 / CVE-2014-1498)

  - Mozilla developer Ehsan Akhgari reported a spoofing     attack where the permission prompt for a WebRTC session     can appear to be from a different site than its actual     originating site if a timed navigation occurs during the     prompt generation. This allows an attacker to     potentially gain access to the webcam or microphone by     masquerading as another site and gaining user permission     through spoofing. (MFSA 2014-19 / CVE-2014-1499)

  - Security researchers Tim Philipp Schaefers and Sebastian     Neef, the team of Internetwache.org, reported a     mechanism using JavaScript onbeforeunload events with     page navigation to prevent users from closing a     malicious page's tab and causing the browser to become     unresponsive. This allows for a denial of service (DOS)     attack due to resource consumption and blocks the     ability of users to exit the application. (MFSA 2014-20     / CVE-2014-1500)

  - Security researcher Alex Infuehr reported that on     Firefox for Android it is possible to open links to     local files from web content by selecting 'Open Link in     New Tab' from the context menu using the file: protocol.
    The web content would have to know the precise location     of a malicious local file in order to exploit this     issue. This issue does not affect Firefox on non-Android     systems. (MFSA 2014-21 / CVE-2014-1501)

  - Mozilla developer Jeff Gilbert discovered a mechanism     where a malicious site with WebGL content could inject     content from its context to that of another site's WebGL     context, causing the second site to replace textures and     similar content. This cannot be used to steal data but     could be used to render arbitrary content in these     limited circumstances. (MFSA 2014-22 / CVE-2014-1502)

  - Security researcher Nicolas Golubovic reported that the     Content Security Policy (CSP) of data: documents was not     saved as part of session restore. If an attacker     convinced a victim to open a document from a data: URL     injected onto a page, this can lead to a Cross-Site     Scripting (XSS) attack. The target page may have a     strict CSP that protects against this XSS attack, but if     the attacker induces a browser crash with another bug,     an XSS attack would occur during session restoration,     bypassing the CSP on the site. (MFSA 2014-23 /     CVE-2014-1504)

  - Security researcher Tyson Smith and Jesse     Schwartzentruber of the BlackBerry Security Automated     Analysis Team used the Address Sanitizer tool while     fuzzing to discover an out-of-bounds read during polygon     rendering in MathML. This can allow web content to     potentially read protected memory addresses. In     combination with previous techniques used for SVG timing     attacks, this could allow for text values to be read     across domains, leading to information disclosure. (MFSA     2014-26 / CVE-2014-1508)

  - Security researcher John Thomson discovered a memory     corruption in the Cairo graphics library during font     rendering of a PDF file for display. This memory     corruption leads to a potentially exploitable crash and     to a denial of service (DOS). This issues is not able to     be triggered in a default configuration and would     require a malicious extension to be installed. (MFSA     2014-27 / CVE-2014-1509)

  - Mozilla developer Robert O'Callahan reported a mechanism     for timing attacks involving SVG filters and     displacements input to feDisplacementMap. This allows     displacements to potentially be correlated with values     derived from content. This is similar to the previously     reported techniques used for SVG timing attacks and     could allow for text values to be read across domains,     leading to information disclosure. (MFSA 2014-28 /     CVE-2014-1505)

  - Security researcher Mariusz Mlynski, via TippingPoint's     Pwn2Own contest, reported that it is possible for     untrusted web content to load a chrome-privileged page     by getting JavaScript-implemented WebIDL to call     window.open(). A second bug allowed the bypassing of the     popup-blocker without user interaction. Combined these     two bugs allow an attacker to load a JavaScript URL that     is executed with the full privileges of the browser,     which allows arbitrary code execution. (MFSA 2014-29 /     CVE-2014-1510 / CVE-2014-1511)

  - Security research firm VUPEN, via TippingPoint's Pwn2Own     contest, reported that memory pressure during Garbage     Collection could lead to memory corruption of     TypeObjects in the JS engine, resulting in an     exploitable use-after-free condition. (MFSA 2014-30 /     CVE-2014-1512)

  - Security researcher Jueri Aedla, via TippingPoint's     Pwn2Own contest, reported that TypedArrayObject does not     handle the case where ArrayBuffer objects are neutered,     setting their length to zero while still in use. This     leads to out-of-bounds reads and writes into the     JavaScript heap, allowing for arbitrary code execution.
    (MFSA 2014-31 / CVE-2014-1513)

  - Security researcher George Hotz, via TippingPoint's     Pwn2Own contest, discovered an issue where values are     copied from an array into a second, neutered array. This     allows for an out-of-bounds write into memory, causing     an exploitable crash leading to arbitrary code     execution. (MFSA 2014-32 / CVE-2014-1514)

The Mozilla Project reports :

MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)

MFSA 2014-16 Files extracted during updates are not always read only

MFSA 2014-17 Out of bounds read during WAV file decoding

MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key

MFSA 2014-19 Spoofing attack on WebRTC permission prompt

MFSA 2014-20 onbeforeunload and JavaScript navigation DOS

MFSA 2014-21 Local file access via Open Link in new tab

MFSA 2014-22 WebGL content injection from one domain to rendering in another

MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore

MFSA 2014-24 Android Crash Reporter open to manipulation

MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape

MFSA 2014-26 Information disclosure through polygon rendering in MathML

MFSA 2014-27 Memory corruption in Cairo during PDF font rendering

MFSA 2014-28 SVG filters information disclosure through feDisplacementMap

MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs

MFSA 2014-30 Use-after-free in TypeObject

MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects

MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering

The installed version of SeaMonkey is a version prior to 2.25 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An issue exists in the 'crypto.generateCRFMRequest'     method due to improper validation of the KeyParams     argument when generating 'ec-dual-use' requests.  This     could lead to a denial of service attack.
    (CVE-2014-1498)

  - An issue exists that could allow for spoofing attacks to     occur during a WebRTC session.  Exploitation of this     issue could allow an attacker to gain access to the     user's webcam or microphone. (CVE-2014-1499)

  - An issue exists with JavaScript 'onbeforeunload' events     that could lead to denial of service attacks.
    (CVE-2014-1500)

  - An issue exists where WebGL context from one website     can be injected into the WebGL context of another     website that could result in arbitrary content being     rendered from the second website. (CVE-2014-1502)

  - A cross-site scripting issue exists due to the Content     Security Policy (CSP) of 'data:' documents not being     saved for a session restore.  Under certain     circumstances, an attacker may be able to evade the CSP     of a remote website resulting in a cross-scripting     attack. (CVE-2014-1504)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which may result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Thunderbird is a version prior to 24.4 and is, therefore, potentially affected the following vulnerabilities:

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Firefox is a version prior to 28.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An issue exists in the 'crypto.generateCRFMRequest'     method due to improper validation of the KeyParams     argument when generating 'ec-dual-use' requests.  This     could lead to a denial of service attack.
    (CVE-2014-1498)

  - An issue exists that could allow for spoofing attacks to     occur during a WebRTC session.  Exploitation of this     issue could allow an attacker to gain access to the     user's webcam or microphone. (CVE-2014-1499)

  - An issue exists with JavaScript 'onbeforeunload' events     that could lead to denial of service attacks.
    (CVE-2014-1500)

  - An issue exists where WebGL context from one website     can be injected into the WebGL context of another     website that could result in arbitrary content being     rendered from the second website. (CVE-2014-1502)

  - A cross-site scripting issue exists due to the Content     Security Policy (CSP) of 'data:' documents not being     saved for a session restore.  Under certain     circumstances, an attacker may be able to evade the CSP     of a remote website resulting in a cross-scripting     attack. (CVE-2014-1504)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Firefox ESR 24.x is a version prior to 24.4.
It is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - A flaw exists in the checkHandshake() function due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2014-1495)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Thunderbird is a version prior to version 24.4. It is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Firefox is a version prior to version 28.0.
It is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An issue exists in the 'crypto.generateCRFMRequest'     method due to improper validation of the KeyParams     argument when generating 'ec-dual-use' requests.  This     could lead to a denial of service attack.
    (CVE-2014-1498)

  - An issue exists that could allow for spoofing attacks to     occur during a WebRTC session.  Exploitation of this     issue could allow an attacker to gain access to the     user's webcam or microphone. (CVE-2014-1499)

  - An issue exists with JavaScript 'onbeforeunload' events     that could lead to denial of service attacks.
    (CVE-2014-1500)

  - An issue exists where WebGL context from one website     can be injected into the WebGL context of another     website, which could result in arbitrary content being     rendered from the second website. (CVE-2014-1502)

  - A cross-site scripting issue exists due to the Content     Security Policy (CSP) of 'data:' documents not being     saved for a session restore.  Under certain     circumstances, an attacker may be able to evade the CSP     of a remote website resulting in a cross-scripting     attack. (CVE-2014-1504)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which may result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

The installed version of Firefox ESR 24.x is prior to 24.4 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist that could lead to arbitrary code     execution. (CVE-2014-1493, CVE-2014-1494)

  - A flaw exists in the checkHandshake() function due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2014-1495)     
  - An issue exists where extracted files for updates are     not read-only while updating.  An attacker may be able     to modify these extracted files resulting in privilege     escalation. (CVE-2014-1496)

  - An out-of-bounds read error exists when decoding WAV     format audio files that could lead to a denial of     service attack or information disclosure.
    (CVE-2014-1497)

  - An out-of-bounds read error exists when polygons are     rendered in 'MathML' that could lead to information     disclosure. (CVE-2014-1508)

  - A memory corruption issue exists in the Cairo graphics     library when rendering a PDF file that could lead to     arbitrary code execution or a denial of service attack.
    (CVE-2014-1509)

  - An issue exists in the SVG filters and the     feDisplacementMap element that could lead to     information disclosure via timing attacks.
    (CVE-2014-1505)

  - An issue exists that could allow malicious websites to     load chrome-privileged pages when JavaScript     implemented WebIDL calls the 'window.open()' function,     which could result in arbitrary code execution.
    (CVE-2014-1510)

  - An issue exists that could allow a malicious website to     bypass the pop-up blocker. (CVE-2014-1511)

  - A use-after-free memory issue exists in 'TypeObjects'     in the JavaScript engine during Garbage Collection     that could lead to arbitrary code execution.
    (CVE-2014-1512)

  - An out-of-bounds write error exists due to     'TypedArrayObject' improperly handling 'ArrayBuffer'     objects that could result in arbitrary code execution.
    (CVE-2014-1513)

  - An out-of-bounds write error exists when copying values     from one array to another that could result in arbitrary     code execution. (CVE-2014-1514)

ID	Name	Product	Family	Type	Severity
701243	Mozilla Firefox ESR < 24.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
8172	SeaMonkey < 2.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
8171	Mozilla Firefox < 28.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
73147	SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9049)	Nessus	SuSE Local Security Checks	Local	high
73111	FreeBSD : mozilla -- multiple vulnerabilities (610de647-af8d-11e3-a25b-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	Local	critical
73101	SeaMonkey < 2.25 Multiple Vulnerabilities	Nessus	Windows	Local	high
73100	Mozilla Thunderbird < 24.4 Multiple Vulnerabilities	Nessus	Windows	Local	high
73099	Firefox < 28.0 Multiple Vulnerabilities	Nessus	Windows	Local	high
73098	Firefox ESR 24.x < 24.4 Multiple Vulnerabilities	Nessus	Windows	Local	high
73097	Thunderbird < 24.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
73096	Firefox < 28.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
73095	Firefox ESR 24.x < 24.4 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2014-1496

medium

Tenable Plugins

high

critical

high

high

high

critical

high

high

high

high

high

high

high