Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Versions of Mozilla Firefox ESR earlier than 24.7 are unpatched for the following vulnerabilities :

 - An exploitable crash when using the Cesium JavaScript library to generate WebGL content could be leveraged to execute arbitrary code (CVE-2014-1556)
 - A potentially exploitable crash when scaling high quality images, due to image data being discarded while in use by the scaling operation (CVE-2014-1557)
 - Use-after-free errors when handling certificates in the trusted cache, triggering a FireOnStateChang event in certain circumstances, when rendering MathML content in DirectWrite handling certain fonts, and buffering Web Audio playback can be leveraged to crash the application and, in some cases, execute arbitrary code (CVE-2014-1544, CVE-2014-1555, CVE-2014-1551, CVE-2014-1550)
 - Bypass of the iframe element sandbox via network-level redirects, which can allow unauthorized access to content without explicit approval (CVE-2014-1552)
 - Issues with parsing SSL certificates when non-standard characters are present, which can lead to a potential inability to use valid SSL certificates (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)
 - Potentially exploitable buffer overflow when interacting with Web Audio buffer for playback, due to an error in the amount of memory allocated for buffers (CVE-2014-1549)
 - Other miscellaneous memory issues that have since been fixed (CVE-2014-1547, CVE-2014-1548)

Versions of Mozilla Firefox ESR prior to version 24.7 are unpatched for the following vulnerabilities :

 - An exploitable crash when using the Cesium JavaScript library to generate WebGL content could be leveraged to execute arbitrary code (CVE-2014-1556)
 - A potentially exploitable crash when scaling high quality images, due to image data being discarded while in use by the scaling operation (CVE-2014-1557)
 - Use-after-free errors when handling certificates in the trusted cache, triggering a FireOnStateChang event in certain circumstances, when rendering MathML content in DirectWrite handling certain fonts, and buffering Web Audio playback can be leveraged to crash the application and, in some cases, execute arbitrary code (CVE-2014-1544, CVE-2014-1555, CVE-2014-1551, CVE-2014-1550)
 - Bypass of the iframe element sandbox via network-level redirects, which can allow unauthorized access to content without explicit approval (CVE-2014-1552)
 - Issues with parsing SSL certificates when non-standard characters are present, which can lead to a potential inability to use valid SSL certificates (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)
 - Potentially exploitable buffer overflow when interacting with Web Audio buffer for playback, due to an error in the amount of memory allocated for buffers (CVE-2014-1549)
 - Other miscellaneous memory issues that have since been fixed (CVE-2014-1547, CVE-2014-1548)

While most of these vulnerabilities are browser-oriented, Thunderbird's built-in browser capabilities may be susceptible vectors for attack.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

Mozilla Firefox has been updated to the 24.7ESR security release.

Security issues fixed in this release :

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     63.html. (CVE-2014-1544)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     56.html. (CVE-2014-1548)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     57.html. (CVE-2014-1549)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     58.html. (CVE-2014-1550)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     59.html. (CVE-2014-1551)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     66.html. (CVE-2014-1552)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     61.html. (CVE-2014-1555)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     62.html. (CVE-2014-1556)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     64.html. (CVE-2014-1557)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     65.html. (CVE-2014-1558 / CVE-2014-1559 / CVE-2014-1560)

  -     https://www.mozilla.org/security/announce/2014/mfsa2014-     60.html. (CVE-2014-1561)

MozillaFirefox was updated to version 31 to fix various security issues and bugs :

  - MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous     memory safety hazards

  - MFSA 2014-57/CVE-2014-1549 (bmo#1020205) Buffer overflow     during Web Audio buffering for playback

  - MFSA 2014-58/CVE-2014-1550 (bmo#1020411) Use-after-free     in Web Audio due to incorrect control message ordering

  - MFSA 2014-60/CVE-2014-1561 (bmo#1000514, bmo#910375)     Toolbar dialog customization event spoofing

  - MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free     with FireOnStateChange event

  - MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable     WebGL crash with Cesium JavaScript library

  - MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free     while when manipulating certificates in the trusted     cache (solved with NSS 3.16.2 requirement)

  - MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia     library when scaling high quality images

  - MFSA 2014-65/CVE-2014-1558/CVE-2014-1559/CVE-2014-1560     (bmo#1015973, bmo#1026022, bmo#997795) Certificate     parsing broken by non-standard character encoding

  - MFSA 2014-66/CVE-2014-1552 (bmo#985135) IFRAME sandbox     same-origin access through redirect

Mozilla-nss was updated to 3.16.3: New Functions :

  - CERT_GetGeneralNameTypeFromString (This function was     already added in NSS 3.16.2, however, it wasn't declared     in a public header file.) Notable Changes :

  - The following 1024-bit CA certificates were removed

  - Entrust.net Secure Server Certification Authority

  - GTE CyberTrust Global Root

  - ValiCert Class 1 Policy Validation Authority

  - ValiCert Class 2 Policy Validation Authority

  - ValiCert Class 3 Policy Validation Authority

  - Additionally, the following CA certificate was removed     as requested by the CA :

  - TDC Internet Root CA

  - The following CA certificates were added :

  - Certification Authority of WoSign

  - CA &#x6C83;&#x901A;&#x6839;&#x8BC1;&#x4E66;

  - DigiCert Assured ID Root G2

  - DigiCert Assured ID Root G3

  - DigiCert Global Root G2

  - DigiCert Global Root G3

  - DigiCert Trusted Root G4

  - QuoVadis Root CA 1 G3

  - QuoVadis Root CA 2 G3

  - QuoVadis Root CA 3 G3

  - The Trust Bits were changed for the following CA     certificates

  - Class 3 Public Primary Certification Authority

  - Class 3 Public Primary Certification Authority

  - Class 2 Public Primary Certification Authority - G2

  - VeriSign Class 2 Public Primary Certification Authority
    - G3

  - AC Ra&iacute;z Certic&aacute;mara S.A.

  - NetLock Uzleti (Class B) Tanusitvanykiado

  - NetLock Expressz (Class C) Tanusitvanykiado changes in     3.16.2 New functionality :

  - DTLS 1.2 is supported.

  - The TLS application layer protocol negotiation (ALPN)     extension is also supported on the server side.

  - RSA-OEAP is supported. Use the new PK11_PrivDecrypt and     PK11_PubEncrypt functions with the CKM_RSA_PKCS_OAEP     mechanism.

  - New Intel AES assembly code for 32-bit and 64-bit     Windows, contributed by Shay Gueron and Vlad Krasnov of     Intel. Notable Changes :

  - The btoa command has a new command-line option -w     suffix, which causes the output to be wrapped in     BEGIN/END lines with the given suffix

  - The certutil commands supports additionals types of     subject alt name extensions.

  - The certutil command supports generic certificate     extensions, by loading binary data from files, which     have been prepared using external tools, or which have     been extracted from other existing certificates and     dumped to file.

  - The certutil command supports three new certificate     usage specifiers.

  - The pp command supports printing UTF-8 (-u).

  - On Linux, NSS is built with the -ffunction-sections
    -fdata-sections compiler flags and the --gc-sections     linker flag to allow unused functions to be discarded.
    changes in 3.16.1 New functionality :

  - Added the 'ECC' flag for modutil to select the module     used for elliptic curve cryptography (ECC) operations.
    New Macros

  - PUBLIC_MECH_ECC_FLAG a public mechanism flag for     elliptic curve cryptography (ECC) operations

  - SECMOD_ECC_FLAG an NSS-internal mechanism flag for     elliptic curve cryptography (ECC) operations. This macro     has the same numeric value as PUBLIC_MECH_ECC_FLAG.
    Notable Changes :

  - Imposed name constraints on the French government root     CA ANSSI (DCISS).

Versions of Mozilla Thunderbird prior to 31.0 are unpatched for the following vulnerabilities :

 - An exploitable crash when using the Cesium JavaScript library to generate WebGL content could be leveraged to execute arbitrary code (CVE-2014-1556)
 - A potentially exploitable crash when scaling high quality images, due to image data being discarded while in use by the scaling operation (CVE-2014-1557)
 - Use-after-free errors when handling certificates in the trusted cache, triggering a FireOnStateChang event in certain circumstances, when rendering MathML content in DirectWrite handling certain fonts, and buffering Web Audio playback can be leveraged to crash the application and, in some cases, execute arbitrary code (CVE-2014-1544, CVE-2014-1555, CVE-2014-1551, CVE-2014-1550)
 - Bypass of the iframe element sandbox via network-level redirects, which can allow unauthorized access to content without explicit approval (CVE-2014-1552)
 - Issues with parsing SSL certificates when non-standard characters are present, which can lead to a potential inability to use valid SSL certificates (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)
 - Potentially exploitable buffer overflow when interacting with Web Audio buffer for playback, due to an error in the amount of memory allocated for buffers (CVE-2014-1549)
 - Other miscellaneous memory issues that have since been fixed (CVE-2014-1547, CVE-2014-1548)

While most of these vulnerabilities are browser-oriented, Thunderbird's built-in browser capabilities may be susceptible vectors for attack.

Versions of Mozilla Firefox earlier than 31.0 are unpatched for the following vulnerabilities :

 - An exploitable crash when using the Cesium JavaScript library to generate WebGL content could be leveraged to execute arbitrary code (CVE-2014-1556)
 - A potentially exploitable crash when scaling high quality images, due to image data being discarded while in use by the scaling operation (CVE-2014-1557)
 - Use-after-free errors when handling certificates in the trusted cache, triggering a FireOnStateChang event in certain circumstances, when rendering MathML content in DirectWrite handling certain fonts, and buffering Web Audio playback can be leveraged to crash the application and, in some cases, execute arbitrary code (CVE-2014-1544, CVE-2014-1555, CVE-2014-1551, CVE-2014-1550)
 - Bypass of the iframe element sandbox via network-level redirects, which can allow unauthorized access to content without explicit approval (CVE-2014-1552)
 - Issues with parsing SSL certificates when non-standard characters are present, which can lead to a potential inability to use valid SSL certificates (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)
 - Potentially exploitable buffer overflow when interacting with Web Audio buffer for playback, due to an error in the amount of memory allocated for buffers (CVE-2014-1549)
 - Other miscellaneous memory issues that have since been fixed (CVE-2014-1547, CVE-2014-1548)

The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is a potential use-after-free issue in     DirectWrite font handling. This may allow an attacker     to potentially execute arbitrary code within the context     of the user running the application. (CVE-2014-1551)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities :

  - When a pair of NSSCertificate structures are added to a     trust domain and then one of them is removed during use,     a use-after-free error occurs which may cause the     application to crash. This crash is potentially     exploitable. (CVE-2014-1544)

  - There are multiple memory safety hazards within the     browser engine. These hazards may lead to memory     corruption vulnerabilities, which may allow attackers     to execute arbitrary code. (CVE-2014-1547,     CVE-2014-1548)

  - A buffer overflow exists when interacting with the Web     Audio buffer during playback due to an error with the     allocation of memory for the buffer. This may lead to     a potentially exploitable crash. (CVE-2014-1549)

  - A use-after-free exists in Web Audio due to the way     control messages are handled. This may lead to a     potentially exploitable crash. (CVE-2014-1550)

  - There is an issue with the IFRAME sandbox same-origin     access policy which allows sandboxed content to access     other content from the same origin without approval.
    This may lead to a same-origin-bypass vulnerability.
    (CVE-2014-1552)

  - Triggering the FireOnStateChange event has the     potential to crash the application. This may lead to     a use-after-free and an exploitable crash.
    (CVE-2014-1555)

  - When using the Cesium JavaScript library to generate     WebGL content, the application may crash. This crash     is potentially exploitable. (CVE-2014-1556)

  - There is a flaw in the Skia library when scaling images     of high quality. If the image data is discarded while     being processed, the library may crash. This crash     is potentially exploitable. (CVE-2014-1557)

  - There are multiple issues with using invalid     characters in various certificates. These invalid     characters may cause certificates to be parsed     incorrectly which may lead to the inability to use     valid SSL certificates. (CVE-2014-1558, CVE-2014-1559,     CVE-2014-1560)

  - It may be possible to spoof drag and drop events in     web content. This may allow limited ability to interact     with the UI. (CVE-2014-1561)

The Mozilla Project reports :

MFSA 2014-66 IFRAME sandbox same-origin access through redirect

MFSA 2014-65 Certificate parsing broken by non-standard character encoding

MFSA 2014-64 Crash in Skia library when scaling high quality images

MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache

MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library

MFSA 2014-61 Use-after-free with FireOnStateChange event

MFSA 2014-60 Toolbar dialog customization event spoofing

MFSA 2014-59 Use-after-free in DirectWrite font handling

MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering

MFSA 2014-57 Buffer overflow during Web Audio buffering for playback

MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)

Christian Holler, David Keeler and Byron Campen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1547)

Atte Kettunen discovered a buffer overflow when interacting with WebAudio buffers. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1549)

Atte Kettunen discovered a use-after-free in WebAudio. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1550)

Jethro Beekman discovered a use-after-free when the FireOnStateChange event is triggered in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Thunderbird. (CVE-2014-1555)

Patrick Cozzi discovered a crash when using the Cesium JS library to generate WebGL content. If a user had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the privilges of the user invoking Thunderbird. (CVE-2014-1556)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in CERT_DestroyCertificate. If a user had enabled scripting, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1544)

A crash was discovered in Skia when scaling an image, if the scaling operation takes too long. If a user had enabled scripting, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1557)

Christian Holler discovered several issues when parsing certificates with non-standard character encoding, resulting in the inability to use valid SSL certificates in some circumstances. (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)

Boris Zbarsky discovered that network redirects could cause an iframe to escape the confinements defined by its sandbox attribute in some circumstances. If a user had enabled scripting, an attacker could potentially exploit this to conduct cross-site scripting attacks.
(CVE-2014-1552).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christian Holler, David Keeler, Byron Campen, Gary Kwong, Jesse Ruderman, Andrew McCreight, Alon Zakai, Bobby Holley, Jonathan Watt, Shu-yu Guo, Steve Fink, Terrence Cole, Gijs Kruitbosch and Catalin Badea discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1547, CVE-2014-1548)

Atte Kettunen discovered a buffer overflow when interacting with WebAudio buffers. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1549)

Atte Kettunen discovered a use-after-free in WebAudio. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1550)

David Chan and Gijs Kruitbosch discovered that web content could spoof UI customization events in some circumstances, resulting in a limited ability to move UI icons. (CVE-2014-1561)

Jethro Beekman discovered a use-after-free when the FireOnStateChange event is triggered in some circumstances. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2014-1555)

Patrick Cozzi discovered a crash when using the Cesium JS library to generate WebGL content. An attacker could potentially exploit this to execute arbitrary code with the privilges of the user invoking Firefox. (CVE-2014-1556)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in CERT_DestroyCertificate. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1544)

A crash was discovered in Skia when scaling an image, if the scaling operation takes too long. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1557)

Christian Holler discovered several issues when parsing certificates with non-standard character encoding, resulting in the inability to use valid SSL certificates in some circumstances. (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560)

Boris Zbarsky discovered that network redirects could cause an iframe to escape the confinements defined by its sandbox attribute in some circumstances. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2014-1552).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
701246	Mozilla Firefox ESR < 24.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
701240	Mozilla Firefox ESR < 24.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
76990	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9569)	Nessus	SuSE Local Security Checks	critical
76989	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9569)	Nessus	SuSE Local Security Checks	critical
76959	openSUSE Security Update : MozillaFirefox (openSUSE-2014-476)	Nessus	SuSE Local Security Checks	critical
8339	Mozilla Thunderbird < 31.0 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
8333	Mozilla Firefox < 31.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
76765	Mozilla Thunderbird < 31.0 Multiple Vulnerabilities	Nessus	Windows	critical
76763	Firefox < 31.0 Multiple Vulnerabilities	Nessus	Windows	critical
76761	Mozilla Thunderbird < 31.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
76759	Firefox < 31.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
76720	FreeBSD : mozilla -- multiple vulnerabilities (978b0f76-122d-11e4-afe3-bc5ff4fb5e7b)	Nessus	FreeBSD Local Security Checks	critical
76706	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2296-1)	Nessus	Ubuntu Local Security Checks	high
76705	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2295-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2014-1550

critical

Tenable Plugins

high

high

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

high

high