Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.

Versions of Mozilla Firefox ESR earlier than 31.3 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

seamonkey was updated to version 2.31 to fix eight security issues.

These security issues were fixed :

  - Miscellaneous memory safety hazards (CVE-2014-1587,     CVE-2014-1588).

  - XBL bindings accessible via improper CSS declarations     (CVE-2014-1589).

  - XMLHttpRequest crashes with some input streams     (CVE-2014-1590).

  - CSP leaks redirect data via violation reports     (CVE-2014-1591).

  - Use-after-free during HTML5 parsing (CVE-2014-1592).

  - Buffer overflow while parsing media content     (CVE-2014-1593).

  - Bad casting from the BasicThebesLayer to     BasicContainerLayer (CVE-2014-1594).

This non-security issue was fixed :

  - define /usr/share/myspell as additional dictionary     location and remove add-plugins.sh finally (bnc#900639).

seamonkey was updated to version 2.31 to fix 20 security issues.

These security issues were fixed :

  - Miscellaneous memory safety hazards (CVE-2014-1587,     CVE-2014-1588).

  - XBL bindings accessible via improper CSS declarations     (CVE-2014-1589).

  - XMLHttpRequest crashes with some input streams     (CVE-2014-1590).

  - CSP leaks redirect data via violation reports     (CVE-2014-1591).

  - Use-after-free during HTML5 parsing (CVE-2014-1592).

  - Buffer overflow while parsing media content     (CVE-2014-1593).

  - Bad casting from the BasicThebesLayer to     BasicContainerLayer (CVE-2014-1594).

  - Miscellaneous memory safety hazards (CVE-2014-1574,     CVE-2014-1575).

  - Buffer overflow during CSS manipulation (CVE-2014-1576).

  - Web Audio memory corruption issues with custom waveforms     (CVE-2014-1577).

  - Out-of-bounds write with WebM video (CVE-2014-1578).

  - Further uninitialized memory use during GIF rendering     (CVE-2014-1580).

  - Use-after-free interacting with text directionality     (CVE-2014-1581).

  - Key pinning bypasses (CVE-2014-1582, CVE-2014-1584).

  - Inconsistent video sharing within iframe (CVE-2014-1585,     CVE-2014-1586).

  - Accessing cross-origin objects via the Alarms API (only     relevant for installed web apps) (CVE-2014-1583).

This non-security issue was fixed :

  - define /usr/share/myspell as additional dictionary     location and remove add-plugins.sh finally (bnc#900639).

Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues.

  - Mozilla developers and community identified and fixed     several memory safety bugs in the browser engine used in     Firefox and other Mozilla-based products. Some of these     bugs showed evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587)

  - Security researcher Joe Vennix from Rapid7 reported that     passing a JavaScript object to XMLHttpRequest that     mimics an input stream will a crash. This crash is not     exploitable and can only be used for denial of service     attacks. (MFSA 2014-85 / CVE-2014-1590)

  - Security researcher Berend-Jan Wever reported a     use-after-free created by triggering the creation of a     second root element while parsing HTML written to a     document created with document.open(). This leads to a     potentially exploitable crash. (MFSA 2014-87 /     CVE-2014-1592)

  - Security researcher Abhishek Arya (Inferno) of the     Google Chrome Security Team used the Address Sanitizer     tool to discover a buffer overflow during the parsing of     media content. This leads to a potentially exploitable     crash. (MFSA 2014-88 / CVE-2014-1593)

  - Security researchers Byoungyoung Lee, Chengyu Song, and     Taesoo Kim at the Georgia Tech Information Security     Center (GTISC) reported a bad casting from the     BasicThebesLayer to BasicContainerLayer, resulting in     undefined behavior. This behavior is potentially     exploitable with some compilers but no clear mechanism     to trigger it through web content was identified. (MFSA     2014-89 / CVE-2014-1594)

  - Security researcher Kent Howard reported an Apple issue     present in OS X 10.10 (Yosemite) where log files are     created by the CoreGraphics framework of OS X in the     /tmp local directory. These log files contain a record     of all inputs into Mozilla programs during their     operation. In versions of OS X from versions 10.6     through 10.9, the CoreGraphics had this logging ability     but it was turned off by default. In OS X 10.10, this     logging was turned on by default for some applications     that use a custom memory allocator, such as jemalloc,     because of an initialization bug in the framework. This     issue has been addressed in Mozilla products by     explicitly turning off the framework's logging of input     events. On vulnerable systems, this issue can result in     private data such as usernames, passwords, and other     inputed data being saved to a log file on the local     system. (MFSA 2014-90 / CVE-2014-1595)

This MozillaFirefox update fixes several security and non security issues.

Changes in MozillaFirefox :

  - update to Firefox 34.0.5 (bnc#908009)

  - Default search engine changed to Yahoo! for North     America

  - Default search engine changed to Yandex for Belarusian,     Kazakh, and Russian locales

  - Improved search bar (en-US only)

  - Firefox Hello real-time communication client

  - Easily switch themes/personas directly in the     Customizing mode

  - Implementation of HTTP/2 (draft14) and ALPN

  - Disabled SSLv3

  - MFSA 2014-83/CVE-2014-1587/CVE-2014-1588 Miscellaneous     memory safety hazards

  - MFSA 2014-84/CVE-2014-1589 (bmo#1043787) XBL bindings     accessible via improper CSS declarations

  - MFSA 2014-85/CVE-2014-1590 (bmo#1087633) XMLHttpRequest     crashes with some input streams

  - MFSA 2014-86/CVE-2014-1591 (bmo#1069762) CSP leaks     redirect data via violation reports

  - MFSA 2014-87/CVE-2014-1592 (bmo#1088635) Use-after-free     during HTML5 parsing

  - MFSA 2014-88/CVE-2014-1593 (bmo#1085175) Buffer overflow     while parsing media content

  - MFSA 2014-89/CVE-2014-1594 (bmo#1074280) Bad casting     from the BasicThebesLayer to BasicContainerLayer

  - rebased patches

  - limit linker memory usage for %ix86

  - update to Firefox 33.1

  - Adding DuckDuckGo as a search option (upstream)

  - Forget Button added

  - Enhanced Tiles

  - Privacy tour introduced

  - fix typo in GStreamer Recommends

  - Disable elf-hack for aarch64

  - Enable EGL for aarch64

  - Limit RAM usage during link for %arm

  - Fix _constraints for ARM

  - use proper macros for ARM

  - use '--disable-optimize' not only on 32-bit x86, but on     32-bit arm too to fix compiling.

  - pass '-Wl,--no-keep-memory' to linker to reduce required     memory during linking on arm.

  - update to Firefox 33.0.2

  - Fix a startup crash with some combination of hardware     and drivers 33.0.1

  - Firefox displays a black screen at start-up with certain     graphics drivers

  - adjusted _constraints for ARM

  - added mozilla-bmo1088588.patch to fix build with EGL     (bmo#1088588)

  - define /usr/share/myspell as additional dictionary     location and remove add-plugins.sh finally (bnc#900639)

  - use Firefox default optimization flags instead of -Os

  - specfile cleanup

Versions of Mozilla Firefox earlier than 34.0 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

The Mozilla Project reports :

ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA-2014-88 Buffer overflow while parsing media content

MFSA-2014-87 Use-after-free during HTML5 parsing

MFSA-2014-86 CSP leaks redirect data via violation reports

MFSA-2014-85 XMLHttpRequest crashes with some input streams

MFSA-2014-84 XBL bindings accessible via improper CSS declarations

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)

Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas Werner, Christian Holler, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1587, CVE-2014-1588)

Cody Crews discovered a way to trigger chrome-level XBL bindings from web content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-1589)

Joe Vennix discovered a crash when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-1590)

Muneaki Nishimura discovered that CSP violation reports did not remove path information in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2014-1591)

Berend-Jan Wever discovered a use-after-free during HTML parsing. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1592)

Abhishek Arya discovered a buffer overflow when parsing media content.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1593)

Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the compositor. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause undefined behaviour, a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1594).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

  - An information disclosure vulnerability exists due to     the CoreGraphic framework creating log files containing     sensitive information in the '/tmp' directory.
    (CVE-2014-1595)

ID	Name	Product	Family	Severity
701249	Mozilla Firefox ESR < 31.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80094	openSUSE Security Update : seamonkey (openSUSE-SU-2014:1656-1)	Nessus	SuSE Local Security Checks	medium
80093	openSUSE Security Update : seamonkey (openSUSE-SU-2014:1655-1)	Nessus	SuSE Local Security Checks	high
80023	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10064)	Nessus	SuSE Local Security Checks	medium
79796	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:1581-1)	Nessus	SuSE Local Security Checks	medium
8588	Mozilla Firefox < 34.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
79707	FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)	Nessus	FreeBSD Local Security Checks	high
79688	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2424-1)	Nessus	Ubuntu Local Security Checks	critical
79665	Firefox < 34.0 Multiple Vulnerabilities	Nessus	Windows	high
79662	Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2014-1589

critical

Tenable Plugins

medium

critical

medium

high

medium

medium

medium

high

critical

high

high