The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, which allows remote attackers to bypass intended DOM object restrictions via a call to an unspecified method.

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

  - An information disclosure vulnerability exists due to     the CoreGraphic framework creating log files containing     sensitive information in the '/tmp' directory.
    (CVE-2014-1595)

ID	Name	Product	Family	Severity
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
79665	Firefox < 34.0 Multiple Vulnerabilities	Nessus	Windows	high
79662	Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2014-8631

critical

Tenable Plugins

critical

high

high