Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.

The remote host is affected by the vulnerability described in GLSA-201512-10 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Mozilla Thunderbird. Please review the CVE identifiers referenced below       for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of Firefox is prior to 39.0 and is affected by multiple vulnerabilities : 

 - A security downgrade vulnerability exists due to a flaw in Network Security Services (NSS). When a client allows for a ECDHE_ECDSA exchange, but the server does not send a ServerKeyExchange message, the the NSS client will take the EC key from the ECDSA certificate. A remote attacker can exploit this to silently downgrade the exchange to a non-forward secret mixed-ECDH exchange. (CVE-2015-2721) 
 - Multiple user-after-free errors exist when using an XMLHttpRequest object in concert with either shared or dedicated workers. A remote attacker can exploit this to cause a denial of service condition. (CVE-2015-2722, CVE-2015-2733) 
 - Multiple memory corruption issues exist that allow an attacker to cause a denial of service condition or potentially execute arbitrary code. (CVE-2015-2724, CVE-2015-2725) 
 - A security bypass vulnerability exists due to a failure to preserve context restrictions. A remote attacker can exploit this, via a crafted web site that is accessed with unspecified mouse and keyboard actions, to read arbitrary files or execute arbitrary JavaScript code. (CVE-2015-2727) 
 - A type confusion flaw exists in the Indexed Database Manager's handling of IDBDatabase. A remote attacker can exploit this to cause a denial of service condition or to execute arbitrary code. (CVE-2015-2728) 
 - An out-of-bounds read flaw exists in the 'AudioParamTimeline::AudioNodeInputValue()' function when computing oscillator rending ranges. An attacker can exploit this to disclose the contents of four bytes of memory or cause a denial of service condition. (CVE-2015-2729) 
 - A signature spoofing vulnerability exists due to a flaw in Network Security Services (NSS) in its Elliptic Curve Digital Signature Algorithm (ECDSA) signature validation. A remote attacker can exploit this to forge signatures. (CVE-2015-2730) 
 - A use-after-free error exists in the 'CSPService::ShouldLoad()' function when modifying the Document Object Model to remove a DOM object. An attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-2731) 
 - An uninitialized memory use issue exists in the 'CairoTextureClientD3D9::BorrowDrawTarget()' function, the '::d3d11::SetBufferData()' function, and the 'YCbCrImageDataDeserializer::ToDataSourceSurface()' function. The impact is unspecified. (CVE-2015-2734, CVE-2015-2737, CVE-2015-2738) 
 - A memory corruption issue exists in the 'nsZipArchive::GetDataOffset()' function due to improper string length checks. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2735) 
 - A memory corruption issue exists in the 'nsZipArchive::BuildFileList()' function due to improper validation of user-supplied input. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2736) 
 - An unspecified memory corruption issue exists in the 'ArrayBufferBuilder::append()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2739) 
 - A buffer overflow condition exists in the 'nsXMLHttpRequest::AppendToResponseText()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2740) 
 - A security bypass vulnerability exists due to a flaw in certificate pinning checks. Key pinning is not enforced upon encountering an X.509 certificate problem that generates a user dialog. A man-in-the-middle attacker can exploit this to bypass intended access restrictions. (CVE-2015-2741) 
 - A privilege escalation vulnerability exists in the PDF viewer (PDF.js) due to internal workers being executed insecurely. An attacker can exploit this, by leveraging a Same Origin Policy bypass, to execute arbitrary code. (CVE-2015-2743) 
 - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)

The Mozilla Project reports :

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange

The version of Firefox installed on the remote Mac OS X host is prior to 39.0. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - An information disclosure vulnerability exists due to     crash reports containing key press information.
    (CVE-2015-2742)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

ID	Name	Product	Family	Type	Severity
87710	GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)	Nessus	Gentoo Local Security Checks	Local	critical
8855	Mozilla Firefox < 39.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		critical
84780	FreeBSD : mozilla -- multiple vulnerabilities (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)	Nessus	FreeBSD Local Security Checks	Local	low
84577	Firefox < 39.0 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2015-2742

high

Tenable Plugins

critical

critical

low

critical