Firefox ESR 31.x < 31.3 Multiple Vulnerabilities

High Nessus Plugin ID 79664


The remote Windows host contains a web browser that is affected by multiple vulnerabilities.


The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.3. It is, therefore, affected by the following vulnerabilities :

- A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER.

- Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588)

- A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash.

- A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with '' function which can result in arbitrary code execution. (CVE-2014-1592)

- A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution.

- A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution.


Upgrade to Firefox ESR 31.3 or later.

See Also

Plugin Details

Severity: High

ID: 79664

File Name: mozilla_firefox_31_3_esr.nasl

Version: $Revision: 1.8 $

Type: local

Agent: windows

Family: Windows

Published: 2014/12/02

Modified: 2016/05/16

Dependencies: 20862

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox_esr

Required KB Items: Mozilla/Firefox/Version

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/12/02

Vulnerability Publication Date: 2014/12/02

Reference Information

CVE: CVE-2014-1569, CVE-2014-1587, CVE-2014-1588, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593, CVE-2014-1594

BID: 71391, 71392, 71395, 71396, 71397, 71398, 71675

OSVDB: 115195, 115196, 115198, 115200, 115202, 115397