Firefox < 34.0 Multiple Vulnerabilities

High Nessus Plugin ID 79665


The remote Windows host contains a web browser that is affected by multiple vulnerabilities.


The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

- A security bypass vulnerability exists due to the 'XrayWrappers' filter not properly validating object properties. This allows a remote attacker to bypass security protection mechanisms to access protected objects. (CVE-2014-8631)

- A security bypass vulnerability exists due to Chrome Object Wrappers (COW) being passed as native interfaces.
This allows a remote attacker to access normally protected objects. (CVE-2014-8632)

- A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER.

- Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588)

- A security bypass vulnerability exists due improper declaration of chrome accessible CSS primary namespaces allowing for XML Binding Language (XBL) bindings to be triggered remotely. (CVE-2014-1589)

- A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash.

- An information disclosure vulnerability exists due to Content Security Policy (CSP) violation reports triggered by a redirect not properly removing path information which can reveal sensitive information.
Note that this only affects Firefox 33. (CVE-2014-1591)

- A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with '' function which can result in arbitrary code execution. (CVE-2014-1592)

- A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution.

- A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution.


Upgrade to Firefox 34.0 or later.

See Also

Plugin Details

Severity: High

ID: 79665

File Name: mozilla_firefox_34.nasl

Version: $Revision: 1.9 $

Type: local

Agent: windows

Family: Windows

Published: 2014/12/02

Modified: 2016/05/16

Dependencies: 20862

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Required KB Items: Mozilla/Firefox/Version

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/12/02

Vulnerability Publication Date: 2014/12/02

Reference Information

CVE: CVE-2014-1569, CVE-2014-1587, CVE-2014-1588, CVE-2014-1589, CVE-2014-1590, CVE-2014-1591, CVE-2014-1592, CVE-2014-1593, CVE-2014-1594, CVE-2014-8631, CVE-2014-8632

BID: 71391, 71392, 71393, 71395, 71396, 71397, 71398, 71399, 71556, 71560, 71675

OSVDB: 115195, 115196, 115197, 115198, 115199, 115200, 115202, 115260, 115261, 115397