Firefox < 34.0 Multiple Vulnerabilities

high Nessus Plugin ID 79665


The remote Windows host contains a web browser that is affected by multiple vulnerabilities.


The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

- A security bypass vulnerability exists due to the 'XrayWrappers' filter not properly validating object properties. This allows a remote attacker to bypass security protection mechanisms to access protected objects. (CVE-2014-8631)

- A security bypass vulnerability exists due to Chrome Object Wrappers (COW) being passed as native interfaces.
This allows a remote attacker to access normally protected objects. (CVE-2014-8632)

- A remote code execution vulnerability exists in Mozilla Network Security Services (NSS) due to a flaw in 'quickder.c' that is triggered when handling PKCS#1 signatures during the decoding of ASN.1 DER.

- Multiple memory safety flaws exist within the browser engine. Exploiting these, an attacker can cause a denial of service or execute arbitrary code. (CVE-2014-1587, CVE-2014-1588)

- A security bypass vulnerability exists due improper declaration of chrome accessible CSS primary namespaces allowing for XML Binding Language (XBL) bindings to be triggered remotely. (CVE-2014-1589)

- A denial of service vulnerability exists due to improper parsing of a JavaScript object to the XMLHttpRequest API which can result in a crash.

- An information disclosure vulnerability exists due to Content Security Policy (CSP) violation reports triggered by a redirect not properly removing path information which can reveal sensitive information.
Note that this only affects Firefox 33. (CVE-2014-1591)

- A use-after-free error exists due the creation of a second XML root element when parsing HTML written to a document created with '' function which can result in arbitrary code execution. (CVE-2014-1592)

- A buffer overflow vulnerability exists in the 'mozilla::FileBlockCache::Read' function when parsing media which can result in arbitrary code execution.

- A casting error exists when casting from the 'BasicThebesLayer' layer to the 'BasicContainerLayer' layer which can result in arbitrary code execution.


Upgrade to Firefox 34.0 or later.

See Also

Plugin Details

Severity: High

ID: 79665

File Name: mozilla_firefox_34.nasl

Version: 1.11

Type: local

Agent: windows

Family: Windows

Published: 12/2/2014

Updated: 11/25/2019

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2014-1569

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Required KB Items: Mozilla/Firefox/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 12/2/2014

Vulnerability Publication Date: 12/2/2014

Reference Information

CVE: CVE-2014-1569, CVE-2014-1587, CVE-2014-1588, CVE-2014-1589, CVE-2014-1590, CVE-2014-1591, CVE-2014-1592, CVE-2014-1593, CVE-2014-1594, CVE-2014-8631, CVE-2014-8632

BID: 71675, 71391, 71395, 71396, 71397, 71398, 71392, 71393, 71399, 71556, 71560