The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2602-1 advisory.

    Jesse Ruderman, Mats Palmgren, Byron Campen, Steve Fink, Gary Kwong, Andrew McCreight, Christian Holler,     Jon Coppeard, and Milan Sreckovic discovered multiple memory safety issues in Firefox. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-2708, CVE-2015-2709)

    Atte Kettunen discovered a buffer overflow during the rendering of SVG content with certain CSS properties     in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2015-2710)

    Alex Verstak discovered that <meta name=referrer> is ignored in some circumstances. (CVE-2015-2711)

    Dougall Johnson discovered an out of bounds read and write in asm.js. If a user were tricked in to opening     a specially crafted website, an attacker could potentially exploit this to obtain sensitive information,     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-2712)

    Scott Bell discovered a use-afer-free during the processing of text when vertical text is enabled. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-2713)

    Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during shutdown. An attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2015-2715)

    Ucha Gobejishvili discovered a buffer overflow when parsing compressed XML content. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-2716)

    A buffer overflow and out-of-bounds read were discovered when parsing metadata in MP4 files in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Firefox. (CVE-2015-2717)

    Mark Hammond discovered that when a trusted page is hosted within an iframe in an untrusted page, the     untrusted page can intercept webchannel responses meant for the trusted page in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could exploit this to bypass     origin restrictions. (CVE-2015-2718)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2602-1)

critical Nessus Plugin ID 83434

Version 2.17