The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - An issue exists where the notification for a Web App     installation could persist from one website to another     website. This could be used by a malicious website to     trick a user into installing an application from one     website while making it appear to come from another     website. (CVE-2013-5611)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

- update to Firefox 26.0 (bnc#854367, bnc#854370)

  - rebased patches

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - removed gecko.js preference file as GStreamer is enabled     by default now

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - An issue exists where the notification for a Web App     installation could persist from one website to another     website. This could be used by a malicious website to     trick a user into installing an application from one     website while making it appear to come from another     website. (CVE-2013-5611)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

The installed version of SeaMonkey is earlier than 2.23 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

The Mozilla Project reports :

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

Mozilla Firefox has been updated to the 24.2.0 ESR security release.

This is a major upgrade from the 17 ESR release branch.

Security issues fixed :

  - Application Installation doorhanger persists on     navigation. (MFSA 2013-105). (CVE-2013-5611)

  - Miscellaneous memory safety hazards (rv:24.2). (MFSA     2013-104). (CVE-2013-5609)

  - Miscellaneous memory safety hazards (rv:26.0). (MFSA     2013-104). (CVE-2013-5610)

  - Character encoding cross-origin XSS attack. (MFSA     2013-106). (CVE-2013-5612)

  - Sandbox restrictions not applied to nested object     elements. (MFSA 2013-107). (CVE-2013-5614)

  - Use-after-free in event listeners. (MFSA 2013-108).
    (CVE-2013-5616)

  - Potential overflow in JavaScript binary search     algorithms. (MFSA 2013-110). (CVE-2013-5619)

  - Segmentation violation when replacing ordered list     elements. (MFSA 2013-111). (CVE-2013-6671)

  - Trust settings for built-in roots ignored during EV     certificate validation. (MFSA 2013-113). (CVE-2013-6673)

  - Use-after-free in synthetic mouse movement. (MFSA     2013-114). (CVE-2013-5613)

  - GetElementIC typed array stubs can be generated outside     observed typesets. (MFSA 2013-115). (CVE-2013-5615)

  - Linux clipboard information disclosure though selection     paste. (MFSA 2013-112). (CVE-2013-6672)

  - Use-after-free during Table Editing (MFSA 2013-109).
    (CVE-2013-5618)

This update fixes the following security issues with SeaMonkey :

  - update to SeaMonkey 2.23 (bnc#854370))

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - rebased patches :

  - mozilla-nongnome-proxies.patch

  - mozilla-shared-nss-db.patch

ID	Name	Product	Family	Published	Updated	Severity
71347	Firefox < 26.0 Multiple Vulnerabilities	Nessus	Windows	12/11/2013	6/23/2026	critical
75240	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1917-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
75241	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1918-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
71344	Firefox < 26.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	12/11/2013	3/3/2026	critical
71349	SeaMonkey < 2.23 Multiple Vulnerabilities	Nessus	Windows	12/11/2013	5/27/2026	critical
71452	FreeBSD : mozilla -- multiple vulnerabilities (dd116b19-64b3-11e3-868f-0025905a4771)	Nessus	FreeBSD Local Security Checks	12/16/2013	1/6/2021	critical
71560	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	12/20/2013	1/19/2021	critical
75327	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0008-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical
71559	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	12/20/2013	1/19/2021	critical
75239	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1916-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical