Mozilla 项目报告：

MFSA 2014-15 多项内存安全危害 (rv:28.0 / rv:24.4)

MFSA 2014-16 更新期间提取的文件不一定是只读

MFSA 2014-17 WAV 文件解码期间的越界读取

MFSA 2014-18 crypto.generateCRMFRequest 不验证密钥类型

MFSA 2014-19 对 WebRTC 权限提示的欺骗攻击

MFSA 2014-20 onbeforeunload 和 JavaScript 导航 DOS

MFSA 2014-21 通过新选项卡中的 Open Link 访问文件

MFSA 2014-22 WebGL 内容从一个域注入到另一个域中进行渲染

MFSA 2014-23 数据的内容安全策略：会话恢复时不保留文档

MFSA 2014-24 Android Crash Reporter 开放操纵

MFSA 2014-25 Firefox OS DeviceStorageFile 对象易受相对路径逃逸攻击

MFSA 2014-26 通过 MathML 中渲染多边形泄露信息

MFSA 2014-27 渲染 PDF 字体期间 Cairo 中内存损坏

MFSA 2014-28 通过 feDisplacementMap 泄露 SVG 过滤器信息

MFSA 2014-29 使用 WebIDL 实现的 API 进行权限升级

MFSA 2014-30 TypeObject 中的释放后使用

MFSA 2014-31 通过中立 ArrayBuffer 对象进行越界读取/写入

MFSA 2014-32 中立后通过 TypedArrayObject 进行越界写入

Mozilla Thunderbird 已更新到 24.4.0。Mozilla SeaMonkey 已更新到 2.25。

- MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 多项内存安全危害

- MFSA 2014-17/CVE-2014-1497 (bmo#966311) 解码 WAV 文件期间发生越界读取

- MFSA 2014-18/CVE-2014-1498 (bmo#935618) crypto.generateCRMFRequest 不验证密钥的类型

- MFSA 2014-19/CVE-2014-1499 (bmo#961512) 对 WebRTC 权限提示的欺骗攻击

- MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload 和 JavaScript 导航 DOS

- MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL 内容从一个域注入到另一个域中进行渲染

- MFSA 2014-23/CVE-2014-1504 (bmo#911547) 数据的内容安全策略：会话恢复时不保留文档

- MFSA 2014-26/CVE-2014-1508 (bmo#963198) 通过 MathML 中渲染多边形泄露信息

- MFSA 2014-27/CVE-2014-1509 (bmo#966021) 渲染 PDF 字体期间 Cairo 中内存损坏

- MFSA 2014-28/CVE-2014-1505 (bmo#941887) 通过 feDisplacementMap 泄露 SVG 过滤器信息

- MFSA 2014-29/CVE-2014-1510/CVE-2014-1511（bmo#982906、bmo#982909）使用 WebIDL 实现的 API 升级权限

- MFSA 2014-30/CVE-2014-1512 (bmo#982957) TypeObject 中的释放后使用

- MFSA 2014-31/CVE-2014-1513 (bmo#982974) 通过中立 ArrayBuffer 对象进行越界读取/写入

- MFSA 2014-32/CVE-2014-1514 (bmo#983344) 中立后通过 TypedArrayObject 进行越界写入

Mozilla Firefox ESR version 24.4 is now patched against multiple vulnerabilities, the most critical of which include:

 - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access through TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)
 - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)
 - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)
 - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)
 - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

SeaMonkey 2.25 is now patched against multiple vulnerabilities, the most critical of which include:

  - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access throuhg TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)

  - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)

  - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)

  - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)

  - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

Versions of Mozilla Firefox prior to 28.0 have been patched against multiple vulnerabilities, the most critical of which include:

 - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access through TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)
 - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)
 - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)
 - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)
 - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)

 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

Additionally, numerous other vulnerabilities have been patched. See reference links for details.

Versions of Mozilla Thunderbird prior to 24.4 are prone to the following vulnerabilities :

 - Out-of-bounds read/write access through ArrayBuffer objects, as well as out-of-bounds write access through TypedArrayObject, which enable remote code execution (CVE-2014-1513, CVE-2014-1514)
 - Use-after-free error in TypeObject due to possible memory corruption during Garbage Collection in the JS engine, which can be exploited for arbitrary code execution (CVE-2014-1512)
 - Privilege escalation using Web-IDL to call JS function 'window.open()', as well as a bug allowing bypass of the popup-blocker without user interaction, could allow an attacker to run arbitrary code with full privileges of the browser (CVE-2014-1510, CVE-2014-1511)
 - Out-of-bounds read during polygon rendering in MathML can be leveraged for information disclosure of protected memory address, especially when combined with timing attacks via SVG filters and displacement input to 'feDisplacementMap' (CVE-2014-1505, CVE-2014-1508)
 - Out-of-bounds read access during WAV file decoding could allow web countent to access heap data or cause a crash (CVE-2014-1497)
 - Miscellaneous memory safety hazards (CVE-2014-1493, CVE-2014-1494)

ID	Name	Product	Family	Published	Updated	Severity
73111	FreeBSD：mozilla -- 多种漏洞 (610de647-af8d-11e3-a25b-b4b52fce4ce8)	Nessus	FreeBSD Local Security Checks	3/20/2014	1/6/2021	critical
75333	openSUSE 安全更新：MozillaThunderbird / seamonkey (openSUSE-SU-2014:0584-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
701243	Mozilla Firefox ESR < 24.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	11/6/2019	11/6/2019	high
8172	SeaMonkey < 2.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/26/2014	3/6/2019	high
8171	Mozilla Firefox < 28.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/26/2014	11/6/2019	high
8173	Mozilla Thunderbird < 24.4 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	3/26/2014	3/6/2019	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high