The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2505-1 advisory.

    Matthew Noorenberghe discovered that Mozilla domains in the allowlist could make UITour API calls from     background tabs. If one of these domains were compromised and open in a background tab, an attacker could

    potentially exploit this to conduct clickjacking attacks. (CVE-2015-0819)

    Jan de Mooij discovered an issue that affects content using the Caja Compiler. If web content loads     specially crafted code, this could be used to bypass sandboxing security measures provided by Caja.
    (CVE-2015-0820)

    Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a     Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to bypass security     restrictions. (CVE-2015-0821)

    Armin Razmdjou discovered that contents of locally readable files could be made available via manipulation     of form autocomplete in some circumstances. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-0822)

    Atte Kettunen discovered a use-after-free in the OpenType Sanitiser (OTS) in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash. (CVE-2015-0823)

    Atte Kettunen discovered a crash when drawing images using Cairo in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0824)

    Atte Kettunen discovered a buffer underflow during playback of MP3 files in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     obtain sensitive information. (CVE-2015-0825)

    Atte Kettunen discovered a buffer overflow during CSS restyling in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0826)

    Abhishek Arya discovered an out-of-bounds read and write when rendering SVG content in some circumstances.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to obtain sensitive information. (CVE-2015-0827)

    A buffer overflow was discovered in libstagefright during video playback in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-0829)

    Daniele Di Proietto discovered that WebGL could cause a crash in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service. (CVE-2015-0830)

    Paul Bandha discovered a use-after-free in IndexedDB. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0831)

    Muneaki Nishimura discovered that a period appended to a hostname could bypass key pinning and HSTS in     some circumstances. A remote attacker could potentially exloit this to conduct a Machine-in-the-middle     (MITM) attack. (CVE-2015-0832)

    Alexander Kolesnik discovered that Firefox would attempt plaintext connections to servers when handling     turns: and stuns: URIs. A remote attacker could potentially exploit this by conducting a Machine-in-the-     middle (MITM) attack in order to obtain credentials. (CVE-2015-0834)

    Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Liz Henry, Byron Campen, Tom Schuster, Ryan     VanderMeulen, Christian Holler, Jesse Ruderman, Randell Jesup, Robin Whittleton, Jon Coppeard, and Nikhil     Marathe discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-0835, CVE-2015-0836)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MozillaFirefox, mozilla-nss were updated to fix 18 security issues.

MozillaFirefox was updated to version 36.0. These security issues were fixed :

  - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory     safety hazards

  - CVE-2015-0832: Appended period to hostnames can bypass     HPKP and HSTS protections

  - CVE-2015-0830: Malicious WebGL content crash when     writing strings

  - CVE-2015-0834: TLS TURN and STUN connections silently     fail to simple TCP connections

  - CVE-2015-0831: Use-after-free in IndexedDB

  - CVE-2015-0829: Buffer overflow in libstagefright during     MP4 video playback

  - CVE-2015-0828: Double-free when using non-default memory     allocators with a zero-length XHR

  - CVE-2015-0827: Out-of-bounds read and write while     rendering SVG content

  - CVE-2015-0826: Buffer overflow during CSS restyling

  - CVE-2015-0825: Buffer underflow during MP3 playback

  - CVE-2015-0824: Crash using DrawTarget in Cairo graphics     library

  - CVE-2015-0823: Use-after-free in Developer Console date     with OpenType Sanitiser

  - CVE-2015-0822: Reading of local files through     manipulation of form autocomplete

  - CVE-2015-0821: Local files or privileged URLs in pages     can be opened into new tabs

  - CVE-2015-0819: UI Tour whitelisted sites in background     tab can spoof foreground tabs

  - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass

mozilla-nss was updated to version 3.17.4 to fix the following issues :

  - CVE-2014-1569: QuickDER decoder length issue     (bnc#910647).

  - bmo#1084986: If an SSL/TLS connection fails, because     client and server don't have any common protocol version     enabled, NSS has been changed to report error code     SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting     SSL_ERROR_NO_CYPHER_OVERLAP).

  - bmo#1112461: libpkix was fixed to prefer the newest     certificate, if multiple certificates match.

  - bmo#1094492: fixed a memory corruption issue during     failure of keypair generation.

  - bmo#1113632: fixed a failure to reload a PKCS#11 module     in FIPS mode.

  - bmo#1119983: fixed interoperability of NSS server code     with a LibreSSL client.

The version of Firefox installed on the remote Windows host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The Mozilla Project reports :

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

Mozilla Firefox has been updated to version 31.5.0 ESR to fix five security issues.

These security issues have been fixed :

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 31.5 allowed remote     attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (bnc#917597).
    (CVE-2015-0836)

  - Heap-based buffer overflow in the mozilla::gfx::CopyRect     function in Mozilla Firefox before 31.5 allowed remote     attackers to obtain sensitive information from     uninitialized process memory via a malformed SVG     graphic. (bnc#917597). (CVE-2015-0827)

  - Multiple unspecified vulnerabilities in the browser     engine in Mozilla Firefox before 36.0 allowed remote     attackers to cause a denial of service (memory     corruption and application crash) or possibly execute     arbitrary code via unknown vectors. (bnc#917597).
    (CVE-2015-0835)

  - Use-after-free vulnerability in the     mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex     function in Mozilla Firefox before 31.5 allowed remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via crafted content     that is improperly handled during IndexedDB index     creation. (bnc#917597). (CVE-2015-0831)

  - The Form Autocompletion feature in Mozilla Firefox     before 31.5 allowed remote attackers to read arbitrary     files via crafted JavaScript code. (bnc#917597).
    (CVE-2015-0822)

These non-security issues have been fixed :

  - Reverted desktop file name back to     MozillaFirefox.desktop. (bnc#916196, bnc#917100)

  - Obsolete subpackages of firefox-gcc47 from SLE11-SP1/2,     that caused problems when upgrading to SLE11-SP3     (bnc#917300)

Mozilla Firefox was updated to version 31.5.0 ESR to fix five security issues.

These security issues were fixed :

  - CVE-2015-0836: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 31.5     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors (bnc#917597).

  - CVE-2015-0827: Heap-based buffer overflow in the     mozilla::gfx::CopyRect function in Mozilla Firefox     before 31.5 allowed remote attackers to obtain sensitive     information from uninitialized process memory via a     malformed SVG graphic (bnc#917597).

  - CVE-2015-0835: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 36.0     allowed remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     execute arbitrary code via unknown vectors (bnc#917597).

  - CVE-2015-0831: Use-after-free vulnerability in the     mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex     function in Mozilla Firefox before 31.5 allowed remote     attackers to execute arbitrary code or cause a denial of     service (heap memory corruption) via crafted content     that is improperly handled during IndexedDB index     creation (bnc#917597).

  - CVE-2015-0822: The Form Autocompletion feature in     Mozilla Firefox before 31.5 allowed remote attackers to     read arbitrary files via crafted JavaScript code     (bnc#917597).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Thunderbird installed on the remote Mac OS X host is prior to 31.5. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox installed on the remote Mac OS X host is prior to 36.0. It is, therefore, affected by the following vulnerabilities :

  - An issue exists that allows whitelisted Mozilla domains     to make 'UITour' API calls while UI Tour pages are     present in background tabs. This allows an attacker, via     a compromised Mozilla domain, to engage in spoofing and     clickjacking in any foreground tab. (CVE-2015-0819)

  - An issue exists related to sandbox libraries, including     the Caja Compiler, which allows JavaScript objects to be     marked as extensible even though the objects were     initially marked as non-extensible. (CVE-2015-0820)

  - An issue exists when opening hyperlinks on a page with     the mouse and specific keyboard key combinations that     allows a Chrome privileged URL to be opened without     context restrictions being preserved. Additionally, the     issue allows the opening of local files and resources     from a known location to be opened with local     privileges, bypassing security protections.
    (CVE-2015-0821)

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - A use-after-free error exists with the OpenType     Sanitiser (OTS) when expanding macros. (CVE-2015-0823)

  - An issue exists in the DrawTarget() function of the     Cairo graphics library that allows an attacker cause a     segmentation fault, resulting in a denial of service.
    (CVE-2015-0824)

  - A buffer underflow issue exists during audio playback of     invalid MP3 audio files. (CVE-2015-0825)

  - An out-of-bounds read issue exists while restyling and     reflowing changes of web content with CSS, resulting in     a denial of service condition or arbitrary code     execution. (CVE-2015-0826)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A double-free issue exists when sending a zero-length     XmlHttpRequest (XHR) object due to errors in memory     allocation when using different memory allocator     libraries than 'jemalloc'. This allows an attacker to     crash the application. (CVE-2015-0828)

  - A buffer overflow issue exists in the 'libstagefright'     library when processing invalid MP4 video files,     resulting in a denial of service condition or arbitrary     code execution. (CVE-2015-0829)

  - An unspecified issue exists that allows an attacker, via     specially crafted WebGL content, to cause a denial of     service condition. (CVE-2015-0830)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists when a period is appended to a hostname     that results in a bypass of the Public Key Pinning     Extension for HTTP (HPKP) and HTTP Strict Transport     Security (HSTS) when certificate pinning is set to     strict mode. An attacker can exploit this issue to     perform man-in-the-middle attacks if the attacker has a     security certificate for a domain with the added period.
    (CVE-2015-0832)

  - An information disclosure vulnerability exists due to     the lack of TLS support for connections to TURN and STUN     servers, resulting in cleartext connections.
    (CVE-2015-0834)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

The version of Firefox ESR 31.x installed on the remote Windows host is prior to 31.5. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists related     to the autocomplete feature that allows an attacker to     read arbitrary files. (CVE-2015-0822)

  - An out-of-bounds read and write issue exists when     processing invalid SVG graphic files. This allows an     attacker to disclose sensitive information.
    (CVE-2015-0827)

  - A use-after-free issue exists when running specific web     content with 'IndexedDB' to create an index, resulting     in a denial of service condition or arbitrary code     execution. (CVE-2015-0831)

  - An issue exists in the Mozilla updater in which DLL     files in the current working directory or Windows     temporary directories will be loaded, allowing the     execution of arbitrary code. Note that hosts are only     affected if the updater is not run by the Mozilla     Maintenance Service. (CVE-2015-0833)

  - Multiple unspecified memory safety issues exist within     the browser engine. (CVE-2015-0835, CVE-2015-0836)

ID	Name	Product	Family	Published	Updated	Severity
81544	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2505-1)	Nessus	Ubuntu Local Security Checks	2/26/2015	8/27/2024	medium
81589	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-185)	Nessus	SuSE Local Security Checks	3/2/2015	1/19/2021	high
81521	Firefox < 36 Multiple Vulnerabilities	Nessus	Windows	2/25/2015	6/23/2026	high
81588	FreeBSD : mozilla -- multiple vulnerabilities (99029172-8253-407d-9d8b-2cfeab9abf81)	Nessus	FreeBSD Local Security Checks	3/2/2015	1/6/2021	high
81697	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 10373)	Nessus	SuSE Local Security Checks	3/9/2015	1/6/2021	high
83691	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:0412-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/6/2021	high
81519	Mozilla Thunderbird < 31.5 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2/25/2015	11/25/2019	high
81518	Firefox < 36.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	2/25/2015	3/3/2026	high
81520	Firefox ESR 31.x < 31.5 Multiple Vulnerabilities	Nessus	Windows	2/25/2015	6/23/2026	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

high

high