The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

The version of Firefox installed on the remote Mac OS X host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

  - An information disclosure vulnerability exists due to     the CoreGraphic framework creating log files containing     sensitive information in the '/tmp' directory.
    (CVE-2014-1595)

The version of Firefox installed on the remote Windows host is a version prior to 34.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists due to the     'XrayWrappers' filter not properly validating object     properties. This allows a remote attacker to bypass     security protection mechanisms to access protected     objects. (CVE-2014-8631)

  - A security bypass vulnerability exists due to Chrome     Object Wrappers (COW) being passed as native interfaces.
    This allows a remote attacker to access normally     protected objects. (CVE-2014-8632)

  - A remote code execution vulnerability exists in Mozilla     Network Security Services (NSS) due to a flaw in     'quickder.c' that is triggered when handling PKCS#1     signatures during the decoding of ASN.1 DER.
    (CVE-2014-1569)

  - Multiple memory safety flaws exist within the browser     engine. Exploiting these, an attacker can cause a denial     of service or execute arbitrary code. (CVE-2014-1587,     CVE-2014-1588)

  - A security bypass vulnerability exists due improper     declaration of chrome accessible CSS primary namespaces     allowing for XML Binding Language (XBL) bindings to be     triggered remotely. (CVE-2014-1589)

  - A denial of service vulnerability exists due to     improper parsing of a JavaScript object to the     XMLHttpRequest API which can result in a crash.
    (CVE-2014-1590)

  - An information disclosure vulnerability exists due to     Content Security Policy (CSP) violation reports     triggered by a redirect not properly removing path     information which can reveal sensitive information.
    Note that this only affects Firefox 33. (CVE-2014-1591)

  - A use-after-free error exists due the creation of a     second XML root element when parsing HTML written to a     document created with 'document.open()' function which     can result in arbitrary code execution. (CVE-2014-1592)

  - A buffer overflow vulnerability exists in the     'mozilla::FileBlockCache::Read' function when parsing     media which can result in arbitrary code execution.
    (CVE-2014-1593)

  - A casting error exists when casting from the     'BasicThebesLayer' layer to the 'BasicContainerLayer'     layer which can result in arbitrary code execution.
    (CVE-2014-1594)

Versions of Mozilla Firefox earlier than 34.0 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

Versions of Mozilla Firefox ESR earlier than 31.3 are unpatched for the following vulnerabilities :

 - Security Bypass that can be leveraged when processing specially crafted Chrome-based CSS stylesheets with improperly declared namespaces. (CVE-2014-1589)
 - Information Disclosure due to the way Content Security Policy leaks data through violation reports. (CVE-2014-1591)
 - Multiple Unspecified Memory Corruption Vulnerabilities. (CVE-2014-1587)(CVE-2014-1588)
 - Multiple Local Information Disclosure Vulnerabilities requiring interactive access to exploit. (CVE-2014-1595)
 - Security Vulnerability due to bad casting from 'BasicThebesLayer' to 'BasicContainerLayer'. (CVE-2014-1594)
 - Denial of Service Vulnerability can occur when passing a js object to 'XMLHttpRequest' that mimics an input stream. (CVE-2014-1590)
 - Use After Free Memory Corruption Vulnerability when creating a second root element during the parsing of an HTML5 document which contains 'document.open()'. (CVE-2014-1592)
 - Buffer Overflow Vulnerability when handling specially crafted media content. (CVE-2014-1593)
 - A flaw exists and is triggered as 'XrayWrappers' filter objects are not properly validated when stored in the program. This may allow a context-dependent attacker to bypass security protection mechanisms. (CVE-2014-8632)

ID	Name	Product	Family	Published	Updated	Severity
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/8/2015	1/11/2021	critical
79662	Firefox < 34.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	12/2/2014	11/25/2019	high
79665	Firefox < 34.0 Multiple Vulnerabilities	Nessus	Windows	12/2/2014	11/25/2019	high
8588	Mozilla Firefox < 34.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	12/4/2014	11/6/2019	medium
701249	Mozilla Firefox ESR < 31.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	11/6/2019	11/6/2019	medium

Detections

Analytics

Plugins Search

critical

high

high

medium

medium