Use-after-free vulnerability in the nsINode::GetParentNode function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a DOM modification at the time of a SetBody mutation event.

Changes in seamonkey :

  - update to SeaMonkey 2.20 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous     memory safety hazards

  - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free     mutating DOM during SetBody

  - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow     when generating CRMF requests

  - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV     audio file decoding

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of     XrayWrappers using XBL Scopes

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - requires NSPR 4.10 and NSS 3.15

  - removed obsolete seamonkey-shared-nss-db.patch

Changes in seamonkey :

  - update to SeaMonkey 2.20 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous     memory safety hazards

  - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free     mutating DOM during SetBody

  - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow     when generating CRMF requests

  - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV     audio file decoding

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of     XrayWrappers using XBL Scopes

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - requires NSPR 4.10 and NSS 3.15

  - removed obsolete seamonkey-shared-nss-db.patch

Changes in xulrunner :

  - update to 17.0.8esr (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety     hazards

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

Changes in xulrunner :

  - update to 17.0.8esr (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety     hazards

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

Changes in MozillaThunderbird :

  - update to Thunderbird 17.0.8 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety     hazards

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - update Enigmail to 1.5.2

  - bugfix release

Changes in MozillaThunderbird :

  - update to Thunderbird 17.0.8 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety     hazards

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - update Enigmail to 1.5.2

  - bugfix release

Changes in mozilla-nss :

  - fix 32bit requirement, it's without () actually

  - update to 3.15.1

  - TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher     suites (RFC 5246 and RFC 5289) are supported, allowing     TLS to be used without MD5 and SHA-1. Note the following     limitations: The hash function used in the signature for     TLS 1.2 client authentication must be the hash function     of the TLS 1.2 PRF, which is always SHA-256 in NSS     3.15.1. AES GCM cipher suites are not yet supported.

  - some bugfixes and improvements

  - require libnssckbi instead of mozilla-nss-certs so     p11-kit can conflict with the latter (fate#314991)

  - update to 3.15

  - Packaging

  + removed obsolete patches

  - nss-disable-expired-testcerts.patch

  - bug-834091.patch

  - New Functionality

  + Support for OCSP Stapling (RFC 6066, Certificate Status     Request) has been added for both client and server     sockets. TLS client applications may enable this via a     call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING,     PR_TRUE);

  + Added function SECITEM_ReallocItemV2. It replaces     function SECITEM_ReallocItem, which is now declared as     obsolete.

  + Support for single-operation (eg: not multi-part)     symmetric key encryption and decryption, via     PK11_Encrypt and PK11_Decrypt.

  + certutil has been updated to support creating name     constraints extensions.

  - New Functions in ssl.h SSL_PeerStapledOCSPResponse -     Returns the server's stapled OCSP response, when used     with a TLS client socket that negotiated the     status_request extension. SSL_SetStapledOCSPResponses -     Set's a stapled OCSP response for a TLS server socket to     return when clients send the status_request extension.
    in ocsp.h CERT_PostOCSPRequest - Primarily intended for     testing, permits the sending and receiving of raw OCSP     request/responses. in secpkcs7.h     SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a     PKCS#7 signature at a specific time other than the     present time. in xconst.h     CERT_EncodeNameConstraintsExtension - Matching function     for CERT_DecodeNameConstraintsExtension, added in NSS     3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray     SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions     to handle the allocation and deallocation of     SECItemArrays SECITEM_ReallocItemV2 - Replaces     SECITEM_ReallocItem, which is now obsolete.
    SECITEM_ReallocItemV2 better matches caller     expectations, in that it updates item->len on     allocation. For more details of the issues with     SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in     pk11pub.h PK11_Decrypt - Performs decryption as a single     PKCS#11 operation (eg: not multi-part). This is     necessary for AES-GCM. PK11_Encrypt - Performs     encryption as a single PKCS#11 operation (eg: not     multi-part). This is necessary for AES-GCM.

  - New Types in secitem.h SECItemArray - Represents a     variable-length array of SECItems.

  - New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with     SSL_OptionSet to configure TLS client sockets to request     the certificate_status extension (eg: OCSP stapling)     when set to PR_TRUE

  - Notable changes

  + SECITEM_ReallocItem is now deprecated. Please consider     using SECITEM_ReallocItemV2 in all future code.

  + The list of root CA certificates in the nssckbi module     has been updated.

  + The default implementation of SSL_AuthCertificate has     been updated to add certificate status responses stapled     by the TLS server to the OCSP cache.

  - a lot of bugfixes

  - Add Source URL, see https://en.opensuse.org/SourceUrls

Changes in mozilla-nss :

  - fix 32bit requirement, it's without () actually

  - update to 3.15.1

  - TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher     suites (RFC 5246 and RFC 5289) are supported, allowing     TLS to be used without MD5 and SHA-1. Note the following     limitations: The hash function used in the signature for     TLS 1.2 client authentication must be the hash function     of the TLS 1.2 PRF, which is always SHA-256 in NSS     3.15.1. AES GCM cipher suites are not yet supported.

  - some bugfixes and improvements

  - require libnssckbi instead of mozilla-nss-certs so     p11-kit can conflict with the latter (fate#314991)

  - update to 3.15

  - Packaging

  + removed obsolete patches

  - nss-disable-expired-testcerts.patch

  - bug-834091.patch

  - New Functionality

  + Support for OCSP Stapling (RFC 6066, Certificate Status     Request) has been added for both client and server     sockets. TLS client applications may enable this via a     call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING,     PR_TRUE);

  + Added function SECITEM_ReallocItemV2. It replaces     function SECITEM_ReallocItem, which is now declared as     obsolete.

  + Support for single-operation (eg: not multi-part)     symmetric key encryption and decryption, via     PK11_Encrypt and PK11_Decrypt.

  + certutil has been updated to support creating name     constraints extensions.

  - New Functions in ssl.h SSL_PeerStapledOCSPResponse -     Returns the server's stapled OCSP response, when used     with a TLS client socket that negotiated the     status_request extension. SSL_SetStapledOCSPResponses -     Set's a stapled OCSP response for a TLS server socket to     return when clients send the status_request extension.
    in ocsp.h CERT_PostOCSPRequest - Primarily intended for     testing, permits the sending and receiving of raw OCSP     request/responses. in secpkcs7.h     SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a     PKCS#7 signature at a specific time other than the     present time. in xconst.h     CERT_EncodeNameConstraintsExtension - Matching function     for CERT_DecodeNameConstraintsExtension, added in NSS     3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray     SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions     to handle the allocation and deallocation of     SECItemArrays SECITEM_ReallocItemV2 - Replaces     SECITEM_ReallocItem, which is now obsolete.
    SECITEM_ReallocItemV2 better matches caller     expectations, in that it updates item->len on     allocation. For more details of the issues with     SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in     pk11pub.h PK11_Decrypt - Performs decryption as a single     PKCS#11 operation (eg: not multi-part). This is     necessary for AES-GCM. PK11_Encrypt - Performs     encryption as a single PKCS#11 operation (eg: not     multi-part). This is necessary for AES-GCM.

  - New Types in secitem.h SECItemArray - Represents a     variable-length array of SECItems.

  - New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with     SSL_OptionSet to configure TLS client sockets to request     the certificate_status extension (eg: OCSP stapling)     when set to PR_TRUE

  - Notable changes

  + SECITEM_ReallocItem is now deprecated. Please consider     using SECITEM_ReallocItemV2 in all future code.

  + The list of root CA certificates in the nssckbi module     has been updated.

  + The default implementation of SSL_AuthCertificate has     been updated to add certificate status responses stapled     by the TLS server to the OCSP cache.

  - a lot of bugfixes

  - Add Source URL, see https://en.opensuse.org/SourceUrls

Changes in mozilla-nspr :

  - update to version 4.10

  - bmo#844513: Add AddressSanitizer (ASan) memory check     annotations to PLArena.

  - bmo#849089: Simple changes to make NSPR's configure.in     work with the current version of autoconf.

  - bmo#856196: Fix compiler warnings and clean up code in     NSPR 4.10.

  - bmo#859066: Fix warning in     nsprpub/pr/src/misc/prnetdb.c.

  - bmo#859830: Deprecate ANDROID_VERSION in favor of     android/api-level.h.

  - bmo#861434: Make PR_SetThreadPriority() change     priorities relatively to the main process instead of     using absolute values on Linux.

  - bmo#871064L: _PR_InitThreads() should not call     PR_SetThreadPriority.

Changes in mozilla-nspr :

  - update to version 4.10

  - bmo#844513: Add AddressSanitizer (ASan) memory check     annotations to PLArena.

  - bmo#849089: Simple changes to make NSPR's configure.in     work with the current version of autoconf.

  - bmo#856196: Fix compiler warnings and clean up code in     NSPR 4.10.

  - bmo#859066: Fix warning in     nsprpub/pr/src/misc/prnetdb.c.

  - bmo#859830: Deprecate ANDROID_VERSION in favor of     android/api-level.h.

  - bmo#861434: Make PR_SetThreadPriority() change     priorities relatively to the main process instead of     using absolute values on Linux.

  - bmo#871064L: _PR_InitThreads() should not call     PR_SetThreadPriority.

Changes in MozillaFirefox :

  - update to Firefox 23.0 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous     memory safety hazards

  - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free     mutating DOM during SetBody

  - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow     when generating CRMF requests

  - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV     audio file decoding

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of     XrayWrappers using XBL Scopes

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - requires NSPR 4.10 and NSS 3.15

  - fix build on ARM (/-g/ matches /-grecord-switches/)

Changes in MozillaFirefox :

  - update to Firefox 23.0 (bnc#833389)

  - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous     memory safety hazards

  - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free     mutating DOM during SetBody

  - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow     when generating CRMF requests

  - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV     audio file decoding

  - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI     misrepresentation and masquerading

  - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests     allow for code execution and XSS attacks

  - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of     XrayWrappers using XBL Scopes

  - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal     used for validating URI for some JavaScript components

  - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin     bypass with web workers and XMLHttpRequest

  - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397)     Local Java applets may read contents of local file     system

  - requires NSPR 4.10 and NSS 3.15

  - fix build on ARM (/-g/ matches /-grecord-switches/)

The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced       below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Further, a remote attacker could conduct XSS       attacks, spoof URLs, bypass address space layout randomization, conduct       clickjacking attacks, obtain potentially sensitive information, bypass       access restrictions, modify the local filesystem, or conduct other       unspecified attacks.
  Workaround :

    There is no known workaround at this time.

The Mozilla Project reports :

MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)

MFSA 2013-64 Use after free mutating DOM during SetBody

MFSA 2013-65 Buffer underflow when generating CRMF requests

MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater

MFSA 2013-67 Crash during WAV audio file decoding

MFSA 2013-68 Document URI misrepresentation and masquerading

MFSA 2013-69 CRMF requests allow for code execution and XSS attacks

MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes

MFSA 2013-71 Further Privilege escalation through Mozilla Updater

MFSA 2013-72 Wrong principal used for validating URI for some JavaScript components

MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest

MFSA 2013-74 Firefox full and stub installer DLL hijacking

MFSA 2013-75 Local Java applets may read contents of local file system

Versions of Mozilla Firefox earlier than version 23.0 are prone to the following vulnerabilities:

  - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)

  - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)

  - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)

  - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)

  - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)

  - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)

  - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)

  - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)

  - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)

  - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)

  - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)

  - A DLL hijacking vulnerability occurs that leads to arbitrary code execution. This issue affects the Firefox Full installer and Stub installer. (CVE-2013-1715)

  - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of Mozilla SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities:

  - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)

  - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)

  - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)

  - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)

  - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)

  - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)

  - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)

  - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)

  - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)

  - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)

  - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)

  - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of Mozilla Firefox earlier than version 23.0 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - A DLL hijacking vulnerability occurs that leads to arbitrary code execution. This issue affects the Firefox Full installer and Stub installer. (CVE-2013-1715)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)
 - Stored cross-site scripting vulnerability due to insufficient input validation of 'data:' URLs in iframe elements. (CVE-2013-6674)

The installed version of SeaMonkey is a version prior to 2.20. It is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

The installed version of Thunderbird is a version prior to 17.0.8 and is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - Errors exist related to the update service and     'maintenanceservice.exe' that could allow buffer     overflows when handling unexpectedly long path values.
    (CVE-2013-1706, CVE-2013-1707)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - DLL path loading errors exist related to the update     service, full installer and the stub installer that     could allow execution of arbitrary code.
    (CVE-2013-1712, CVE-2013-1715)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

The installed version of Firefox is earlier than 23.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - Errors exist related to the update service and     'maintenanceservice.exe' that could allow buffer     overflows when handling unexpectedly long path values.
    (CVE-2013-1706, CVE-2013-1707)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - DLL path loading errors exist related to the update     service, full installer and the stub installer that     could allow execution of arbitrary code.
    (CVE-2013-1712, CVE-2013-1715)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

The installed version of Thunderbird is earlier than 17.0.8 and is, therefore, potentially affected by the following vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

The installed version of Firefox is earlier than 23.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - Various errors exist that could allow memory corruption     conditions. (CVE-2013-1701, CVE-2013-1702)

  - Use-after-free errors exist related to DOM modification     when using 'SetBody' and generating a 'Certificate     Request Message'. (CVE-2013-1704, CVE-2013-1705)

  - An error exists in the function 'nsCString::CharAt'     that could allow application crashes when decoding     specially crafted WAV audio files. (CVE-2013-1708)

  - Unspecified errors exist related to HTML frames and     history handling, 'XrayWrappers', JavaScript URI     handling and web workers using 'XMLHttpRequest' that     could allow cross-site scripting attacks.
    (CVE-2013-1709, CVE-2013-1711, CVE-2013-1713,     CVE-2013-1714)

  - An unspecified error exists related to generating     'Certificate Request Message Format' (CRMF) requests     that could allow cross-site scripting attacks.
    (CVE-2013-1710)

  - An error exists related to Java applets and 'file:///'     URIs that could allow read-only access to arbitrary     files. (CVE-2013-1717)

USN-1924-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubufox and Unity Firefox Extension.

Jeff Gilbert, Henrik Skupin, Ben Turner, Christian Holler, Andrew McCreight, Gary Kwong, Jan Varga and Jesse Ruderman discovered multiple memory safety issues in Firefox. If the user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1701, CVE-2013-1702)

A use-after-free bug was discovered when the DOM is modified during a SetBody mutation event. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1704)

A use-after-free bug was discovered when generating a CRMF request with certain parameters. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1705)

Aki Helin discovered a crash when decoding a WAV file in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1708)

It was discovered that a document's URI could be set to the URI of a different document. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2013-1709)

A flaw was discovered when generating a CRMF request in certain circumstances. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1710)

Bobby Holley discovered that XBL scopes could be used to circumvent XrayWrappers in certain circumstances. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks or cause undefined behaviour. (CVE-2013-1711)

Cody Crews discovered that some JavaScript components performed security checks against the wrong URI, potentially bypassing same-origin policy restrictions. An attacker could exploit this to conduct cross-site scripting (XSS) attacks or install addons from a malicious site. (CVE-2013-1713)

Federico Lanusse discovered that web workers could bypass cross-origin checks when using XMLHttpRequest. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2013-1714)

Georgi Guninski and John Schoenick discovered that Java applets could access local files under certain circumstances. An attacker could potentially exploit this to steal confidential data. (CVE-2013-1717).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jeff Gilbert, Henrik Skupin, Ben Turner, Christian Holler, Andrew McCreight, Gary Kwong, Jan Varga and Jesse Ruderman discovered multiple memory safety issues in Firefox. If the user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1701, CVE-2013-1702)

A use-after-free bug was discovered when the DOM is modified during a SetBody mutation event. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1704)

A use-after-free bug was discovered when generating a CRMF request with certain parameters. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1705)

Aki Helin discovered a crash when decoding a WAV file in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1708)

It was discovered that a document's URI could be set to the URI of a different document. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2013-1709)

A flaw was discovered when generating a CRMF request in certain circumstances. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1710)

Bobby Holley discovered that XBL scopes could be used to circumvent XrayWrappers in certain circumstances. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks or cause undefined behaviour. (CVE-2013-1711)

Cody Crews discovered that some JavaScript components performed security checks against the wrong URI, potentially bypassing same-origin policy restrictions. An attacker could exploit this to conduct cross-site scripting (XSS) attacks or install addons from a malicious site. (CVE-2013-1713)

Federico Lanusse discovered that web workers could bypass cross-origin checks when using XMLHttpRequest. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2013-1714)

Georgi Guninski and John Schoenick discovered that Java applets could access local files under certain circumstances. An attacker could potentially exploit this to steal confidential data. (CVE-2013-1717).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75122	openSUSE Security Update : MozillaFirefox / MozillaThunderbird / mozilla-nspr / etc (openSUSE-SU-2013:1348-1)	Nessus	SuSE Local Security Checks	critical
70183	GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
69278	FreeBSD : mozilla -- multiple vulnerabilities (0998e79d-0055-11e3-905b-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
801463	Mozilla Firefox < 23.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium
801462	Mozilla SeaMonkey < 2.20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium
6978	Mozilla Firefox < 23.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6977	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
69272	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus	Windows	critical
69270	Mozilla Thunderbird < 17.0.8 Multiple Vulnerabilities	Nessus	Windows	critical
69269	Firefox < 23.0 Multiple Vulnerabilities	Nessus	Windows	critical
69266	Thunderbird < 17.0.8 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
69265	Firefox < 23.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
69235	Ubuntu 12.04 LTS / 12.10 / 13.04 : ubufox, unity-firefox-extension update (USN-1924-2)	Nessus	Ubuntu Local Security Checks	critical
69234	Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1924-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2013-1704

high

Tenable Plugins

critical

critical

critical

medium

medium

high

high

critical

critical

critical

critical

critical

critical

critical