Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21, allows remote attackers to execute arbitrary code via a crafted web site.

This seamonkey update to version 2.21 fixes several security and non-security issues :

  - update to SeaMonkey 2.21 (bnc#840485)

  - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous     memory safety hazards

  - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state     in HTML5 Tree Builder with templates

  - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow     in ANGLE library

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey     continues handling key messages after widget is     destroyed

  - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free     with select element

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized     data in IonMonkey

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

  - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC     hazard with default compartments and frame chain     restoration

  - requires NSS 3.15.1

This MozillaFirefox update to version 24.0 fixes several security and non-security issues :

  - move greek to the translations-common package     (bnc#840551)

  - update to Firefox 24.0 (bnc#840485)

  - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous     memory safety hazards

  - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state     in HTML5 Tree Builder with templates

  - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow     in ANGLE library

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey     continues handling key messages after widget is     destroyed

  - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free     with select element

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized     data in IonMonkey

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

  - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC     hazard with default compartments and frame chain     restoration

  - enable gstreamer explicitely via pref (gecko.js)

  - require NSS 3.15.1

The Mozilla Project reports :

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

MFSA 2013-78 Integer overflow in ANGLE library

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning

MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed

MFSA 2013-81 Use-after-free with select element

MFSA 2013-82 Calling scope for new JavaScript objects can lead to memory corruption

MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification

MFSA 2013-84 Same-origin bypass through symbolic links

MFSA 2013-85 Uninitialized data in IonMonkey

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers

MFSA 2013-87 Shared object library loading from writable location

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

MFSA 2013-90 Memory corruption involving scrolling

MFSA 2013-91 User-defined properties on DOM proxies get the wrong 'this' object

MFSA 2013-92 GC hazard with default compartments and frame chain restoration

Upstream security update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735,     CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service     attack. (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution. Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities:

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch could result in a     denial of service or arbitrary code execution. Versions     of Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An input validation error exists related to email     messages containing HTML and iframes and the action of     replying to or forwarding such messages that could     allow cross-site scripting attacks. (CVE-2013-6674)

  - An input validation error exists related to email     messages containing HTML and object or embed elements     that could allow cross-site scripting attacks.
    (CVE-2014-2018)

The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist that could result     in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735,     CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments could result in denial of service or     possibly arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker could     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch can result in a denial     of service or arbitrary code execution.  Versions of     Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This could     result in access restrictions being bypassed.
    (CVE-2013-1737)

The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist in the browser engine that could     allow for denial of service or arbitrary code execution.
    (CVE-2013-1718, CVE-2013-1719)

  - The HTML5 Tree Builder does not properly maintain     states, which could result in a denial of service or     possible arbitrary code execution.  (CVE-2013-1720)

  - The ANGLE library is vulnerable to an integer overflow,     which could result in a denial of service or arbitrary     code execution. (CVE-2013-1721)

  - Multiple use-after-free problems exist, which could     result in denial of service attacks or arbitrary code     execution. (CVE-2013-1722, CVE-2013-1724,     CVE-2013-1735, CVE-2013-1736, CVE-2013-1738)

  - The NativeKey widget does not properly terminate key     messages, possibly leading to a denial of service attack.
    (CVE-2013-1723)

  - Incorrect scope handling for JavaScript objects with     compartments can result in denial of service or possibly     arbitrary code execution. (CVE-2013-1725)

  - Local users can gain the same privileges as the Mozilla     Updater because the application does not ensure     exclusive access to the update file. An attacker can     exploit this by inserting a malicious file into the     update file. (CVE-2013-1726)

  - Sensitive information can be obtained via unspecified     vectors because the IonMonkey JavaScript does not     properly initialize memory. (CVE-2013-1728)

  - A JavaScript compartment mismatch can result in a denial     of service or arbitrary code execution.  Versions of     Firefox 20 or greater are not susceptible to the     arbitrary code execution mentioned above.
    (CVE-2013-1730)

  - A buffer overflow is possible because of an issue with     multi-column layouts. (CVE-2013-1732)

  - An object is not properly identified during use of     user-defined getter methods on DOM proxies.  This can     result in access restrictions being bypassed.
    (CVE-2013-1737)

  - An issue in the NVIDIA OS X graphic drivers allows the     user's desktop to be viewed by web content, potentially     exposing sensitive information. (CVE-2013-1729)

Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2013-1718)

Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. If a user had scripting enabled, in some circumstances an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1720)

Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1721)

Abhishek Arya discovered a use-after-free in the Animation Manager. If a user had scripting enabled, an attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1722)

Scott Bell discovered a use-after-free when using a select element. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1724)

It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. If a user had scripting enabled, an attacker could potentially exploit this to execute code with the privileges of the user invoking Thunderbird.
(CVE-2013-1725)

Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728)

Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730)

Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1732)

Two memory corruption bugs when scrolling were discovered. If a user had scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2013-1735, CVE-2013-1736)

Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. If a user had scripting enabled, an attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737)

A use-after-free bug was discovered in Thunderbird. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1738).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of SeaMonkey earlier than version 2.21 are prone to the following vulnerabilities:

  - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)

  - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)

  - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)

  - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)

  - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)

  - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)

  - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)

  - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)

  - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)

  - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)

  - An integer overflow in the Almost Native Graphics Layer Engine (ANGLE) can lead to a potentially exploitable crash (CVE-2013-1721)

  - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)

  - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

Versions of Mozilla Firefox earlier than version 24.0 are prone to the following vulnerabilities :

 - use-after-free vulnerability in the Garbage Collector could allow a remote attacker to execute arbitrary code in the context of the user. (CVE-2013-1738)
 - user-defined getters on DOM proxies would incorrectly get the expando object when accessing the "this" object, which may not be directly exploitable but could lead to incorrect security sensitive decisions. (CVE-2013-1737)
 - Combining lists, floats, and multiple columns in a layout could trigger a potentially exploitable buffer overflow. (CVE-2013-1732)
 - Compartment mismatch when moving XBL-backed nodes into a new document can lead cause a crash (CVE-2013-1730)
 - flaw in the NVIDIA OS X graphic drivers would allow portions of a user's desktop or other visible applications to be incorporated into WebGL canvases, leading to potential information disclosure (CVE-2013-1729)
 - uninitialized data and variables in the IonMonkey Javascript engine can be used with additional exploits to allow access to previously allocated memory (CVE-2013-1728)
 - Same-origin bypass through symbolic links can allow for cross-site scripting and access to locally stored Firefox containing sensitive user data (CVE-2013-1727)
 - the MAR update file is not write-locked when used by the Mozilla Updater, which can allow the altering of the MAR file content after its signature has been checked but before it has been used. (CVE-2013-1726)
 - Calling scope for new Javascript objects with compartments can lead to memory corruption (CVE-2013-1725)
 - A use-after-free vulnerability via the <select> element could lead to a potentially exploitable crash (CVE-2013-1724)
 - the NativeKey widget continues handling key messages even when it is destroyed by dispatched event listeners, which can lead to an unexploitable crash (CVE-2013-1723)
 - Use-after-free in Animation Manager during stylesheet cloning can lead to a potentially exploitable crash (CVE-2013-1722)
 - An integer overflow in the Almost Native Graphics Layer Engine (ANGLE) can lead to a potentially exploitable crash (CVE-2013-1721)
 - Incorrectly stored stack information in the HTML5 Tree Builder can lead to code execution (CVE-2013-1720)  - Various memory corruption vulnerabilities (CVE-2013-1735, CVE-2013-1736, CVE-2013-1718, CVE-2013-1719)

Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1718, CVE-2013-1719)

Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. In some circumstances, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1720)

Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox.
(CVE-2013-1721)

Abhishek Arya discovered a use-after-free in the Animation Manager. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1722)

Scott Bell discovered a use-after-free when using a select element. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1724)

It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-1725)

Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728)

Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730)

Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1732)

Two memory corruption bugs when scrolling were discovered. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1735, CVE-2013-1736)

Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. An attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737)

A use-after-free bug was discovered in Firefox. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1738).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75151	openSUSE Security Update : seamonkey (openSUSE-SU-2013:1491-1)	Nessus	SuSE Local Security Checks	critical
75149	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1493-1)	Nessus	SuSE Local Security Checks	critical
70262	FreeBSD : mozilla -- multiple vulnerabilities (7dfed67b-20aa-11e3-b8d8-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
70205	Fedora 18 : firefox-24.0-1.fc18 / xulrunner-24.0-2.fc18 (2013-17047)	Nessus	Fedora Local Security Checks	critical
70062	Fedora 20 : firefox-24.0-1.fc20 / xulrunner-24.0-2.fc20 (2013-17074)	Nessus	Fedora Local Security Checks	critical
70036	Fedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)	Nessus	Fedora Local Security Checks	critical
69996	SeaMonkey < 2.21 Multiple Vulnerabilities	Nessus	Windows	critical
69995	Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities	Nessus	Windows	critical
69993	Firefox < 24.0 Multiple Vulnerabilities	Nessus	Windows	critical
69989	Firefox < 24.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
69970	Ubuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1952-1)	Nessus	Ubuntu Local Security Checks	critical
8012	SeaMonkey < 2.21 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8010	Mozilla Firefox < 24.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
69947	Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1951-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2013-1721

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical