PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.

Versions of Mozilla Firefox ESR versions earlier than 24.1 are affected by the following vulnerabilities :

 - Miscellaneous use-after-free issues in the browsing engine (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)
 - Memory corruption in the Javascript engine when using workers with direct proxy (CVE-2013-5602)
 - Use-after-free issues when interacting with HTML templates (CVE-2013-5603)
 - Security bypass via iframe injection using PDF.js (CVE-2013-5598)
 - Miscellaneous memory safety issues in the browser engine (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-1739)
 - Address spoofing in the addressbar via SELECT element, which can lead to clickjacking and other spoof attacks (CVE-2013-5593)
 - Access violation due to uninitialized data in XSLT processing (CVE-2013-5604)
 - Potential buffer/memory overflows in the Javascript engine (CVE-2013-5595)
 - Race condition causing a crash on extremely large pages (CVE-2013-5596)
 - A use-after-free issue during state change events when updating the offline cache (CVE-2013-5597)

Versions of Mozilla Firefox ESR prior to version 17.0.10 are prone to the following vulnerabilities :

 - Miscellaneous use-after-free issues in the browsing engine (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)
 - Memory corruption in the Javascript engine when using workers with direct proxy (CVE-2013-5602)
 - Use-after-free issues when interacting with HTML templates (CVE-2013-5603)
 - Security bypass via iframe injection using PDF.js (CVE-2013-5598)
 - Miscellaneous memory safety issues in the browser engine (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-1739)
 - Address spoofing in the addressbar via SELECT element, which can lead to clickjacking and other spoof attacks (CVE-2013-5593)
 - Access violation due to uninitialized data in XSLT processing (CVE-2013-5604)
 - Potential buffer/memory overflows in the Javascript engine (CVE-2013-5595)
 - Race condition causing a crash on extremely large pages (CVE-2013-5596)
 - A use-after-free issue during state change events when updating the offline cache (CVE-2013-5597)

The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Firefox, Thunderbird,       and SeaMonkey. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information, spoof       the address bar, conduct clickjacking attacks, bypass security       restrictions and protection mechanisms,  or have other unspecified       impact.
  Workaround :

    There are no known workarounds at this time.

- update to SeaMonkey 2.22 (bnc#847708)

  - rebased patches

  - requires NSS 3.15.2 or higher

  - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592     Miscellaneous memory safety hazards

  - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing     addressbar through SELECT element

  - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation     with XSLT and uninitialized data

  - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly     initialized memory and overflows in some JavaScript     functions

  - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle     collected object during image decoding

  - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free     when updating offline cache

  - MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass     of PDF.js checks using iframes

  - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601     (bmo#915210, bmo#915576, bmo#916685) Miscellaneous     use-after-free issues found through ASAN fuzzing

  - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory     corruption in workers

  - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free     in HTML document templates

MozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1.

Changes in MozillaFirefox :

  - requires NSS 3.15.2 or above

  - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592     Miscellaneous memory safety hazards

  - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing     addressbar through SELECT element

  - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation     with XSLT and uninitialized data

  - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly     initialized memory and overflows in some JavaScript     functions

  - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle     collected object during image decoding

  - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free     when updating offline cache

  - MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass     of PDF.js checks using iframes

  - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601     (bmo#915210, bmo#915576, bmo#916685) Miscellaneous     use-after-free issues found through ASAN fuzzing

  - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory     corruption in workers

  - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free     in HTML document templates

Changes in MozillaThunderbird :

  - requires NSS 3.15.2 or above

  - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592     Miscellaneous memory safety hazards

  - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing     addressbar through SELECT element

  - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation     with XSLT and uninitialized data

  - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly     initialized memory and overflows in some JavaScript     functions

  - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle     collected object during image decoding

  - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free     when updating offline cache

  - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601     (bmo#915210, bmo#915576, bmo#916685) Miscellaneous     use-after-free issues found through ASAN fuzzing

  - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory     corruption in workers

  - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free     in HTML document templates

  - update to Thunderbird 24.0.1

  - fqdn for smtp server name was not accepted (bmo#913785)

  - fixed crash in PL_strncasecmp (bmo#917955)

  - update Enigmail to 1.6

  - The passphrase timeout configuration in Enigmail is now     read and written from/to gpg-agent.

  - New dialog to change the expiry date of keys

  - New function to search for the OpenPGP keys of all     Address Book entries on a keyserver

  - removed obsolete enigmail-build.patch

Changes in xulrunner :

  - update to 17.0.10esr (bnc#847708)

  - require NSS 3.14.4 or above

  - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592     Miscellaneous memory safety hazards

  - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation     with XSLT and uninitialized data

  - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly     initialized memory and overflows in some JavaScript     functions

  - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free     when updating offline cache

  - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601     (bmo#915210, bmo#915576, bmo#916685) Miscellaneous     use-after-free issues found through ASAN fuzzing

  - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory     corruption in workers

  - update to 17.0.9esr (bnc#840485)

  - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow     when generating CRMF requests

  - MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety     hazards

  - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free     in Animation Manager during stylesheet cloning

  - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope     for new JavaScript objects can lead to memory corruption

  - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment     mismatch re-attaching XBL-backed nodes

  - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow     with multi-column, lists, and floats

  - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,     bmo#906301) Memory corruption involving scrolling

  - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined     properties on DOM proxies get the wrong 'this' object

Changes in mozilla-nspr :

  - update to version 4.10.1

  - bmo#888273: RWIN Scaling (RFC1323) limited to 2 on     Windows 7 and 8 (Windows only)

  - bmo#907512: Unix platforms shouldn't mask errors     specific to Unix domain sockets

Versions of Mozilla Thunderbird prior to version 24.1 are prone to the following vulnerabilities :

 - Miscellaneous use-after-free issues in the browsing engine (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)
 - Memory corruption in the Javascript engine when using workers with direct proxy (CVE-2013-5602)
 - Use-after-free issues when interacting with HTML templates (CVE-2013-5603)
 - Security bypass via iframe injection using PDF.js (CVE-2013-5598)
 - Miscellaneous memory safety issues in the browser engine (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-1739)
 - Address spoofing in the addressbar via SELECT element, which can lead to clickjacking and other spoof attacks (CVE-2013-5593)
 - Access violation due to uninitialized data in XSLT processing (CVE-2013-5604)
 - Potential buffer/memory overflows in the Javascript engine (CVE-2013-5595)
 - Race condition causing a crash on extremely large pages (CVE-2013-5596)
 - A use-after-free issue during state change events when updating the offline cache (CVE-2013-5597)

Versions of SeaMonkey earlier than version 25.0 are prone to the following vulnerabilities:

  - Miscellaneous use-after-free issues in the browsing engine (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)

  - Memory corruption in the Javascript engine when using workers with direct proxy (CVE-2013-5602)

  - Use-after-free issues when interacting with HTML templates (CVE-2013-5603)

  - Security bypass via iframe injection using PDF.js (CVE-2013-5598)

  - Miscellaneous memory safety issues in the browser engine (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-1739)

  - Address spoofing in the addressbar via SELECT element, which can lead to clickjacking and other spoof attacks (CVE-2013-5593)

  - Access violation due to uninitialized data in XSLT processing (CVE-2013-5604)

  - Potential buffer/memory overflows in the Javascript engine (CVE-2013-5595)

  - Race condition causing a crash on extremely large pages (CVE-2013-5596)

  - A use-after-free issue during state change events when updating the offline cache (CVE-2013-5597)

Versions of Mozilla Firefox earlier than 25.0 are affected by the following vulnerabilities :

 - Miscellaneous use-after-free issues in the browsing engine (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)
 - Memory corruption in the Javascript engine when using workers with direct proxy (CVE-2013-5602)
 - Use-after-free issues when interacting with HTML templates (CVE-2013-5603)
 - Security bypass via iframe injection using PDF.js (CVE-2013-5598)
 - Miscellaneous memory safety issues in the browser engine (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-1739)
 - Address spoofing in the addressbar via SELECT element, which can lead to clickjacking and other spoof attacks (CVE-2013-5593)
 - Access violation due to uninitialized data in XSLT processing (CVE-2013-5604)
 - Potential buffer/memory overflows in the Javascript engine (CVE-2013-5595)
 - Race condition causing a crash on extremely large pages (CVE-2013-5596)
 - A use-after-free issue during state change events when updating the offline cache (CVE-2013-5597)

The installed version of Firefox is earlier than 25.0 and is, therefore, potentially affected by the following vulnerabilities :

  - The implementation of Network Security Services (NSS)     does not ensure that data structures are initialized,     which could result in a denial of service or disclosure     of sensitive information. (2013-1739)

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592)

  - Arbitrary HTML content can be put into 'select'     elements.  This can be used to spoof the displayed     address bar, leading to clickjacking and other spoofing     attacks. (CVE-2013-5593)

  - Memory issues exist in the JavaScript engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5595, CVE-2013-5602)

  - A race condition exists during image collection on large     web pages that could result in a denial of service or     arbitrary code execution. (CVE-2013-5596)

  - Multiple use-after-free vulnerabilities exist that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5597, CVE-2013-5599, CVE-2013-5600,     CVE-2013-5601, CVE-2013-5603)

  - Improper handling of the 'IFRAME' element in PDF.js     could result in reading arbitrary files and arbitrary     JavaScript code execution. (CVE-2013-5598)

  - A stack-based buffer overflow in     txXPathNodeUtils::getBaseURI is possible due to     uninitialized data during XSLT processing.
    (CVE-2013-5604)

The installed version of Firefox ESR 24.x is earlier than 24.1, and is, therefore, potentially affected by the following vulnerabilities :

  - The implementation of Network Security Services (NSS)     does not ensure that data structures are initialized,     which could result in a denial of service or disclosure     of sensitive information. (2013-1739)

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592)

  - Arbitrary HTML content can be put into 'select'     elements.  This can be used to spoof the displayed     address bar, leading to clickjacking and other spoofing     attacks. (CVE-2013-5593)

  - Memory issues exist in the JavaScript engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5595, CVE-2013-5602)

  - A race condition exists during image collection on large     web pages that could result in a denial of service or     arbitrary code execution. (CVE-2013-5596)

  - Multiple use-after-free vulnerabilities exist that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5597, CVE-2013-5599, CVE-2013-5600,     CVE-2013-5601, CVE-2013-5603)

  - Improper handling of the 'IFRAME' element in PDF.js     could result in reading arbitrary files and arbitrary     JavaScript code execution. (CVE-2013-5598)

  - A stack-based buffer overflow in     txXPathNodeUtils::getBaseURI is possible due to     uninitialized data during XSLT processing.
    (CVE-2013-5604)

The installed version of Firefox is earlier than 25.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - The implementation of Network Security Services (NSS)     does not ensure that data structures are initialized,     which could result in a denial of service or disclosure     of sensitive information. (2013-1739)

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592)

  - Arbitrary HTML content can be put into 'select'     elements.  This can be used to spoof the displayed     address bar, leading to clickjacking and other spoofing     attacks. (CVE-2013-5593)

  - Memory issues exist in the JavaScript engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5595, CVE-2013-5602)

  - A race condition exists during image collection on large     web pages that could result in a denial of service or     arbitrary code execution. (CVE-2013-5596)

  - Multiple use-after-free vulnerabilities exist that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5597, CVE-2013-5599, CVE-2013-5600,     CVE-2013-5601, CVE-2013-5603)

  - Improper handling of the 'IFRAME' element in PDF.js     could result in reading arbitrary files and arbitrary     JavaScript code execution. (CVE-2013-5598)

  - A stack-based buffer overflow in     txXPathNodeUtils::getBaseURI is possible due to     uninitialized data during XSLT processing.
    (CVE-2013-5604)

The installed version of Firefox ESR 24.x is earlier than 24.1 and is, therefore, potentially affected by the following vulnerabilities :

  - The implementation of Network Security Services (NSS)     does not ensure that data structures are initialized,     which could result in a denial of service or disclosure     of sensitive information. (2013-1739)

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5590, CVE-2013-5591, CVE-2013-5592)

  - Arbitrary HTML content can be put into 'select'     elements.  This can be used to spoof the displayed     address bar, leading to clickjacking and other spoofing     attacks. (CVE-2013-5593)

  - Memory issues exist in the JavaScript engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5595, CVE-2013-5602)

  - A race condition exists during image collection on large     web pages that could result in a denial of service or     arbitrary code execution. (CVE-2013-5596)

  - Multiple use-after-free vulnerabilities exist that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5597, CVE-2013-5599, CVE-2013-5600,     CVE-2013-5601, CVE-2013-5603)

  - Improper handling of the 'IFRAME' element in PDF.js     could result in reading arbitrary files and arbitrary     JavaScript code execution. (CVE-2013-5598)

  - A stack-based buffer overflow in     txXPathNodeUtils::getBaseURI is possible due to     uninitialized data during XSLT processing.
    (CVE-2013-5604)

The Mozilla Project reports :

MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)

MFSA 2013-94 Spoofing addressbar though SELECT element

MFSA 2013-95 Access violation with XSLT and uninitialized data

MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions

MFSA 2013-97 Writing to cycle collected object during image decoding

MFSA 2013-98 Use-after-free when updating offline cache

MFSA 2013-99 Security bypass of PDF.js checks using iframes

MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing

MFSA 2013-101 Memory corruption in workers

MFSA 2013-102 Use-after-free in HTML document templates

Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1739, CVE-2013-5590, CVE-2013-5591, CVE-2013-5592)

Jordi Chancel discovered that HTML select elements could display arbitrary content. An attacker could potentially exploit this to conduct URL spoofing or clickjacking attacks (CVE-2013-5593)

Abhishek Arya discovered a crash when processing XSLT data in some circumstances. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox.
(CVE-2013-5604)

Dan Gohman discovered a flaw in the JavaScript engine. When combined with other vulnerabilities, an attacked could possibly exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5595)

Ezra Pool discovered a crash on extremely large pages. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5596)

Byoungyoung Lee discovered a use-after-free when updating the offline cache. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5597)

Cody Crews discovered a way to append an iframe in to an embedded PDF object displayed with PDF.js. An attacked could potentially exploit this to read local files, leading to information disclosure.
(CVE-2013-5598)

Multiple use-after-free flaws were discovered in Firefox. An attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601)

A memory corruption flaw was discovered in the JavaScript engine when using workers with direct proxies. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5602)

Abhishek Arya discovered a use-after-free when interacting with HTML document templates. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5603).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
701256	Mozilla Firefox ESR < 24.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
701239	Mozilla Firefox ESR < 17.0.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
82632	GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75216	openSUSE Security Update : seamonkey (openSUSE-SU-2013:1788-1)	Nessus	SuSE Local Security Checks	critical
75192	openSUSE Security Update : seamonkey (openSUSE-SU-2013:1644-1)	Nessus	SuSE Local Security Checks	critical
75186	openSUSE Security Update : Mozilla Suite (openSUSE-SU-2013:1633-1)	Nessus	SuSE Local Security Checks	critical
8046	Mozilla Thunderbird < 24.1 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	critical
8045	SeaMonkey < 2.22 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
8044	Mozilla Firefox < 25.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
70716	Firefox < 25.0 Multiple Vulnerabilities	Nessus	Windows	critical
70715	Firefox ESR 24.x < 24.1 Multiple Vulnerabilities	Nessus	Windows	critical
70711	Firefox < 25.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
70710	Firefox ESR 24.x < 24.1 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
70701	FreeBSD : mozilla -- multiple vulnerabilities (81f866ad-41a4-11e3-a4af-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
70698	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2009-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2013-5598

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical