Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation.

Versions of Mozilla Firefox ESR prior to 24.2 are prone to the following vulnerabilities :

 - Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)
 - Application Installation doorhanger does not get properly dismissed, which can be leveraged to trick a user into installing an application from one site while thinking it originated from another (CVE-2013-5611)
 - Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)
 - Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)
 - Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)
 - Binary search algorithms in the Javascript engine contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)
 - Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)
 - On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)
 - Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)
 - GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)
 - Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)
 - An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

This update fixes the following security issues with SeaMonkey :

  - update to SeaMonkey 2.23 (bnc#854370))

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - rebased patches :

  - mozilla-nongnome-proxies.patch

  - mozilla-shared-nss-db.patch

- update to Firefox 26.0 (bnc#854367, bnc#854370)

  - rebased patches

  - requires NSPR 4.10.2 and NSS 3.15.3.1

  - MFSA 2013-104/CVE-2013-5609/CVE-2013-5610 Miscellaneous     memory safety hazards

  - MFSA 2013-105/CVE-2013-5611 (bmo#771294) Application     Installation doorhanger persists on navigation

  - MFSA 2013-106/CVE-2013-5612 (bmo#871161) Character     encoding cross-origin XSS attack

  - MFSA 2013-107/CVE-2013-5614 (bmo#886262) Sandbox     restrictions not applied to nested object elements

  - MFSA 2013-108/CVE-2013-5616 (bmo#938341) Use-after-free     in event listeners

  - MFSA 2013-109/CVE-2013-5618 (bmo#926361) Use-after-free     during Table Editing

  - MFSA 2013-110/CVE-2013-5619 (bmo#917841) Potential     overflow in JavaScript binary search algorithms

  - MFSA 2013-111/CVE-2013-6671 (bmo#930281) Segmentation     violation when replacing ordered list elements

  - MFSA 2013-112/CVE-2013-6672 (bmo#894736) Linux clipboard     information disclosure though selection paste

  - MFSA 2013-113/CVE-2013-6673 (bmo#970380) Trust settings     for built-in roots ignored during EV certificate     validation

  - MFSA 2013-114/CVE-2013-5613 (bmo#930381, bmo#932449)     Use-after-free in synthetic mouse movement

  - MFSA 2013-115/CVE-2013-5615 (bmo#929261) GetElementIC     typed array stubs can be generated outside observed     typesets

  - MFSA 2013-116/CVE-2013-6629/CVE-2013-6630 (bmo#891693)     JPEG information leak

  - MFSA 2013-117 (bmo#946351) Mis-issued ANSSI/DCSSI     certificate (fixed via NSS 3.15.3.1)

  - removed gecko.js preference file as GStreamer is enabled     by default now

Mozilla Firefox has been updated to the 24.2.0 ESR security release.

This is a major upgrade from the 17 ESR release branch.

Security issues fixed :

  - Application Installation doorhanger persists on     navigation. (MFSA 2013-105). (CVE-2013-5611)

  - Miscellaneous memory safety hazards (rv:24.2). (MFSA     2013-104). (CVE-2013-5609)

  - Miscellaneous memory safety hazards (rv:26.0). (MFSA     2013-104). (CVE-2013-5610)

  - Character encoding cross-origin XSS attack. (MFSA     2013-106). (CVE-2013-5612)

  - Sandbox restrictions not applied to nested object     elements. (MFSA 2013-107). (CVE-2013-5614)

  - Use-after-free in event listeners. (MFSA 2013-108).
    (CVE-2013-5616)

  - Potential overflow in JavaScript binary search     algorithms. (MFSA 2013-110). (CVE-2013-5619)

  - Segmentation violation when replacing ordered list     elements. (MFSA 2013-111). (CVE-2013-6671)

  - Trust settings for built-in roots ignored during EV     certificate validation. (MFSA 2013-113). (CVE-2013-6673)

  - Use-after-free in synthetic mouse movement. (MFSA     2013-114). (CVE-2013-5613)

  - GetElementIC typed array stubs can be generated outside     observed typesets. (MFSA 2013-115). (CVE-2013-5615)

  - Linux clipboard information disclosure though selection     paste. (MFSA 2013-112). (CVE-2013-6672)

  - Use-after-free during Table Editing (MFSA 2013-109).
    (CVE-2013-5618)

New upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mozilla Firefox earlier than 26.0 are prone to the following vulnerabilities :

 - Miscellaneous memory safety hazards (CVE-2013-5609, CVE-2013-5610)
 - Application Installation doorhanger does not get properly dismissed, which can be leveraged to trick a user into installing an application from one site while thinking it originated from another (CVE-2013-5611)
 - Potential XSS vulnerability via cross-domain inheritance of charset (CVE-2013-5612)
 - Sandbox restrictions are not properly applied to nested object elements, which could be leveraged to bypass restrictions (CVE-2013-5614)
 - Use-after-free in event listeners, table editing user interface, synthetic mouse movement can lead to a potentially exploitable crash (CVE-2013-5616, CVE-2013-5613, CVE-2013-5618)
 - Binary search algorithms in the Javascript engine contain potential out-of-bounds array access, though these are not directly exploitable (CVE-2013-5619)
 - Segmentation violation when replacing ordered list elements in a document via script can lead to a potentially exploitable crash (CVE-2013-6671)
 - On Linux systems, clipboard content may be made accessible to web content when a user pastes a selection with a middle-click, which can lead to information disclosure (CVE-2013-6672)
 - Extended validation root certificates remain trusted even if the user has explicitly removes the trust. (CVE-2013-6673)
 - GetElementIC typed arrays can be generated outside observed typesets, with unknown security impact (CVE-2013-5615)
 - Issues in the JPEG image processing library can allow arbitrary memory to be read, as well as cross-domain theft (CVE-2013-6629, CVE-2013-6630)
 - An intermediary CA that is chained up to a root within Mozilla's root store was revoked for supplying an intermediate certificate that allowed a man-in-the-middle proxy to perform traffic management of domain names and IP addresses the certificate holder did not own or control.

The Mozilla Project reports :

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph Diehl discovered multiple memory safety issues in Firefox.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5609, CVE-2013-5610)

Myk Melez discovered that the doorhanger notification for web app installation could persist between page navigations. An attacker could potentially exploit this to conduct clickjacking attacks.
(CVE-2013-5611)

Masato Kinugawa discovered that pages with missing character set encoding information can inherit character encodings across navigations from another domain. An attacker could potentially exploit this to conduct cross-site scripting attacks. (CVE-2013-5612)

Daniel Veditz discovered that a sandboxed iframe could use an object element to bypass its own restrictions. (CVE-2013-5614)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in event listeners. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5618)

Dan Gohman discovered that binary search algorithms in Spidermonkey used arithmetic prone to overflow in several places. However, this is issue not believed to be exploitable. (CVE-2013-5619)

Tyson Smith and Jesse Schwartzentruber discovered a crash when inserting an ordered list in to a document using script. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-6671)

Vincent Lefevre discovered that web content could access clipboard data under certain circumstances, resulting in information disclosure.
(CVE-2013-6672)

Sijie Xia discovered that trust settings for built-in EV root certificates were ignored under certain circumstances, removing the ability for a user to manually untrust certificates from specific authorities. (CVE-2013-6673)

Tyson Smith, Jesse Schwartzentruber and Atte Kettunen discovered a use-after-free in functions for synthetic mouse movement handling. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5613)

Eric Faust discovered that GetElementIC typed array stubs can be generated outside observed typesets. An attacker could possibly exploit this to cause undefined behaviour with a potential security impact. (CVE-2013-5615)

Michal Zalewski discovered several issues with JPEG image handling. An attacker could potentially exploit these to obtain sensitive information. (CVE-2013-6629, CVE-2013-6630).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Firefox 26.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - An issue exists where the notification for a Web App     installation could persist from one website to another     website. This could be used by a malicious website to     trick a user into installing an application from one     website while making it appear to come from another     website. (CVE-2013-5611)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by multiple vulnerabilities :

  - Memory issues exist in the browser engine that could     result in a denial of service or arbitrary code     execution. (CVE-2013-5609, CVE-2013-5610)

  - An issue exists where the notification for a Web App     installation could persist from one website to another     website. This could be used by a malicious website to     trick a user into installing an application from one     website while making it appear to come from another     website. (CVE-2013-5611)

  - Cross-site scripting filtering evasion may be possible     due to character encodings being inherited from a     previously visited website when character set encoding     is missing from the current website. (CVE-2013-5612)

  - Two use-after-free vulnerabilities exist in the     functions for synthetic mouse movement handling.
    (CVE-2013-5613)

  - Sandbox restrictions may be bypassed because 'iframe     sandbox' restrictions are not properly applied to     'object' elements in sandboxed iframes. (CVE-2013-5614)

  - An issue exists in which 'GetElementIC' typed array     stubs can be generated outside observed typesets. This     could lead to unpredictable behavior with a potential     security impact. (CVE-2013-5615)

  - A use-after-free vulnerability exists when     interacting with event listeners from the mListeners     array.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5616)

  - A use-after-free vulnerability exists in the table     editing user interface of the editor during garbage     collection.  This could result in a denial of service or     arbitrary code execution. (CVE-2013-5618)

  - Memory issues exist in the binary search algorithms in     the SpiderMonkey JavaScript engine that could result in     a denial of service or arbitrary code execution.
    (CVE-2013-5619)

  - Issues exist with the JPEG format image processing with     Start Of Scan (SOS) and Define Huffman Table (DHT)     markers in the 'libjpeg' library.  This could allow     attackers to read arbitrary memory content as well as     cross-domain image theft. (CVE-2013-6629, CVE-2013-6630)

  - A memory issue exists when inserting an ordered list     into a document through a script that could result in a     denial of service or arbitrary code execution.
    (CVE-2013-6671)

  - Trust settings for built-in root certificates are     ignored during extended validation (EV) certificate     validation.  This removes the ability of users to     explicitly untrust root certificates from specific     certificate authorities. (CVE-2013-6673)

  - An intermediate certificate that is used by a man-in-     the-middle (MITM) traffic management device exists in     Mozilla's root certificate authorities.  Reportedly,     this certificate has been misused.

ID	Name	Product	Family	Severity
701241	Mozilla Firefox ESR < 24.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
75327	openSUSE Security Update : seamonkey (openSUSE-SU-2014:0008-1)	Nessus	SuSE Local Security Checks	critical
75241	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1918-1)	Nessus	SuSE Local Security Checks	critical
75240	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1917-1)	Nessus	SuSE Local Security Checks	critical
75239	openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1916-1)	Nessus	SuSE Local Security Checks	critical
71560	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	critical
71559	SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 8657)	Nessus	SuSE Local Security Checks	critical
71505	Fedora 20 : firefox-26.0-3.fc20 / thunderbird-24.2.0-3.fc20 / xulrunner-26.0-2.fc20 (2013-23519)	Nessus	Fedora Local Security Checks	critical
8070	Mozilla Firefox < 26.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
71452	FreeBSD : mozilla -- multiple vulnerabilities (dd116b19-64b3-11e3-868f-0025905a4771)	Nessus	FreeBSD Local Security Checks	critical
71374	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2052-1)	Nessus	Ubuntu Local Security Checks	critical
71365	Fedora 19 : firefox-26.0-2.fc19 / xulrunner-26.0-1.fc19 (2013-23127)	Nessus	Fedora Local Security Checks	critical
71347	Firefox < 26.0 Multiple Vulnerabilities	Nessus	Windows	critical
71344	Firefox < 26.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2013-5611

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical